Geeks
Lunch - Intensive Version -HowTo's
Encrypted USB Filesystem
I bought a Lexar Jump drive to
keep my personal files on so I don't keep them on the laptop owned by
the company I work for. Also with the pervasive layoffs in my
company over the last year it will make it much easier for the day they
say "here's your pinkslip, pack-up all your stuff; and no, you can't
keep the laptop"; if that day ever arrives. If so it's
just, grab my USB device, say farewell and hit the want ads. I
also don't want it readable if I happen to leave it laying around or
lose it, its full of Million-Dollar-Ideas(tm).
So its time to do the "USB-encrypted-filesystem-thang". Here's
the quick and dirty on how to set it up on Fedora Core 3 (FC3)
Automount Works
Fedora Core 3 automagically
mounted the drive on boot
/dev/sda1 on
/media/LEXAR_MEDIA type vfat
(rw,nosuid,nodev,sync,noatime,iocharset=utf8)
That a good start. It came with a movie trailer for "BE COOL" already
loaded. Also on the device are Winblows, Mac, and Linux
directories. In the Linux directory there is a GUI setup tool for
the hardware encryption which works and a loadable kernel module that
doesn't. :( When I checked out their website
(http://www.lexar.com/support/lexar_support.html) they had no updates,
no source code, no mention of Linux at all. Bummer.
So now I've got an unencrypted
USB filesystem. Not good. Time to start from scratch.
Being the paranoid type, I don't
trust their proprietary encryption system anyway.
You know, the one with the back door key of "letNSAin", so
lets do the Linux version.
Tools Up
We need some tools- easy
enough- yum will get them
yum install cryptsetup
To see what encryption options are available to the kernel
type
cat /proc/crypto
There is nothing good there by default so lets install blowfish.
insmod
/lib/modules/2.6.10-1.770_FC3smp/kernel/crypto/blowfish.ko
(use kernel path dujour)
now a cat /proc/crypto
shows that blowfish is available.
Device setup
Don't forget to umount /media/LEXAR_MEDIA (or
whatever your device is if you're using something else. Use dmesg
| less to look for your device name or just mount if its already
mounted.)
Here's where the
real-magic(tm) happens. Setup the encrypted device with
cryptsetup -c blowfish -s48
-b1014784 create cryptvol /dev/sda
where -s is keysize (cat /proc/crypto for
options)
-b is number of
sectors (get with blockdev
--getsize /dev/sda)
cryptvol is the
name of the volume to create
and finally the actual device is the last item on the
command line
It will prompt you for a pass phrase, if you're going to all this
trouble- pick a good one. That's it. You know have a
blowfish encrypted device. But what to do with it? First:
Lets create a filesystem on the encrypted device.
mkfs /dev/mapper/cryptvol
Now we're all done except for:
Mounting the new device
mount
/dev/mapper/cryptvol /mnt
Looking at the device with
df -h
shows
/dev/mapper/cryptvol 480M
2.3M 453M 1% /mnt
(of the 512MB advertised space)
Speed Testing
I did a test copy of 271M
of various files in a subdirectory to the encrypted device and as a
comparison to another directory on my HD. My system was rather busy
doing other things at the time.
First the encrypted drive
time cp -ar /root/monta /mnt
real 1m16.873s
Now the HD
time cp -ar /root/monta /tmp
real 1m26.636s
The encrypted filesystem was faster in this test- but remember that
copying
from the HD back to the HD is twice the load on it. While it
appears that
the encrypted filesystem is slower than than the HD it is plenty fast
and
if feels responsive to work with.
Note: if you want to
make the encrypted filesystem unavailable while the computer is still
on, after you umount the filesystem execute
cryptsetup remove cryptvol
(otherwise it can simply be mounted again)
Final note: I wouldn't put your browser cache or similar on a USB device
because the non-infinite number of re-writes available.
For more info see http://www.saout.de/misc/dm-crypt/
The most recent copy of this
document is here.
http://www.geekslunch.com/glivh/Encrypted_USB_filesystem.html
written by: Monta Elkins
Back to GLIVH's [Geeks
Lunch Intensive HowTo's]
email Monta.gl @ [this domain]
Please send you comments/feedback/suggestions
or if you really liked it; link to it.