LUKS and Nuke key installtion on Ubuntu?

Question

When you install Ubuntu there's an option to encrypt the installation. I didn't select that, can I still encrypt Ubuntu? I do not want to encrypt my home folder I would like to encrypt Ubuntu as if I did select that option on the setup process. Also I recently saw that Offensive Security added the NUKE key feature to Kali's encrypted partitioning and LVM option. Can I install that on Ubuntu as well?

Answer 1

Yes, you can add the NUKE feature to Ubuntu crypsetup! You need der sourcecode from crypsetup, the patch for cryptsetup-1.6.6...

Then you can compile new libcryptsetup and cryptsetup with nuke feature.

This patch is for 1.6.6-5 (Ubuntu 16.04), for other version you neeed other patch, please visit the link!

get the patch (take a look http://deriv.debian.net/patches/c/cryptsetup/)

sudo apt-get update
sudo apt-get install libgcrypt11-dev libdevmapper-dev libpopt-dev uuid-dev libtool automake autopoint debhelper xsltproc docbook-xsl dpkg-dev
sudo apt-get source cryptsetup

wget http://deriv.debian.net/patches/c/cryptsetup/Debian_cryptsetup_2:1.6.6-5_Kali_cryptsetup_2:1.6.6-5kali1.debian.patch

extract source code from cryptsetup

cd cryptsetup-1.6.6

now its time to patch

patch -p1 < ../cryptsetup-nuke-keys/cryptsetup.patch

please corret the path, in my folder i have modified...

after patching, create DEB files for ubuntu

dpkg-buildpackage -b -uc

now its time to install

sudo dpkg -i ../libcryptsetup*.deb
sudo dpkg -i ../cryptsetup*.deb

edit:

I have made a simple shell script to patch and compile cryptsetup for Ubuntu 16.04. Please be careful!

run it with sudo!

#!/bin/sh

apt-get update
apt-get install libgcrypt11-dev libdevmapper-dev libpopt-dev uuid-dev libtool automake autopoint debhelper xsltproc docbook-xsl dpkg-dev

apt-get source cryptsetup
wget http://deriv.debian.net/patches/c/cryptsetup/Debian_cryptsetup_2:1.6.6-5_Kali_cryptsetup_2:1.6.6-5kali1.debian.patch

cd cryptsetup-1.6.6
patch -p1 < ../Debian_cryptsetup_2:1.6.6-5_Kali_cryptsetup_2:1.6.6-5kali1.debian.patch

dpkg-buildpackage -b -uc

After that, you can install with

sudo dpkg -i ../libcryptsetup*.deb
sudo dpkg -i ../cryptsetup*.deb

check with

cryptsetup --help | grep luksAddNuke

should look like

luksAddNuke [] - add NUKE to LUKS device

Now you can add nuke keys with

sudo cryptsetup luksAddNuke /dev/sda5

With a standard Ubuntu installation it is normal sda5 !

Now make a backup of the header!

sudo cryptsetup luksHeaderBackup /dev/sda5 --header-backup-file luks-backup

copy the file luks-backup on save location, if you wipe the header with nuke password, you can recover the header with linux live system!

make sure, that ubuntu update dont install the "normal" cryptsetup

sudo apt-mark hold cryptsetup-bin libcryptsetup4

check upgrade

sudo apt-get upgrade

looks like this

Die folgenden Pakete sind zurückgehalten worden: cryptsetup-bin libcryptsetup4 linux-generic linux-headers-generic linux-image-generic ubuntu-core-launcher

If i have some time, i would create ppa.

roema