* [dm-crypt] LiveUSB encrypted. @ 2011-11-09 18:41 Marcos Barbosa 2011-11-09 20:34 ` Arno Wagner 0 siblings, 1 reply; 8+ messages in thread From: Marcos Barbosa @ 2011-11-09 18:41 UTC (permalink / raw) To: dm-crypt [-- Attachment #1: Type: text/plain, Size: 186 bytes --] How i create a Ubuntu liveUSB inside a USB stick? The trick: The casper files is inside a encrypted partition with LUKS. any ideas? -- Marcos Barbosa <marcosestevesbarbosa@gmail.com> [-- Attachment #2: Type: text/html, Size: 334 bytes --] ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [dm-crypt] LiveUSB encrypted. 2011-11-09 18:41 [dm-crypt] LiveUSB encrypted Marcos Barbosa @ 2011-11-09 20:34 ` Arno Wagner 2011-11-09 21:26 ` Marcos Barbosa 0 siblings, 1 reply; 8+ messages in thread From: Arno Wagner @ 2011-11-09 20:34 UTC (permalink / raw) To: dm-crypt You don't. What you do instead is use an encrypted data partition, which may be supported by some Ubuntu tool. The problem is that the kernel and an initrd have to reside outside of the encrypted space. There is no way around that. As a consequence, an attacker can already modify those two and get complete control. If you are worried about this, use some form of physical protection. Weak protection comes from using write-once media like a CD-R. Stronger comes from using an encrypted memory-stick with keypad. (Beware, there are secure and insecure ones on the market.) You can also ware the stick around your neck. Arno On Wed, Nov 09, 2011 at 04:41:44PM -0200, Marcos Barbosa wrote: > How i create a Ubuntu liveUSB inside a USB stick? > The trick: The casper files is inside a encrypted partition with LUKS. > > any ideas? > > -- > Marcos Barbosa <marcosestevesbarbosa@gmail.com> > _______________________________________________ > dm-crypt mailing list > dm-crypt@saout.de > http://www.saout.de/mailman/listinfo/dm-crypt -- Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F ---- Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans If it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." -- Bruce Schneier ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [dm-crypt] LiveUSB encrypted. 2011-11-09 20:34 ` Arno Wagner @ 2011-11-09 21:26 ` Marcos Barbosa 2011-11-10 10:30 ` Arno Wagner 0 siblings, 1 reply; 8+ messages in thread From: Marcos Barbosa @ 2011-11-09 21:26 UTC (permalink / raw) To: dm-crypt [-- Attachment #1: Type: text/plain, Size: 1920 bytes --] Hello Arno, I can survive if kernel and initrd stay in a separated partition. May be i create a script to generate hash and sign them. If I use a separated partition, what is the next logical step? 2011/11/9 Arno Wagner <arno@wagner.name> > You don't. What you do instead is use an encrypted > data partition, which may be supported by some > Ubuntu tool. > > The problem is that the kernel and an initrd have to > reside outside of the encrypted space. There is no > way around that. As a consequence, an attacker can > already modify those two and get complete control. > > If you are worried about this, use some form of > physical protection. Weak protection comes from using > write-once media like a CD-R. Stronger comes from > using an encrypted memory-stick with keypad. (Beware, > there are secure and insecure ones on the market.) > You can also ware the stick around your neck. > > Arno > > On Wed, Nov 09, 2011 at 04:41:44PM -0200, Marcos Barbosa wrote: > > How i create a Ubuntu liveUSB inside a USB stick? > > The trick: The casper files is inside a encrypted partition with LUKS. > > > > any ideas? > > > > -- > > Marcos Barbosa <marcosestevesbarbosa@gmail.com> > > > _______________________________________________ > > dm-crypt mailing list > > dm-crypt@saout.de > > http://www.saout.de/mailman/listinfo/dm-crypt > > > -- > Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: > arno@wagner.name > GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 > 338F > ---- > Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans > > If it's in the news, don't worry about it. The very definition of > "news" is "something that hardly ever happens." -- Bruce Schneier > _______________________________________________ > dm-crypt mailing list > dm-crypt@saout.de > http://www.saout.de/mailman/listinfo/dm-crypt > -- Marcos Barbosa <marcosestevesbarbosa@gmail.com> [-- Attachment #2: Type: text/html, Size: 2912 bytes --] ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [dm-crypt] LiveUSB encrypted. 2011-11-09 21:26 ` Marcos Barbosa @ 2011-11-10 10:30 ` Arno Wagner 2011-11-10 11:00 ` Milan Broz 0 siblings, 1 reply; 8+ messages in thread From: Arno Wagner @ 2011-11-10 10:30 UTC (permalink / raw) To: dm-crypt Hi Marcos, I actually do not know in detail. Basically you need a bootloader to load kernel and initrd, and the initrd then needs to decrypt the encrypted root partition and mount it as such. Personally I do not use initrd in my own installations. For encrypted data on USB, an encrypted user area is quite enough for me. (I use knoppix, it offers to create one when booted from USB stick the first time). There are some people on the list, that have worked on something like you want. Maybe search the archves and ask them directly. Arno On Wed, Nov 09, 2011 at 07:26:26PM -0200, Marcos Barbosa wrote: > Hello Arno, > > I can survive if kernel and initrd stay in a separated partition. May be i > create a script to generate hash and sign them. If I use a separated > partition, what is the next logical step? > > 2011/11/9 Arno Wagner <arno@wagner.name> > > > You don't. What you do instead is use an encrypted > > data partition, which may be supported by some > > Ubuntu tool. > > > > The problem is that the kernel and an initrd have to > > reside outside of the encrypted space. There is no > > way around that. As a consequence, an attacker can > > already modify those two and get complete control. > > > > If you are worried about this, use some form of > > physical protection. Weak protection comes from using > > write-once media like a CD-R. Stronger comes from > > using an encrypted memory-stick with keypad. (Beware, > > there are secure and insecure ones on the market.) > > You can also ware the stick around your neck. > > > > Arno > > > > On Wed, Nov 09, 2011 at 04:41:44PM -0200, Marcos Barbosa wrote: > > > How i create a Ubuntu liveUSB inside a USB stick? > > > The trick: The casper files is inside a encrypted partition with LUKS. > > > > > > any ideas? > > > > > > -- > > > Marcos Barbosa <marcosestevesbarbosa@gmail.com> > > > > > _______________________________________________ > > > dm-crypt mailing list > > > dm-crypt@saout.de > > > http://www.saout.de/mailman/listinfo/dm-crypt > > > > > > -- > > Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: > > arno@wagner.name > > GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 > > 338F > > ---- > > Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans > > > > If it's in the news, don't worry about it. The very definition of > > "news" is "something that hardly ever happens." -- Bruce Schneier > > _______________________________________________ > > dm-crypt mailing list > > dm-crypt@saout.de > > http://www.saout.de/mailman/listinfo/dm-crypt > > > > > > -- > Marcos Barbosa <marcosestevesbarbosa@gmail.com> > _______________________________________________ > dm-crypt mailing list > dm-crypt@saout.de > http://www.saout.de/mailman/listinfo/dm-crypt -- Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F ---- Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans If it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." -- Bruce Schneier ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [dm-crypt] LiveUSB encrypted. 2011-11-10 10:30 ` Arno Wagner @ 2011-11-10 11:00 ` Milan Broz 2011-11-10 11:44 ` Arno Wagner 0 siblings, 1 reply; 8+ messages in thread From: Milan Broz @ 2011-11-10 11:00 UTC (permalink / raw) To: dm-crypt On 11/10/2011 11:30 AM, Arno Wagner wrote: > I actually do not know in detail. Basically you need a > bootloader to load kernel and initrd, and the initrd then needs > to decrypt the encrypted root partition and mount it as such. grub2 boor loader should be able to decrypt full LUKS mapping without initramfs. Milan ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [dm-crypt] LiveUSB encrypted. 2011-11-10 11:00 ` Milan Broz @ 2011-11-10 11:44 ` Arno Wagner 2011-11-10 13:27 ` Nikolay Kichukov 0 siblings, 1 reply; 8+ messages in thread From: Arno Wagner @ 2011-11-10 11:44 UTC (permalink / raw) To: dm-crypt That would be nice. And a reason to switch bootloaders. Arno On Thu, Nov 10, 2011 at 12:00:36PM +0100, Milan Broz wrote: > On 11/10/2011 11:30 AM, Arno Wagner wrote: > > I actually do not know in detail. Basically you need a > > bootloader to load kernel and initrd, and the initrd then needs > > to decrypt the encrypted root partition and mount it as such. > > grub2 boor loader should be able to decrypt full LUKS mapping without initramfs. > > Milan > _______________________________________________ > dm-crypt mailing list > dm-crypt@saout.de > http://www.saout.de/mailman/listinfo/dm-crypt > -- Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F ---- Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans If it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." -- Bruce Schneier ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [dm-crypt] LiveUSB encrypted. 2011-11-10 11:44 ` Arno Wagner @ 2011-11-10 13:27 ` Nikolay Kichukov 2011-11-10 14:32 ` Marcos Barbosa 0 siblings, 1 reply; 8+ messages in thread From: Nikolay Kichukov @ 2011-11-10 13:27 UTC (permalink / raw) To: dm-crypt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 It SHOULD. When I have attempted to make it boot I failed. The module was in beta development back then, maybe this have changed now. Cheers, - -Nik On 11/10/2011 01:44 PM, Arno Wagner wrote: > That would be nice. And a reason to switch bootloaders. > > Arno > > On Thu, Nov 10, 2011 at 12:00:36PM +0100, Milan Broz wrote: >> On 11/10/2011 11:30 AM, Arno Wagner wrote: >>> I actually do not know in detail. Basically you need a >>> bootloader to load kernel and initrd, and the initrd then needs >>> to decrypt the encrypted root partition and mount it as such. >> >> grub2 boor loader should be able to decrypt full LUKS mapping without initramfs. >> >> Milan >> _______________________________________________ >> dm-crypt mailing list >> dm-crypt@saout.de >> http://www.saout.de/mailman/listinfo/dm-crypt >> > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJOu9FEAAoJEDFLYVOGGjgXf5QH/A+gPnSg0YFi/ankNoaE4uln DxHM+EnV9jwWq41tCDwjnWY9RbZRFs3Ac4azzJD8lW1/SNsMNQ1xV5ZWExUBlbYs 6xGyccG001bILiEfMcB3AOs4F7MaKLMSIbuyR+wcIcyLdU4/fvAmAK/OxdnO/zf7 KJjK/Ha0c5QRQ28AcOKBvOozRb8Ed6axB3ugpHGFYYVd1oo55PBfk/kgZlVJ8qk4 hb1Feoo0BdhgeVxK2DBAAo49dDMDv+V5t75GYQtGAtDeHxfLDz87lqvMx0hYT8We M3IjoQvvcz9KhuV5G4n3R8oneXARbXX+3zlFq35rnWlG9ncTxr4ELxZBCWIlnX0= =Hx2j -----END PGP SIGNATURE----- ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [dm-crypt] LiveUSB encrypted. 2011-11-10 13:27 ` Nikolay Kichukov @ 2011-11-10 14:32 ` Marcos Barbosa 0 siblings, 0 replies; 8+ messages in thread From: Marcos Barbosa @ 2011-11-10 14:32 UTC (permalink / raw) To: dm-crypt [-- Attachment #1: Type: text/plain, Size: 1855 bytes --] Thanks guys. Any details about the use of GRUB2 to decrypt? parameters, etc. or a link to documentation? 2011/11/10 Nikolay Kichukov <hijacker@oldum.net> > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > It SHOULD. > > When I have attempted to make it boot I failed. The module was in beta > development back then, maybe this have changed now. > > Cheers, > - -Nik > > On 11/10/2011 01:44 PM, Arno Wagner wrote: > > That would be nice. And a reason to switch bootloaders. > > > > Arno > > > > On Thu, Nov 10, 2011 at 12:00:36PM +0100, Milan Broz wrote: > >> On 11/10/2011 11:30 AM, Arno Wagner wrote: > >>> I actually do not know in detail. Basically you need a > >>> bootloader to load kernel and initrd, and the initrd then needs > >>> to decrypt the encrypted root partition and mount it as such. > >> > >> grub2 boor loader should be able to decrypt full LUKS mapping without > initramfs. > >> > >> Milan > >> _______________________________________________ > >> dm-crypt mailing list > >> dm-crypt@saout.de > >> http://www.saout.de/mailman/listinfo/dm-crypt > >> > > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.11 (GNU/Linux) > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ > > iQEcBAEBAgAGBQJOu9FEAAoJEDFLYVOGGjgXf5QH/A+gPnSg0YFi/ankNoaE4uln > DxHM+EnV9jwWq41tCDwjnWY9RbZRFs3Ac4azzJD8lW1/SNsMNQ1xV5ZWExUBlbYs > 6xGyccG001bILiEfMcB3AOs4F7MaKLMSIbuyR+wcIcyLdU4/fvAmAK/OxdnO/zf7 > KJjK/Ha0c5QRQ28AcOKBvOozRb8Ed6axB3ugpHGFYYVd1oo55PBfk/kgZlVJ8qk4 > hb1Feoo0BdhgeVxK2DBAAo49dDMDv+V5t75GYQtGAtDeHxfLDz87lqvMx0hYT8We > M3IjoQvvcz9KhuV5G4n3R8oneXARbXX+3zlFq35rnWlG9ncTxr4ELxZBCWIlnX0= > =Hx2j > -----END PGP SIGNATURE----- > _______________________________________________ > dm-crypt mailing list > dm-crypt@saout.de > http://www.saout.de/mailman/listinfo/dm-crypt > -- Marcos Barbosa <marcosestevesbarbosa@gmail.com> [-- Attachment #2: Type: text/html, Size: 2833 bytes --] ^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2011-11-10 14:32 UTC | newest] Thread overview: 8+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2011-11-09 18:41 [dm-crypt] LiveUSB encrypted Marcos Barbosa 2011-11-09 20:34 ` Arno Wagner 2011-11-09 21:26 ` Marcos Barbosa 2011-11-10 10:30 ` Arno Wagner 2011-11-10 11:00 ` Milan Broz 2011-11-10 11:44 ` Arno Wagner 2011-11-10 13:27 ` Nikolay Kichukov 2011-11-10 14:32 ` Marcos Barbosa
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.