encrypted SWAP FAQ item
Dear all,
I just have added a mini-HOWOT on how to set up encrypted swap in FAQ item 2.2:
http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions
Proofreading and suggestions welcome.
Arno
Signature · 7 lines
Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: [email protected] GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718 ---- There are two ways of constructing a software design: One way is to make it so simple that there are obviously no deficiencies, and the other way is to make it so complicated that there are no obvious deficiencies. The first method is far more difficult. --Tony Hoare
Quoted 9 lines · Arno Wagner
Dear all,
I just have added a mini-HOWOT on how to set up encrypted swap in FAQ item 2.2:
http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestionsProofreading and suggestions welcome.
i just gazed over it and noticed a typo "sisks" instead of "disks".Its on the second line on the paragraph that starts with "Warning: While Debian refuse..."
Thanks, fixed.
Arno
Quoted 19 lines · .. ink ..
Quoted 9 lines · Arno Wagner
Dear all,
I just have added a mini-HOWOT on how to set up encrypted swap in FAQ item 2.2:
http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestionsProofreading and suggestions welcome.
i just gazed over it and noticed a typo "sisks" instead of "disks".Its on the second line on the paragraph that starts with "Warning: While Debian refuse..."
_______________________________________________
dm-crypt mailing list
[email protected]
http://www.saout.de/mailman/listinfo/dm-crypt
Signature · 7 lines
Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: [email protected] GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718 ---- There are two ways of constructing a software design: One way is to make it so simple that there are obviously no deficiencies, and the other way is to make it so complicated that there are no obvious deficiencies. The first method is far more difficult. --Tony Hoare
Another small typo at "Note: The "noearly" optiom" should presumably be "option". Nice guide, thanks.
- Justin
Quoted 9 lines · Arno Wagner
Dear all,
I just have added a mini-HOWOT on how to set up encrypted swap in FAQ item 2.2:
http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestionsProofreading and suggestions welcome.
Arno
Fixed. Thanks!
Arno
Quoted 21 lines · Justin Tracey
Another small typo at "Note: The "noearly" optiom" should presumably be "option".
Nice guide, thanks.- Justin
Quoted 9 lines · Arno Wagner
Dear all,
I just have added a mini-HOWOT on how to set up encrypted swap in FAQ item 2.2:
http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestionsProofreading and suggestions welcome.
Arno
_______________________________________________
dm-crypt mailing list
[email protected]
http://www.saout.de/mailman/listinfo/dm-crypt
Signature · 7 lines
Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: [email protected] GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718 ---- There are two ways of constructing a software design: One way is to make it so simple that there are obviously no deficiencies, and the other way is to make it so complicated that there are no obvious deficiencies. The first method is far more difficult. --Tony Hoare
Heya,
Am 11.07.2013 08:53, schrieb Arno Wagner:
Quoted 7 lines
Dear all,
I just have added a mini-HOWOT on how to set up encrypted swap in FAQ item 2.2:
http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestionsProofreading and suggestions welcome.
Good idea to add it to the FAQ. Thanks for maintaining this very valuable piece of documentation.
But maybe you should more emphasize the fact that /etc/crypttab implementations are distro-specific. While I know for sure that options like swap and noearly are supported in Debian-based distributions, I'm not sure about Redhat-based ones. Last time I looked, only a small subset of crypttab options that we've implemented in Debian were supported on Redhat-based systems.
Additionally, the following sentence looks wrong to me:
"Note: use /dev/random if you are paranoid or in a potential low-entropy situation (embedded system, etc.).".
Mainly in low-entropy situations /dev/random would cause the boot process to hang, right? So for these setups /dev/urandom actually is the better solution. Granted that one isn't paranoid ;)
Kind regards,
jonas
Quoted 14 lines · Jonas Meurer
Heya,
Am 11.07.2013 08:53, schrieb Arno Wagner:
Quoted 7 lines
Dear all,
I just have added a mini-HOWOT on how to set up encrypted swap in FAQ item 2.2:
http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestionsProofreading and suggestions welcome.
Good idea to add it to the FAQ. Thanks for maintaining this very valuable piece of documentation.
Quoted 6 lines
But maybe you should more emphasize the fact that
/etc/crypttabimplementations are distro-specific. While I know for sure that options like swap and noearly are supported in Debian-based distributions, I'm not sure about Redhat-based ones. Last time I looked, only a small subset of crypttab options that we've implemented in Debian were supported on Redhat-based systems.
Fedora (and future RHEL, perhaps) is using systemd, crypttab is parsed in systemd. IIRC most of the options are "systemd standardized". IIRC all Debian keywords were already there.
And for swap... it never worked properly with systemd but it is implementation bug prhaps only, enjoy reading
https://bugzilla.redhat.com/show_bug.cgi?id=759402
(systemd is using libcryptsetup for real device activation)
Quoted 8 lines
Additionally, the following sentence looks wrong to me:
"Note: use
/dev/randomif you are paranoid or in a potential low-entropy situation (embedded system, etc.).".Mainly in low-entropy situations
/dev/randomwould cause the boot process to hang, right? So for these setups/dev/urandomactually is the better solution. Granted that one isn't paranoid ;)
This is not so simple. Once /dev/random is "fixed" for most configs (read: internal pool is continuously mixed with good entropy source like e.g. RDRAND instructions) cryptsetup will switch default to /dev/random (for long-live keys). Perhaps in next major version.
See my notes here http://code.google.com/p/cryptsetup/issues/detail?id=161
Milan
Quoted 5 lines · Jonas Meurer
Heya,
Am 11.07.2013 08:53, schrieb Arno Wagner:
Quoted 2 lines
Dear all,
Quoted 8 lines
Quoted 5 lines
I just have added a mini-HOWOT on how to set up encrypted swap in FAQ item 2.2:
http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestionsProofreading and suggestions welcome.
Good idea to add it to the FAQ. Thanks for maintaining this very valuable piece of documentation.
Thanks!
Quoted 3 lines
But maybe you should more emphasize the fact that
/etc/crypttabimplementations are distro-specific. While I know for sure that options like swap and noearly are supported in Debian-based distributions, I'm
Well, if "swap" is not supported, then this will just fail. In this case, the user will likely have to write his/her own startup-script. Same with noearly, it will simply fail if the device is not yet available because it needs LVM or RAID-assembly.
I will see about saying this clearer though.
Quoted 11 lines
not sure about Redhat-based ones. Last time I looked, only a small subset of crypttab options that we've implemented in Debian were supported on Redhat-based systems.
Additionally, the following sentence looks wrong to me:
"Note: use
/dev/randomif you are paranoid or in a potential low-entropy situation (embedded system, etc.).".Mainly in low-entropy situations
/dev/randomwould cause the boot process to hang, right? So for these setups/dev/urandomactually is the
No. It hangs only in a "no entropy" situation. With "low entropy", it merely takes long. In a "no entropy" situation, you cannot do secure encryption and should do without it or find some entropy. Also note that a pre-seeded /dev/urandom is not a "low entropy" situation.
Quoted 1 line
better solution. Granted that one isn't paranoid ;)
Not "better", faster. But catastrophically worse with regard to security. If you do not care about security in swap it is better to not encrypt it in the first place. But if you encrypt, then it must be secure. Otherwise people will make wrong assumptions.
History has shown time and again that having no security in place makes (most) people careful, but having very weak security in place gives them a false sense of security, which is a lot worse. Hence do encryption right or do without it.
Arno
Signature · 7 lines
Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: [email protected] GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718 ---- There are two ways of constructing a software design: One way is to make it so simple that there are obviously no deficiencies, and the other way is to make it so complicated that there are no obvious deficiencies. The first method is far more difficult. --Tony Hoare
En réponse à Arno Wagner <[email protected]> :
Quoted 10 lines
------------------ Début du message d'origine --------------------
Dear all,
I just have added a mini-HOWOT on how to set up encrypted swap in FAQ item 2.2:
http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestionsProofreading and suggestions welcome.
As said, /etc/crypttab is very distro specific.
For the record, slackware uses:
swap /dev/sdaX /dev/random swap,cipher=aes-xts-essiv:sha256
Another things really nice is done at shutdown: it mkswap the partition. So, if you multiboot, you can use the swap the way you want: clear for unencrypted distribution, and ciphered for the crypted one.
Quoted 20 lines
Arno
Signature · 18 lines
Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: [email protected] GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718 ---- There are two ways of constructing a software design: One way is to make it so simple that there are obviously no deficiencies, and the other way is to make it so complicated that there are no obvious deficiencies. The first method is far more difficult. --Tony Hoare _______________________________________________ dm-crypt mailing list [email protected] http://www.saout.de/mailman/listinfo/dm-crypt ------------------- Fin du message d'origine ---------------------
Envoyé avec Inmano, ma messagerie renversante et gratuite : http://www.inmano.com
Quoted 3 lines · Arno Wagner
I just have added a mini-HOWOT on how to set up encrypted swap in FAQ item 2.2:
http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions
There are now two sections numbered 2.2.
Signature · 2 lines
Bob Nichols "NOSPAM" is really part of my email address.
Do NOT delete it.