Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Normally I don't shutdown my notebook any more in favour of using suspend-to-RAM. The downside is that my encrypted home partition is completely accessible after resume without entering the passphrase. A bad idea if someome steals your notebook...

Looking at cryptsetup's manpage. I've learned that LUKS now supports the luksSuspend and luksResume command. Has luksSuspend and luksResume been integrated in the scripts doing suspend-to-RAM and resume?

share|improve this question
    
Related LP bug. Locking the screen is an easy method to protect against the "regular" people. It does not protect you from people who know your password (or can guess it), abuse a bug to gain access to a session or read the passwords from memory –  Lekensteyn Mar 24 '12 at 21:39

2 Answers 2

Current problem

When using Ubuntu Full Disk Encryption(that is based on dm-crypt with LUKS) to set up full system encryption, the encryption key is kept in memory when suspending the system. This drawback defeats the purpose of encryption if you carry around your suspended laptop a lot. One can use the cryptsetup luksSuspend command to freeze all I/O and flush the key from memory.

Solution

ubuntu-luks-suspend is an attempt to change the default suspend mechanism. The basic idea is to change to a chroot outside of the encrypted root fs and then lock it (withcryptsetup luksSuspend)

share|improve this answer
    
This attempt (not functional yet) is discussed on the related question How do I enable Ubuntu to suspend the machine using LUKSsuspend during sleep/hibernate. –  jonasmalacofilho Jul 25 at 16:30

Actually, you just need to ensure that your screensaver passphrase is required on resume from suspend, and you'll be safe.

This will ensure that someone resuming your laptop from suspend will have to enter a password before they can get into the computer.

enter image description here

share|improve this answer
2  
and this really uses luksSuspend / luksResume ? –  Stefan Armbruster Feb 19 '12 at 20:33
2  
No, it ensures that someone resuming your laptop is required to enter a password on resume. That's essential if you've gone to the length of encrypted your data. –  Dustin Kirkland Feb 19 '12 at 21:57
3  
Er, this is not enough... it's just a screensaver password. It should suspend fully so that you're required to enter your LUKS password again before returning to the GUI –  BenAlabaster Oct 13 '13 at 3:14
2  
Exactly. The decryption key for LUKS will still be in RAM unless luksSuspend/luksResume is used. Is there a way to do this with Ubuntu? –  jzila Apr 10 at 23:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.