F10 and encrypted partitions - positive outcome

[mike cloaked]

One thing that has not been discussed on this forum for a while is the issue
of the handling of encrypted partitions in F10.

I have an old test laptop that had previously been installed with F9 with
encrypted swap, /, and /opt partitions and an unencrypted /boot partition.

I ran a clean F10 install and asked the installer to reformat the swap, root
and /opt partitions, which it did.

The nice surprise was that on firstboot the system asked me to enter the
luks passphrase for the root partition and seemed to have stored the
passphrases for the other partitions within the root partition so only a
single passphrase was requested. This is excellent and means that booting
the fully encrypted system is now very user friendly.  

This makes usability (user friendliness) excellent - so congrats to the
developers for getting this right in F10.

I have not tried suspending that machine so I don't know if coming back from
suspend actually works for this machine but at least booting works nicely
now.
-- 
View this message in context:
http://www.nabble.com/F10-and-encrypted-partitions---positive-outcome-tp2...
Sent from the Fedora List mailing list archive at Nabble.com.

[Bruno Wolff III]

On Sat, Jan 03, 2009 at 03:41:22 -0800,
  Mike Cloaked <mike.cloaked(a)gmail.com&gt; wrote:
>  
>  The nice surprise was that on firstboot the system asked me to enter the
>  luks passphrase for the root partition and seemed to have stored the
>  passphrases for the other partitions within the root partition so only a
>  single passphrase was requested. This is excellent and means that booting
>  the fully encrypted system is now very user friendly.   
Do you use the same passphrase for all partitions? It has been a feature
since close to the release of F10 that it tried any entered passphrase
against each luks partition.

[mike cloaked]

Bruno Wolff III wrote:
>  
>  On Sat, Jan 03, 2009 at 03:41:22 -0800,
>    Mike Cloaked <mike.cloaked(a)gmail.com&gt; wrote:
> > 
> > The nice surprise was that on firstboot the system asked me to enter the
> > luks passphrase for the root partition and seemed to have stored the
> > passphrases for the other partitions within the root partition so only a
> > single passphrase was requested. This is excellent and means that booting
> > the fully encrypted system is now very user friendly.  
>  
>  Do you use the same passphrase for all partitions? It has been a feature
>  since close to the release of F10 that it tried any entered passphrase
>  against each luks partition.
>  
>   
Yes I chose the same passphrase for all three partitions.  This is the same
scheme I used for F9 but in F9 it asked me three separate times for the
passphrases despite them all being the same. I did not click on the first
one as a master passphrase though (as far as I remember!)

In F10 the screen halts soon after the "post" with a simple request for the
passphrase and then continues with the text simplified Plymouth blue and
white boot progress indicator - which although information-free does work
fast and well.

So I am happy with this.
-- 
View this message in context:
http://www.nabble.com/F10-and-encrypted-partitions---positive-outcome-tp2...
Sent from the Fedora List mailing list archive at Nabble.com.

[Bruno Wolff III]

On Sat, Jan 03, 2009 at 08:41:53 -0800,
  Mike Cloaked <mike.cloaked(a)gmail.com&gt; wrote:
>  
>  Yes I chose the same passphrase for all three partitions.  This is the same
>  scheme I used for F9 but in F9 it asked me three separate times for the
>  passphrases despite them all being the same. I did not click on the first
>  one as a master passphrase though (as far as I remember!) 
That's odd though. I misspoke when I said shortly before F10, it was shortly
before the F9 release that it started using passphrases against each
luks partition. Maybe there was something different about how your
partitions were setup that F9 couldn't handle, but F10 can.

You can see that the passphrases aren't being saved (well at least that
saved ones aren't bing used) by entering an incorrect passphrase before
a correct one. You'll then get a warning message for each luks partition
that there is no key slot unlocked by that passphrase.

[mike cloaked]

Bruno Wolff III wrote:
>  
>  
>  That's odd though. I misspoke when I said shortly before F10, it was
>  shortly
>  before the F9 release that it started using passphrases against each
>  luks partition. Maybe there was something different about how your
>  partitions were setup that F9 couldn't handle, but F10 can.
>  
>  You can see that the passphrases aren't being saved (well at least that
>  saved ones aren't bing used) by entering an incorrect passphrase before
>  a correct one. You'll then get a warning message for each luks partition
>  that there is no key slot unlocked by that passphrase.
>  
>   
Interesting!  The F9 partitions were set up nominally using the same
technique during the F9 install as I just did for F10 (except that I had
previously randomised all the partitions just ahead of the original F9
install). The F10 install was a clean install over the F9 partitions but
nothing additional was done.

Either way I do like the current setup - I have not yet plugged in a test
encrypted usbkey that I was playing with under F9, nor a luks encrypted CD
that I prepared in F9.  For the usbkey the system just asked for the
passphrase after plugging in and then just mounted and was visible, so I
hope this will be the same in F10.

The encrypted CD was a pain in F9 and needed some commands entering to set
up the mapping - certainly it would not just ask for the passphrase and
mount - I am currently testing some other things on the encrypted laptop but
I will do these tests hopefully before the weekend is out.

Mike
-- 
View this message in context:
http://www.nabble.com/F10-and-encrypted-partitions---positive-outcome-tp2...
Sent from the Fedora List mailing list archive at Nabble.com.