|[Home] [Credit Search] [Category Browser] [Staff Roll Call]||The LINUX.COM Article Archive|
|Originally Published: Wednesday, 3 November 1999||Author: Quentin Cregan|
|Published to: enchance_articles_security/Advanced Security Articles||Page: 1/1 - [Std View]|
Transparent Cryptographic FileSystem
As a minimum, you will have to patch to at least version 2.2.9 of the linux kernel before continuing. There are further instructions on applying patches in the Details section later in this document.
Kernel source can be found at:ftp://ftp.kerneli.org/ There is a HOWTO on the process of recompiling kernels at: http://metalab.unc.edu/LDP/HOWTO/ This document may be reproduced and distributed in whole or in part, without fee, subject to the following conditions:
Different types of encryption can be used, including XOR, DES, twofish, blowfish, cast128, serpent, MARS, RC6, DFC, and IDEA. The program 'losetup' (loopback setup) is what associates your encrypted file with a filesystem and it's cipher type. According to Alexander Kjeldaas, who maintains kerneli.org and the international crypto patches, DES and losetup are currently incompatible. This is due to differences in the way the two handle parity bits. There are no plans to support DES as it is much more insecure than the other ciphers.
Twofish, blowfish, cast128, and serpent are all licensed free for any use. The others may or may not have licensing restrictions. Several of them are candidates for the AES standard. The finalists will provide royalty free use of their ciphers worldwide.
This document uses the serpent algorithm because it is strong yet remarkably fast, and it's freely distributable under the GPL. According to it's documentation, serpent uses a 128-bit block cipher designed by Ross Anderson, Eli Biham and Lars Knudsen. It provides users with the highest practical level of assurance that no shortcut attacks will be found. The documentation on serpent as well as the source code can be found at:
Details for these steps in the next section. I thought it would be nice to provide a summary first to provide reference (if you are experienced with unix/linux you probably don't need the details anyway). Here they are summarized as follows:
/dev/loop0 /mnt/crypt ext2 user,noauto,rw,loop 0 0
dd if=/dev/zero of=/etc/cryptfile bs=1k count=1000
You only have one chance to enter the password, be careful. If you want to double-check your password, you can use the command:
losetup -e serpent /dev/loop0 /etc/cryptfile
This will deactivate your loop device. Next you will run losetup again to test your password, as follows:
losetup -d /dev/loop0
losetup -e serpent /dev/loop0 /etc/cryptfile
mkfs -t ext2 /dev/loop0 100000
mount -t ext2 /dev/loop0 /mnt/crypt
umount /dev/loop0 losetup -d /dev/loop0'
You can upgrade from '2.2.x' releases by patching. Each patch that is released for '2.2.x' contains bugfixes. New features will be added to the Linux '2.3.x' development kernel. To install by patching, get all the newer patch files and do the following:
Repeat xx for all versions bigger than the version of your current source tree, IN ORDER.
cd /usr/src gzip -cd patchXX.gz ¦ patch -p0
The default directory for the kernel source is '/usr/src/linux'. If your source is installed somewhere else, I would suggest using a symbolic link from '/usr/src/linux'. Editing 'MCONFIG' for the 'util-linux' package compilation: The following are excerpts from the 'MCONFIG' file I used to compile the 'util-linux' package. Note that this is fairly specific for my setup, which is loosely based on RedHat 5.2. The point is to make sure you don't overwrite any important system tools such as 'login', 'getty', or 'passwd'. Anyway, here are the important lines as follows:
Suggestions: Note that you could use any of the eight loopback devices, from 'dev/loop0' to '/dev/loop7'. Use an inconspicuous directory for the mount point. I would suggest creating a folder with 700 permissions inside your home folder. The same goes for the file that holds the data. I use a filename like 'sysfile' or 'config.data' inside the '/etc' folder. This will usually get overlooked.
CPU=$(shell uname -m ¦ sed s/I.86/intel/) LOCALEDIR=/usr/share/locale HAVE_PAM=no HAVE_SHADOW=yes HAVE_PASSWD=yes REQUIRE_PASSWORD=yes ONLY_LISTED_SHELLS=yes HAVE_SYSVINIT=yes HAVE_SYSVINIT_UTILS=yes HAVE_GETTY=yes USE_TTY_GROUP=yes HAVE_RESET=yes HAVE_SLN=yes CC=gcc
I created very simple Perl scripts to mount and unmount the filesystem with one command. Write these, make them executable (chmod u+x), and store them somewhere in your path.
#!/usr/bin/perl -w # #simple utility to setup loopback encryption filesystem #Copyright 1999 by Ryan T. Rhea $cmd1 = `losetup -e serpent /dev/loop0 /etc/cryptfile`; $cmd2 = `mount /mnt/crypt`; print $cmd1; print $cmd2;
Name the above script 'loop', and then you can be on your way with one command ('loop') and a password.
#!/usr/bin/perl -w # #simple utility to deactivate loopback encryption filesystem #Copyright 1999 by Ryan T. Rhea $cmd1 = `umount /mount/crypt`; $cmd2 = `losetup -d /dev/loop0`; print $cmd1; print $cmd2;
Name the second one 'unloop', and then typing 'unloop' will quickly deactivate your filesystem.