2

When you install Ubuntu there's an option to encrypt the installation. I didn't select that, can I still encrypt Ubuntu? I do not want to encrypt my home folder I would like to encrypt Ubuntu as if I did select that option on the setup process. Also I recently saw that Offensive Security added the NUKE key feature to Kali's encrypted partitioning and LVM option. Can I install that on Ubuntu as well?

migrated from security.stackexchange.com Sep 6 '16 at 23:06

This question came from our site for information security professionals.

  • The encryption Ubuntu offers on install is based on ecryptfs. That is file encryption and only encrypts the home folder. If you want a full block device encryption and a bootable Ubuntu you need to do it yourself manually. Search for luks (the encryption) & lvm (you need logical volumes because booting should be possible) & Ubuntu installation. – therealmarv Sep 6 '16 at 23:10
  • Related: askubuntu.com/questions/95159/… – Elder Geek Sep 6 '16 at 23:11
  • So I can't encrypt the Ubuntu system partition like the setup option? – Thomas Byerly Sep 6 '16 at 23:42
2

Yes, you can add the NUKE feature to Ubuntu crypsetup! You need der sourcecode from crypsetup, the patch for cryptsetup-1.6.6...

Then you can compile new libcryptsetup and cryptsetup with nuke feature.

This patch is for 1.6.6-5 (Ubuntu 16.04), for other version you neeed other patch, please visit the link!

get the patch (take a look http://deriv.debian.net/patches/c/cryptsetup/)

sudo apt-get update
sudo apt-get install libgcrypt11-dev libdevmapper-dev libpopt-dev uuid-dev libtool automake autopoint debhelper xsltproc docbook-xsl dpkg-dev
sudo apt-get source cryptsetup

wget http://deriv.debian.net/patches/c/cryptsetup/Debian_cryptsetup_2:1.6.6-5_Kali_cryptsetup_2:1.6.6-5kali1.debian.patch

extract source code from cryptsetup

cd cryptsetup-1.6.6

now its time to patch

patch -p1 < ../cryptsetup-nuke-keys/cryptsetup.patch

please corret the path, in my folder i have modified...

after patching, create DEB files for ubuntu

dpkg-buildpackage -b -uc

now its time to install

sudo dpkg -i ../libcryptsetup*.deb
sudo dpkg -i ../cryptsetup*.deb

edit:

I have made a simple shell script to patch and compile cryptsetup for Ubuntu 16.04. Please be careful!

run it with sudo!

#!/bin/sh

apt-get update
apt-get install libgcrypt11-dev libdevmapper-dev libpopt-dev uuid-dev libtool automake autopoint debhelper xsltproc docbook-xsl dpkg-dev

apt-get source cryptsetup
wget http://deriv.debian.net/patches/c/cryptsetup/Debian_cryptsetup_2:1.6.6-5_Kali_cryptsetup_2:1.6.6-5kali1.debian.patch

cd cryptsetup-1.6.6
patch -p1 < ../Debian_cryptsetup_2:1.6.6-5_Kali_cryptsetup_2:1.6.6-5kali1.debian.patch

dpkg-buildpackage -b -uc

After that, you can install with

sudo dpkg -i ../libcryptsetup*.deb
sudo dpkg -i ../cryptsetup*.deb

check with

cryptsetup --help | grep luksAddNuke

should look like

luksAddNuke [] - add NUKE to LUKS device

Now you can add nuke keys with

sudo cryptsetup luksAddNuke /dev/sda5

With a standard Ubuntu installation it is normal sda5 !

Now make a backup of the header!

sudo cryptsetup luksHeaderBackup /dev/sda5 --header-backup-file luks-backup

copy the file luks-backup on save location, if you wipe the header with nuke password, you can recover the header with linux live system!

make sure, that ubuntu update dont install the "normal" cryptsetup

sudo apt-mark hold cryptsetup-bin libcryptsetup4

check upgrade

sudo apt-get upgrade

looks like this

Die folgenden Pakete sind zurückgehalten worden: cryptsetup-bin libcryptsetup4 linux-generic linux-headers-generic linux-image-generic ubuntu-core-launcher

If i have some time, i would create ppa.

roema

  • If you like, i can send you a .deb file for installing. – roema Oct 8 '16 at 18:26
  • 1
    If you want to make a package for this, please consider uploading it to a Launchpad PPA so that everyone in the community can profit from it. We don't really want to offer personal support here but create questions and answers useful for a wider audience. – Byte Commander Oct 8 '16 at 18:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.