There seems to be plenty of documentation out there on how to create an encrypted filesystem, although I didn’t find any of it really gave me the answers I wanted in easy steps from 1 to 10. This is my attempt to provide some simple instructions based on Debian Sarge with a 2.6.x kernel.<\/p>\n
Firstly, note that the preferred method under 2.6.x is to use dm_crypt instead of the older cryptoloop method in kernel 2.4.x. In my experience, all the modules are built as part of the default kernel, so compiling a custom kernel probably isn’t required. The following guide includes steps for checking this.<\/p>\n
Install required packages<\/b>
\napt-get install cryptsetup hashalot<\/i><\/p>\n
Check Device-Mapper exists:<\/b>
\nls -L \/dev\/mapper\/control<\/i>
\nIf not, add dm_mod to \/etc\/modules<\/p>\n
Check AES encryption is enabled:<\/b>
\ncat \/proc\/crypto<\/i>
\nThis should return:
\nname : aes
\nmodule : aes_i586
\ntype : cipher
\nblocksize : 16
\nmin keysize : 16
\nmax keysize : 32
\nIf not, add aes to \/etc\/modules<\/p>\n
Check versions<\/b>
\ndmsetup targets<\/i>
\nShould return:
\ncrypt v1.1.0 (v1.0.0 is okay)
\nstriped v1.0.2 (v1.01 is okay)
\nlinear v1.0.1
\nerror v1.0.1<\/p>\n
Setup the encrypted device<\/b>
\ncryptsetup -y create foo \/dev\/hda4<\/i>
\nThis creates an encrypted device called foo using device hda4, (This could be an md device for RAID support)
\nThe -y switch causes the user to be prompted twice for the passphrase and verifies they are the same.<\/p>\n
Check it worked okay<\/b>
\ndmsetup ls<\/i>
\nThis should return something like:
\nfoo (253, 0)<\/p>\n
Format the new device<\/b>
\nmkfs -t ext3 \/dev\/mapper\/foo<\/i><\/p>\n
Mount the new device<\/b>
\nmount \/dev\/mapper\/foo \/crypto<\/i>
\nThis assumes you want the encrypted filesystem to be mounted in \/crypto.<\/p>\n
Make it permanent<\/b>
\nEdit \/etc\/crypttab and insert the new crypto device
\n# <target device> <source device> <key file> <options>
\nfoo \/dev\/hda4
\nWARNING: This will result in a passphrase prompt during the boot process. If you haven’t got local access to the box, don’t do it!!<\/b><\/p>\n
Mount the device on boot<\/b>
\nEdit the \/etc\/fstab file and insert the new mount point:
\n\/dev\/mapper\/foo \/crypto defaults 0 1
\nThis of course implies that you’ve done the above step and automated the mount.<\/p>\n
Non-automated mounting<\/b>
\ncryptsetup create foo \/dev\/hda4<\/i>
\nPassword prompted for here
\nmount \/dev\/mapper\/foo \/crypto<\/i><\/p>\n
Unmounting the crypto filesystem<\/b>
\numount \/dev\/mapper\/foo<\/i>
\ncryptsetup remove foo<\/i><\/p>\n","protected":false},"excerpt":{"rendered":"
My efforts to load an encrypted filesystem under Debian Sarge using a 2.6 kernel<\/p>\n","protected":false},"author":24,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-24","post","type-post","status-publish","format-standard","hentry","category-debian","entry"],"_links":{"self":[{"href":"https:\/\/blog.stmellion.org\/index.php?rest_route=\/wp\/v2\/posts\/24","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.stmellion.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.stmellion.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.stmellion.org\/index.php?rest_route=\/wp\/v2\/users\/24"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.stmellion.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=24"}],"version-history":[{"count":0,"href":"https:\/\/blog.stmellion.org\/index.php?rest_route=\/wp\/v2\/posts\/24\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.stmellion.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.stmellion.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.stmellion.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}