On Wed, Jun 28, 2006 at 11:10:09PM +0200, Miroslav Kure wrote: > > The suggestions seem reasonable and I'll incorporate them before > friday. Hm, this took a bit longer. I just merged all the trivial bits and worked a bit on the others. I did not do the conditional thing as it seems that it should work on all architectures and if needed, we could add it easily later. Meanwhile I also wrote a foundation for new section for boot-new.xml (our RM complained it is too empty ;-) which talks about issues with mounting encrypted volumes when booting the system. This one is attached both as a docbook source and a html page, because the source is a bit wild. -- Miroslav Kure
<!-- retain these comments for translator revision tracking -->
<!-- $Id: partman-crypto.xml 33725 2006-01-03 19:39:07Z mck-guest $ -->
<sect3 id="partman-crypto">
<title>Configuring Encrypted Volumes</title>
<para>
&d-i; allows you to set up encrypted partitions. Every file you write
to such a partition is immediately saved to the device in encrypted
form. Access to the encrypted data is granted only after entering
the <firstterm>passphrase</firstterm> used when the encrypted
partition was originally created. This feature is useful to protect
sensitive data in case your laptop or hard drive gets stolen. The
thief might get physical access to the hard drive, but without knowing
the right passphrase, the data on the hard drive will look like random
characters.
</para><para>
The two most important partitions to encrypt are: the home partition,
where your private data resides, and the swap partition, where
sensitive data might be stored temporarily during operation. Of
course, nothing prevents you from encrypting any other partitions that might
be of interest. For example <filename>/var</filename> where database
servers, mail servers or print servers store their data, or
<filename>/tmp</filename> which is used by various programs to store
potentially interesting temporary files. Some people may even want to
encrypt their whole system. The only exception is
the <filename>/boot</filename> partition which must remain
unencrypted, because currently there is no way to load the kernel from
an encrypted partition.
</para><note><para>
Please note that the performance of encrypted partitions will be
less than that of unencrypted ones because the data needs to be
decrypted or encrypted for every read or write. The performance impact
depends on your CPU speed, chosen cipher and a key length.
</para></note><para>
To use encryption, you have to create a new partition by selecting
some free space in the main partitioning menu. Another option is to
choose an existing partition (e.g. a regular partition, an LVM logical
volume or a RAID volume). In the <guimenu>Partition setting</guimenu>
menu, you need to select <guimenuitem>physical volume for
encryption</guimenuitem> at the <menuchoice> <guimenu>Use
as:</guimenu> </menuchoice> option. The menu will then change to
include several cryptographic options for the partition.
</para><para>
&d-i; supports several encryption methods. The default method
is <firstterm>dm-crypt</firstterm> (included in newer Linux kernels,
able to host LVM physical volumes), the other
is <firstterm>loop-AES</firstterm> (older, maintained separately from
the Linux kernel tree). Unless you have compelling reasons to do
otherwise, it is recommended to use the default.
<!-- TODO: link to the "Debian block device encryption guide"
once Max writes it :-) -->
</para><para>
First, let's have a look at available options available when you
select <userinput>Device-mapper (dm-crypt)</userinput> as the
encryption method. As always: when in doubt, use the defaults, because
they have been carefully chosen with security in mind.
<variablelist>
<varlistentry>
<term>Encryption: <userinput>aes</userinput></term>
<listitem><para>
This option lets you select the encryption algorithm
(<firstterm>cipher</firstterm>) which will be used to encrypt the data
on the partition. &d-i; currently supports the following block
ciphers: <firstterm>aes</firstterm>, <firstterm>blowfish</firstterm>,
<firstterm>serpent</firstterm>, and <firstterm>twofish</firstterm>.
It is beyond the scope of this document to discuss the qualities of
these different algorithms, however, it might help your decision to
know that in 2000, <emphasis>AES</emphasis> was chosen by the American
National Institute of Standards and Technology as the standard
encryption algorithm for protecting sensitive information in the 21st
century.
</para></listitem>
</varlistentry>
<varlistentry>
<term>Key size: <userinput>256</userinput></term>
<listitem><para>
Here you can specify the length of the encryption key. With a larger
key size, the strength of the encryption is generally improved. On the
other hand, increasing the length of the key usually has a negative
impact on performance. Available key sizes vary depending on the
cipher.
</para></listitem>
</varlistentry>
<varlistentry>
<term>IV algorithm: <userinput>cbc-essiv:sha256</userinput></term>
<listitem><para>
The <firstterm>Initialization Vector</firstterm> or
<firstterm>IV</firstterm> algorithm is used in cryptography to ensure
that applying the cipher on the same <firstterm>clear text</firstterm>
data with the same key always produces a unique
<firstterm>cipher text</firstterm>. The idea is to prevent the
attacker from deducing information from repeated patterns in the encrypted
data.
</para><para>
>From the provided alternatives, the default
<userinput>cbc-essiv:sha256</userinput> is currently the least
vulnerable to known attacks. Use the other alternatives only when you
need to ensure compatibility with some previously installed system
that is not able to use newer algorithms.
</para></listitem>
</varlistentry>
<varlistentry>
<term>Encryption key: <userinput>Passphrase</userinput></term>
<listitem><para>
Here you can choose the type of the encryption key for this partition.
<variablelist>
<varlistentry>
<term>Passphrase</term>
<listitem><para>
The encryption key will be computed<footnote>
<para>
Using a passphrase as the key currently means that the partition will
be set up using <ulink url="&url-luks;">LUKS</ulink>.
</para></footnote> on the basis of a passphrase which you will be able
to enter later in the process.
</para></listitem>
</varlistentry>
<varlistentry>
<term>Random key</term>
<listitem><para>
A new encryption key will be generated from random data each time you
try to bring up the encrypted partition. In other words: on every
shutdown the content of the partition will be lost as the key is
deleted from memory. (Of course, you could try to guess the key with a
brute force attack, but unless there is an unknown weakness in the
cipher algorithm, it is not achievable in our lifetime.)
</para><para>
Random keys are useful for swap partitions because you do not need to
bother yourself with remembering the passphrase or wiping sensitive
information from the swap partition before shutting down your
computer. However, it also means that you
will <emphasis>not</emphasis> be able to use
the <quote>suspend-to-disk</quote> functionality offered by newer
Linux kernels as it will be impossible (during a subsequent boot) to
recover the suspended data written to the swap partition.
</para></listitem>
</varlistentry>
</variablelist>
</para></listitem>
</varlistentry>
<varlistentry>
<term>Erase data: <userinput>yes</userinput></term>
<listitem><para>
Determines whether the content of this partition should be overwritten
with random data before setting up the encryption. This is recommended
because it might otherwise be possible for an attacker to discern
which parts of the partition are in use and which are not. In
addition, this will make it harder to recover any leftover data from
previous installations<footnote><para>
It is believed that the guys from three-letter agencies can restore
the data even after several rewrites of the magnetooptical media,
though.
</para></footnote>.
</para></listitem>
</varlistentry>
</variablelist>
</para><para>
If you select <menuchoice> <guimenu>Encryption method:</guimenu>
<guimenuitem>Loopback (loop-AES)</guimenuitem> </menuchoice>, the menu
changes to provide the following options:
<variablelist>
<varlistentry>
<term>Encryption: <userinput>AES256</userinput></term>
<listitem><para>
For loop-AES, unlike dm-crypt, the options for cipher and key size are
combined, so you can select both at the same time. Please see the
above sections on ciphers and key sizes for further information.
</para></listitem>
</varlistentry>
<varlistentry>
<term>Encryption key: <userinput>Keyfile (GnuPG)</userinput></term>
<listitem><para>
Here you can select the type of the encryption key for this partition.
<variablelist>
<varlistentry>
<term>Keyfile (GnuPG)</term>
<listitem><para>
The encryption key will be generated from random data during the
installation. Moreover this key will be encrypted
with <application>GnuPG</application>, so to use it, you will need to
enter the proper passphrase (you will be asked to provide one later in
the process).
</para></listitem>
</varlistentry>
<varlistentry>
<term>Random key</term>
<listitem><para>
Please see the the section on random keys above.
</para></listitem>
</varlistentry>
</variablelist>
</para></listitem>
</varlistentry>
<varlistentry>
<term>Erase data: <userinput>yes</userinput></term>
<listitem><para>
Please see the the section on erasing data above.
</para></listitem>
</varlistentry>
</variablelist>
</para><note><para>
Please note that the <emphasis>graphical</emphasis> version of the
installer still has some limitations when compared to the textual
one. For cryptography it means you can set up only volumes using
<emphasis>passphrases</emphasis> as the encryption keys.
</para></note><para>
After you have selected the desired parameters for your encrypted
partitions, return back to the main partitioning menu. There should
now be a new menu item called <guimenu>Configure encrypted
volumes</guimenu>. After you select it, you will be asked to confirm
the deletion of data on partitions marked to be erased and possibly
other actions such as writing a new partition table. For large
partitions this might take some time.
</para><para>
Next you will be asked to enter a passphrase for partitions configured
to use one. Good passphrases should be longer than 8 characters,
should be a mixture of letters, numbers and other characters and
should not contain common dictionary words or information easily
associable with you (such as birthdates, hobbies, pet names, names of
family members or relatives, etc.).
</para><warning><para>
Before you input any passphrases, you should have made sure that your
keyboard is configured correctly and generates the expected
characters. If you are unsure, you can switch to the second virtual
console and type some text at the prompt. This ensures that you won't be
surprised later, e.g. by trying to input a passphrase using a qwerty
keyboard layout when you used an azerty layout during the installation.
This situation can have several causes. Maybe you switched to another
keyboard layout during the installation, or the selected keyboard layout
might not have been set up yet when entering the passphrase for the
root file system.
</para></warning><para>
If you selected to use methods other than a passphrase to create
encryption keys, they will be generated now. Because the kernel may
not have gathered a sufficient amount of entropy at this early stage
of the installation, the process may take a long time. You can help
speed up the process by generating entropy: e.g. by pressing random
keys, or by switching to the shell on the second virtual console and
generating some network and disk traffic (downloading some files,
feeding big files into <filename>/dev/null</filename>, etc.).
<!-- TODO: Mention hardware random generators when we will support
them -->
This will be repeated for each partition to be encrypted.
</para><para>
After returning to the main partitioning menu, you will see all
encrypted volumes as additional partitions which can be configured in
the same way as ordinary partitions. The following example shows two
different volumes. The first one is encrypted via dm-crypt, the second
one via loop-AES.
<informalexample><screen>
Encrypted volume (<replaceable>crypt0</replaceable>) - 115.1 GB Linux device-mapper
#1 115.1 GB F ext3
Loopback (<replaceable>loop0</replaceable>) - 515.2 MB AES256 keyfile
#1 515.2 MB F ext3
</screen></informalexample>
Now is the time to assign mount points to the volumes and optionally
change the file system types if the defaults do not suit you.
</para><para>
One thing to note here are the identifiers in parentheses
(<replaceable>crypt0</replaceable>
and <replaceable>loop0</replaceable> in this case) and the mount
points you assigned to each encrypted volume. You will need this
information later when booting the new system. The differences between
ordinary boot process and boot process with encryption involved will
be covered later in <xref linkend="mount-encrypted-volumes"/>.
</para><para>
Once you are satisfied with the partitioning scheme, continue with the
installation.
</para>
</sect3>
<!-- retain these comments for translator revision tracking --> <!-- $Id: boot-new.xml 33725 2006-01-03 19:39:07Z fjp $ --> <chapter id="boot-new"> <title>Booting Into Your New Debian System</title> <sect1 id="base-boot"><title>The Moment of Truth</title> <para> Your system's first boot on its own power is what electrical engineers call the <quote>smoke test</quote>. </para><para> If you are booting directly into Debian, and the system doesn't start up, either use your original installation boot media, or insert the custom boot floppy if you have one, and reset your system. This way, you will probably need to add some boot arguments like <userinput>root=<replaceable>root</replaceable></userinput>, where <replaceable>root</replaceable> is your root partition, such as <filename>/dev/sda1</filename>. Alternatively, see <xref linkend="rescue"/> for instructions on using the installer's built-in rescue mode. </para> <sect2 arch="m68k"><title>BVME 6000 Booting</title> <para> If you have just performed a diskless install on a BVM or Motorola VMEbus machine: once the system has loaded the <command>tftplilo</command> program from the TFTP server, from the <prompt>LILO Boot:</prompt> prompt enter one of: <itemizedlist> <listitem><para> <userinput>b6000</userinput> followed by &enterkey; to boot a BVME 4000/6000 </para></listitem><listitem><para> <userinput>b162</userinput> followed by &enterkey; to boot an MVME162 </para></listitem><listitem><para> <userinput>b167</userinput> followed by &enterkey; to boot an MVME166/167 </para></listitem> </itemizedlist> </para> </sect2> <sect2 arch="m68k"><title>Macintosh Booting</title> <para> Go to the directory containing the installation files and start up the <command>Penguin</command> booter, holding down the <keycap>command</keycap> key. Go to the <userinput>Settings</userinput> dialogue (<keycombo> <keycap>command</keycap> <keycap>T</keycap> </keycombo>), and locate the kernel options line which should look like <userinput>root=/dev/ram video=font:VGA8x16</userinput> or similar. </para><para> You need to change the entry to <userinput>root=/dev/<replaceable>yyyy</replaceable></userinput>. Replace the <replaceable>yyyy</replaceable> with the Linux name of the partition onto which you installed the system (e.g. <filename>/dev/sda1</filename>); you wrote this down earlier. The <userinput>video=font:VGA8x8</userinput> is recommended especially for users with tiny screens. The kernel would pick a prettier (6x11) font but the console driver for this font can hang the machine, so using 8x16 or 8x8 is safer at this stage. You can change this at any time. </para><para> If you don't want to start GNU/Linux immediately each time you start, uncheck the <userinput>Auto Boot</userinput> option. Save your settings in the <filename>Prefs</filename> file using the <userinput>Save Settings As Default</userinput> option. </para><para> Now select <userinput>Boot Now</userinput> (<keycombo> <keycap>command</keycap> <keycap>B</keycap> </keycombo>) to start your freshly installed GNU/Linux instead of the RAMdisk installer system. </para><para> Debian should boot, and you should see the same messages as when you first booted the installation system, followed by some new messages. </para> </sect2> <sect2 arch="powerpc"><title>OldWorld PowerMacs</title> <para> If the machine fails to boot after completing the installation, and stops with a <prompt>boot:</prompt> prompt, try typing <userinput>Linux</userinput> followed by &enterkey;. (The default boot configuration in <filename>quik.conf</filename> is labeled Linux). The labels defined in <filename>quik.conf</filename> will be displayed if you press the <keycap>Tab</keycap> key at the <prompt>boot:</prompt> prompt. You can also try booting back into the installer, and editing the <filename>/target/etc/quik.conf</filename> placed there by the <guimenuitem>Install Quik on a Hard Disk</guimenuitem> step. Clues for dealing with <command>quik</command> are available at <ulink url="&url-powerpc-quik-faq;"></ulink>. </para><para> To boot back into MacOS without resetting the nvram, type <userinput>bye</userinput> at the OpenFirmware prompt (assuming MacOS has not been removed from the machine). To obtain an OpenFirmware prompt, hold down the <keycombo> <keycap>command</keycap> <keycap>option</keycap> <keycap>o</keycap> <keycap>f</keycap> </keycombo> keys while cold booting the machine. If you need to reset the OpenFirmware nvram changes to the MacOS default in order to boot back to MacOS, hold down the <keycombo> <keycap>command</keycap> <keycap>option</keycap> <keycap>p</keycap> <keycap>r</keycap> </keycombo> keys while cold booting the machine. </para><para> If you use <command>BootX</command> to boot into the installed system, just select your desired kernel in the <filename>Linux Kernels</filename> folder, un-choose the ramdisk option, and add a root device corresponding to your installation; e.g. <userinput>/dev/hda8</userinput>. </para> </sect2> <sect2 arch="powerpc"><title>NewWorld PowerMacs</title> <para> On G4 machines and iBooks, you can hold down the <keycap>option</keycap> key and get a graphical screen with a button for each bootable OS, &debian; will be a button with a small penguin icon. </para><para> If you kept MacOS and at some point it changes the OpenFirmware <envar>boot-device</envar> variable you should reset OpenFirmware to its default configuration. To do this hold down the <keycombo> <keycap>command</keycap> <keycap>option</keycap> <keycap>p</keycap> <keycap>r</keycap> </keycombo> keys while cold booting the machine. </para><para> The labels defined in <filename>yaboot.conf</filename> will be displayed if you press the <keycap>Tab</keycap> key at the <prompt>boot:</prompt> prompt. </para><para> Resetting OpenFirmware on G3 or G4 hardware will cause it to boot &debian; by default (if you correctly partitioned and placed the Apple_Bootstrap partition first). If you have &debian; on a SCSI disk and MacOS on an IDE disk this may not work and you will have to enter OpenFirmware and set the <envar>boot-device</envar> variable, <command>ybin</command> normally does this automatically. </para><para> After you boot &debian; for the first time you can add any additional options you desire (such as dual boot options) to <filename>/etc/yaboot.conf</filename> and run <command>ybin</command> to update your boot partition with the changed configuration. Please read the <ulink url="&url-powerpc-yaboot-faq;">yaboot HOWTO</ulink> for more information. </para> </sect2> </sect1> <sect1 id="mount-encrypted-volumes"> <title>Mounting encrypted volumes</title> <para> If you created encrypted volumes during the installation and assigned them mount points, you will be asked to enter appropriate passphrases for these volumes during the boot. The actual procedure slightly differs between dm-crypt and loop-AES. </para> <sect2> <title id="mount-loop-aes">loop-AES</title> <para> For partitions encrypted via loop-AES you will be shown the following prompt during the boot: <informalexample><screen> mount: going to use loop device /dev/loop<replaceable>X</replaceable> Password: </screen></informalexample> where <replaceable>X</replaceable> is some number. You are now probably asking yourself <emphasis>which volume</emphasis> are you actually entering the passphrase for. Does is relate to your <filename>/home</filename>? Or to the <filename>/var</filename>? This is where the notes you wrote down as the last step in <xref linkend="partman-crypto"/> come handy. If you did not note the mapping between <filename>loop<replaceable>X</replaceable></filename> and the mount point before, you can still find it in <filename>/etc/fstab</filename> of your new system. Of course, if you have just one encrypted volume, you do not need to bother and can enter the passphrase right away. No characters (even asterisk) will be shown while entering the passphrase. </para><para> Be careful, you have only <emphasis>one try</emphasis>. If you enter wrong passphrase, an error message will appear and mounting will continue with another volume. Please see <xref linkend="crypto-troubleshooting"/> below for further information. </para><para> After entering all passphrases the boot should continue as usual. </para> </sect2> <sect2> <title id="mount-dm-crypt">dm-crypt</title> <para condition="FIXME"> TODO: write something once it works. </para> </sect2> <sect2> <title id="crypto-troubleshooting">Troubleshooting</title> <para> If some of the encrypted volumes could not be mounted due to the wrong passphrase, you will have to mount them after the boot. There are several cases. </para> <itemizedlist> <listitem><para> The easiest case is with encrypted volumes holding data like <filename>/home</filename> or <filename>/srv</filename>. You can simply mount them manually after the boot. For loop-AES this is one-step operation: <informalexample><screen> <prompt>#</prompt> <userinput>mount <replaceable>/mount_point</replaceable></userinput> <prompt>Password:</prompt> </screen></informalexample> where <replaceable>/mount_point</replaceable> should be replaced by the particular directory (e.g. <filename>/home</filename>). The only difference from ordinary mount is that you will be asked to enter the passphrase for this volume. </para><para> dm-crypt is a bit trickier. First you need to register the volumes with <application>device mapper</application> by running: <informalexample><screen> <prompt>#</prompt> <userinput>/etc/init.d/cryptdisks start</userinput> </screen></informalexample> This will scan all volumes mentioned in <filename>/etc/crypttab</filename> and will create appropriate devices under the <filename>/dev</filename> directory after entering the correct passphrases. (Already registered volumes will be skipped, so you can repeat this command several times without worrying.) After successful registration you can simply mount the volumes the usual way: <informalexample><screen> <prompt>#</prompt> <userinput>mount <replaceable>/mount_point</replaceable></userinput> </screen></informalexample> </para></listitem> <listitem><para> If the volumes holding noncritical system files could not be mounted (<filename>/usr</filename> or <filename>/var</filename>), the system should still boot and you should be able to mount the volumes manually like in the previous case. Moreover you will also need to (re)start services usually running in your default runlevel, because it is very likely that they were not started. The easiest way to achieve this is by switching to the first runlevel and back by entering <informalexample><screen> <prompt>#</prompt> <userinput>init 1</userinput> </screen></informalexample> at the shell prompt and pressing <keycombo> <keycap>Control</keycap> <keycap>D</keycap> </keycombo> when asked for the root password. </para></listitem> <listitem><para> The last case concerns the root partition. When it is not mounted correctly, the boot process will halt and you will have to restart the computer to try again. </para></listitem> </itemizedlist> </sect2> </sect1> <sect1 id="login"> <title>Log In</title> <para> Once your system boots, you'll be presented with the login prompt. Log in using the personal login and password you selected during the installation process. Your system is now ready to use. </para><para> If you are a new user, you may want to explore the documentation which is already installed on your system as you start to use it. There are currently several documentation systems, work is proceeding on integrating the different types of documentation. Here are a few starting points. </para><para> Documentation accompanying programs you have installed is in <filename>/usr/share/doc/</filename>, under a subdirectory named after the program. For example, the APT User's Guide for using <command>apt</command> to install other programs on your system, is located in <filename>/usr/share/doc/apt/guide.html/index.html</filename>. </para><para> In addition, there are some special folders within the <filename>/usr/share/doc/</filename> hierarchy. Linux HOWTOs are installed in <emphasis>.gz</emphasis> format, in <filename>/usr/share/doc/HOWTO/en-txt/</filename>. After installing <command>dhelp</command> you will find a browse-able index of documentation in <filename>/usr/share/doc/HTML/index.html</filename>. </para><para> One easy way to view these documents is to <userinput>cd /usr/share/doc/</userinput>, and type <userinput>lynx</userinput> followed by a space and a dot (the dot stands for the current directory). </para><para> You can also type <userinput>info <replaceable>command</replaceable></userinput> or <userinput>man <replaceable>command</replaceable></userinput> to see documentation on most commands available at the command prompt. Typing <userinput>help</userinput> will display help on shell commands. And typing a command followed by <userinput>--help</userinput> will usually display a short summary of the command's usage. If a command's results scroll past the top of the screen, type <userinput>| more</userinput> after the command to cause the results to pause before scrolling past the top of the screen. To see a list of all commands available which begin with a certain letter, type the letter and then two tabs. </para><para> For a more complete introduction to Debian and GNU/Linux, see <filename>/usr/share/doc/debian-guide/html/noframes/index.html</filename>. </para> </sect1> </chapter>Title: 7.2. Mounting encrypted volumes
|
If you created encrypted volumes during the installation and assigned them mount points, you will be asked to enter appropriate passphrases for these volumes during the boot. The actual procedure slightly differs between dm-crypt and loop-AES. For partitions encrypted via loop-AES you will be shown the following prompt during the boot:
mount: going to use loop device /dev/loop
where Be careful, you have only one try. If you enter wrong passphrase, an error message will appear and mounting will continue with another volume. Please see Section 7.2.3, “Troubleshooting” below for further information. After entering all passphrases the boot should continue as usual. If some of the encrypted volumes could not be mounted due to the wrong passphrase, you will have to mount them after the boot. There are several cases.
|