4

I use truecrypt to encrypt one of my drives and I would want to leave the computer running processes that use information of that drive while I'm not home, I've tried suspending it but everything stops, I've also tried logging out but all processes are closed.

So is locking the computer (Ctrl+Alt+:L) the only possibility of achieving what I want?

0

3 Answers 3

4

Is locking the computer (Ctrl+Alt+L) the only possibility of achieving what I want?

No. Services will still be active when you log out. So you could rewrite those processes to run as a service (if not already available). Or create a script that does what you want to do and include that as a service or crontab job.

I would expect the encryption to be re-actived when you log out(?)

Second: Is the lock screen secure enough to prevent "Mallory" from accessing the encrypted drive?

Well... nothing is secure if someone can physically access your machine. What is preventing someone to reboot the machine by cutting of the power and boot with a live cd and just format your disc?

To make things worse: there is probably a way to circumvent the lock screen. Also reported here. I have not seen a fix for debian/ubuntu so you might want to test if it is possible to do on your machine.

5
  • If that someone reboots the machine, the drives are encrypted so he won't be able to access the information, yes he can delete them, but he wouldn't know what has he deleted. But I managed as you said using the "daemon" of the application, so it works fine, thanks!
    – Vndtta
    Apr 11, 2013 at 13:52
  • Ofcourse. But you might be better of someone viewing it then to actually loose the files. QUESTION: do those processes use the encrypted partition? If not I might have a suggestion: use an encrypted usb stick. You can remove it when you go away from the system.
    – Rinzwind
    Apr 11, 2013 at 13:57
  • Yes, those processes use the encrypted partition
    – Vndtta
    May 7, 2013 at 13:35
  • @Vndtta keep in mind that unless you're doing full disk encryption, an adversary would be able to reboot the system from a live cd or whatever and replace your truecrypt/cryptsetup binaries to obtain your encryption keys. It all depends on your threat model, as usual.
    – GnP
    Aug 19, 2015 at 23:59
  • @GnP It's somewhat hard to do this without the user being aware of it happening. If you return to your computer and it is exactly how you left it there is a reasonable assumption of security. There is no easy route to knowing your password even with root, so it would be hard to return the computer to the previous state without changing the password, which is obviously a huge red flag. Clearly, exploits that bypass the lock screen are a serious threat and break everything. Dec 15, 2016 at 12:35
1

It depends on technical knowledge of your adversary.

In theory nothing will help you if a violator has physical access to your computer and really wants to steal your data.

For example he can reboot your system in single user mode with root privileges.

You can disable single user mode but he can use live cd or a kind of hack to reset root password.

To protect from booting from live cd you can setup BIOS password (for boot and for settings access), but that also can be bypassed by CMOS data clearing and restoring default BIOS settings.

In addition your system can have running services listening some ports. They also can be vulnerable.

Then he can install special software he need, for example key logger for catching your password and accessing encrypted files/folders/drives.

So the more protection steps you did, the more difficult it can be to get access (more time and higher skills are required). But that is still not impossible.

You can hide your data (if not done yet) in addition to encryption.

1

As far as defeating the encryption on an otherwise locked down machine, look up the liquid nitrogen RAM attacks. It's always a question of how secure you want to be, not being undefeatable. If an attacker needs a dewer of LN on hand to defeat you, you're fairly likely to see him coming.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .