Tell me more ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.
up vote 1 down vote favorite

I'm wondering, if I can store the passphrase of an encrypted disk in /etc/crypttab encrypted - and only possible to decrypt that by that OS, where I created. Is it possible?

(because, I want auto mount the disk after a restart, but I don't want to allow to read that password from the file with a simple live disk)

Thanks

share|improve this question
I don't think you can read stored passwords from a live disk. This may not be necessary. – Tom Brossman Aug 28 '12 at 21:22
1  
But then you'd have to store a passphrase to decrypt that passphrase somewhere :) And you can't store that second passphrase encrypted unless you willing to create a third passphrase to encrypt the second passphrase, and so on. That's the thing with encryption - unless the secret is stored outside of the system (in your head) you have to just dump it there in plain text and just make sure nobody has physical access to the system. – Sergey Aug 28 '12 at 21:25
@TomBrossman - we can, if I store it in a file read only by root, they put in a live disc, and mount the HDD, and they are root than. – B. Roland Aug 29 '12 at 7:56
@Sergey - can every Linux machine create unique hash? That they can only decrypt with their unique something... - like in ZNC... we have to generate the pw hash, and when I tried to move the config to other computer, the pw didn't work. How did it do it? – B. Roland Aug 29 '12 at 7:58
Just use Disk Utility to format the disk as an encrypted partition, then mount it in Nautilus. Choose 'remember forever' and the key gets saved in Seahorse and can't be read from a live disk. This is simple and secure. Maybe I'm not understanding the goal here, it seems needlessly complex. Are we talking about /home here or a separate SATA or USB drive? – Tom Brossman Aug 29 '12 at 8:08
show 2 more comments

1 Answer

up vote 0 down vote

First, add a keyfile to each encrypted volume then, simply edit your crypttab [/etc/crypttab] to include your extra encrypted volumes.

Make a key:

The keyfile can be of arbitrary content and size. We will generate a random temporary keyfile of 2048 bytes:

dd if=/dev/urandom of=secretkey bs=512 count=4

Add a key

cryptsetup luksAddKey /dev/sda2 secretkey

Enter any LUKS passphrase:

key slot 0 unlocked.

Command successful.

Add to crypttab:

label      UUID=#       keyfile-location     luks
share|improve this answer
Hm, so I can't avoid the theft of the passphrase. If someone opens the HDD of the computer, he can easily recover the key, and that's all... Any other solution? – B. Roland Nov 6 '12 at 20:39
Simply encrypt your root drive. no point in encrypting just one of your drives. /boot itself has to remain unencrypted but can easily be placed on a thumbdrive. So long as your keyfiles remain on an encrypted system and are stored on an encrypted drive, the only way to get them is physical access to the machine. Basically there is nothing you can do about a system left on and decrypted that someone can access. Limit physical access and turn the machine off (especially with laptops) and your fine. – Cain Nov 11 '12 at 2:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.