Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

After reading this question about how often tmp is cleared, it would be best for our setup if tmp is encrypted. How do I encrypt it?

My fstab looks like this:

proc            /proc           proc    nodev,noexec,nosuid 0       0
/dev/mapper/vg_doulos-root /               ext4    errors=remount-ro 0       1
# /boot was on /dev/sda1 during installation
UUID=205a1a54-7dfa-45a6-a7e3-4a7234b3a473 /boot           ext4    defaults        0   2
/dev/mapper/vg_doulos-home /home           ext4    defaults        0       2
/dev/mapper/vg_doulos-tmp /tmp            ext4    defaults        0       2
# swap was on /dev/sda2 during installation
#UUID=705e9f69-bf95-4d44-9119-c40076d10333 none            swap    sw              0  0
/dev/mapper/cryptswap1 none swap sw 0 0

crypttab:

# <target name> <source device>         <key file>      <options>
cryptswap1 /dev/sda2 /dev/urandom swap,cipher=aes-cbc-essiv:sha256

Is it sufficient to put something like this in crypttab?

crypttmp /dev/mapper/vg_doulos-tmp /dev/urandom

and then this to replace the tmp file entry in fstab?

/dev/mapper/crypttmp /tmp ext4 defaults 0 2

share|improve this question
    
Just a question, why do you need to encrypt the /tmp folder? There are other ways of dealing with it. –  Mitch May 31 '12 at 5:16
    
@Mitch What other ways do you suggest? Any others that address the problem of what happens if someone breaks in, cuts the power, and takes the machine? (I mean, clearly not everyone needs something this robust, but it seems like encrypting /tmp beats most alternatives, when it comes to privacy of the files it contains.) –  Eliah Kagan May 31 '12 at 8:05
    
@Eliah Kagan Maybe something like shredding /tmp folder on shutdown. So if someone does breaks in, cuts the power, takes the machine, that will simulate a shutdown. So shredding would be good. –  Mitch May 31 '12 at 8:13
    
@Mitch If they cut the power, the machine doesn't shut down. It was on, and suddenly now it's off. Nothing gets shredded. Any cleartext in /tmp stays there and can be recovered quickly and trivially. –  Eliah Kagan May 31 '12 at 8:21
    
@Eliah Kagan Following the default Ubuntu install, wouldn`t /tmp be configured as tmpfs which is a RAM disk. So the moment the machine is off in any way, it should be gone. –  Mitch May 31 '12 at 8:25
show 5 more comments

3 Answers

up vote 2 down vote accepted

The correct incantation in crypttab should look like this:

crypttmp /dev/mapper/vg_doulos-tmp /dev/urandom precheck=/bin/true,tmp,size=256,hash=sha256,cipher=aes-cbc-essiv:sha256

The most important part was the precheck=/bin/true. The reason why /tmp wasn't mounting was that cryptsetup was failing due to a precheck. The precheck noticed that the LVM partition was formatted for ext4 and refused to continue.

The fstab entry should look like this:

/dev/mapper/crypttmp /tmp ext4 defaults 0 2

share|improve this answer
add comment

I think your right it should be enough to add in crypttab:

crypttmp  /dev/mapper/vg_doulos-tmp  /dev/urandom  tmp

and in fstab:

/dev/mapper/crypttmp  /tmp  ext4  defaults  0  0 

Greets

share|improve this answer
    
This doesn't work. :( I think it might be because /dev/mapper/vg_doulos-tmp is already in /dev/mapper and I'm trying to create another item there. –  Avery Chan Jun 4 '12 at 7:35
    
why you have it twice ? –  Steve Jun 4 '12 at 7:49
    
I don't have it twice. I was just hypothesizing, but I don't think my guess is correct either. Here's what my fstab and crypttab look like: pastebin.com/GjsfewRR –  Avery Chan Jun 4 '12 at 8:31
    
I ran cryptdisks_start crypttmp and the output was: * crypttmp: the precheck for '/dev/mapper/vg_doulos-tmp' failed: - The device /dev/mapper/vg_doulos-tmp contains a filesystem type ext4. Any ideas how to fix this? I think the boot process is choking on this. –  Avery Chan Jun 4 '12 at 8:43
    
try : /dev/mapper/crypttmp /tmp ext2 defaults 0 0 –  Steve Jun 4 '12 at 9:44
add comment

Starting with Avery's answer, (on Ubuntu 12.04) I had to specify the filesystem type with "tmp=ext4" to get it to work:

/etc/cryptsetup:

crypttmp /dev/sdb /dev/urandom precheck=/bin/true,tmp=ext4,size=256,hash=sha256,cipher=aes-cbc-essiv:sha256

/etc/fstab:

/dev/mapper/crypttmp /tmp ext4 noatime 0 2
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.