If you carry around business information on your laptop, it's a good idea to encrypt /tmp and the swap volume, and not only your home directory. You could already do this with a little scripting on Fedora Core 6. With Fedora 7, it got a little easier. First, create /etc/crypttab with the following content:

swap    /dev/vg1/swap   /dev/urandom    swap,cipher=aes-cbc-essiv:sha256
tmp     /dev/vg1/tmp    /dev/urandom    tmp,cipher=aes-cbc-essiv:sha256

In /etc/fstab you only list the swap volume:

/dev/mapper/swap        none            swap    defaults        0 0

Because the encrypted volumes are created after /etc/fstab is processed, the following script has to take care of mounting /tmp:

#!/bin/bash
#
# cryptotmp setup crypted tmp partition
#
# chkconfig: 2345 01 90
# description: adds crypted tmp partition.

. /etc/init.d/functions

# See how we were called.
case "$1" in
    start)
        mount /dev/mapper/tmp /tmp
        restorecon /tmp

        action "Adding encrypted tmp"

        touch /var/lock/subsys/cryptotmp
        ;;
    stop)
        rm -f /var/lock/subsys/cryptotmp
        ;;
    *)
        echo $"Usage: $0 {start|stop}"
        exit 1
esac

exit 0

Save it as /etc/init.d/cryptotmp and run

chmod +x /etc/init.d/cryptotmp
chkconfig --add cryptotmp

When the system boots, it overwrites the contents of /dev/vg1/swap and /dev/vg1/tmp, using a random key for encryption. Once the system shuts down, the content will no longer be accessible, as the encryption key is not stored anywhere.

Warning: The above configuration erases /dev/vg1/swap and /dev/vg1/tmp when the system boots. Files stored in /tmp are lost when the system is shut down. Also, suspend to disk does not work with an encrypted swap volume.

14:30, 12 Jun 2007 by Carsten Clasohm Permalink | Comments (2)

RSS

Archive

June 2007
S M T W T F S
         
10  11  12  13  14  15  16 
17  18  19  20  21  22  23 
24  25  26  27  28  29  30 
September 2008
July 2008
June 2007
May 2007
March 2007
January 2007
December 2006
September 2006
June 2006
April 2006
March 2006
February 2006
January 2006
November 2005
October 2005
September 2005
August 2005
July 2005
June 2005
May 2005
April 2005
March 2005
January 2005
December 2004
November 2004
October 2004

Blog Categories

Hiking (5)
Desktop Linux (28)
Server Linux (5)
Palm (3)
Photography (5)
Politics (2)
Web Applications (15)

Notifications

Request notifications

Syndication Feed

RSS

Recent Comments

  1. Anonymous Visitor: Thanks
  2. Anonymous Visitor: AT&T U.S.
  3. Anonymous Visitor: All went well under CentOS 5.0 in Croatia (VIP network)
  4. Anonymous Visitor: tmp crypt not necessary
  5. Anonymous Visitor: Great article
  6. Anonymous Visitor: So it's not a Virus...
  7. Anonymous Visitor: Thanks! Helps also on Windows!
  8. Anonymous Visitor: Thank you
  9. Anonymous Visitor: Economic Incentives
  10. Anonymous Visitor: thank you