Encrypt parts of drive?

[Peter Lauri]

Hi,

 

First, sorry for bugging you guys with questions. I am rather new, and I
hope I can contribute later on with more experience.

 

Is there anyway to encrypt parts of a drive? For example: I need to encrypt
a specific home directory /home/confidentialuser/ but not the rest of the
drive, is that possible?

 

Best regards,

Peter Lauri

 

 <http://www.dwsasia.com/> www.dwsasia.com - company web site

 <http://www.lauri.se/> www.lauri.se - personal web site

 <http://www.carbonfree.org.uk/> www.carbonfree.org.uk - become Carbon Free

On Monday 26 February 2007, Peter Lauri wrote:

>  Is there anyway to encrypt parts of a drive? For example:
>  I need to encrypt a specific home directory
>  /home/confidentialuser/ but not the rest of the drive, is
>  that possible? 
Have you looked at permissions yet?

setting the file permissions like this chmod 700 will make 
the file available only to the owner and no one else

[Todd Zullinger]

linuxmaillists(a)charter.net wrote:
>  On Monday 26 February 2007, Peter Lauri wrote:
>  
> > Is there anyway to encrypt parts of a drive? For example:
> > I need to encrypt a specific home directory
> > /home/confidentialuser/ but not the rest of the drive, is
> > that possible?
>  
>  Have you looked at permissions yet?
>  
>  setting the file permissions like this chmod 700 will make 
>  the file available only to the owner and no one else 
That doesn't help you at all if your drive gets stolen.  Anyone with
physical access can easily circumvent permissions in many ways.  It's
not that permissions are useless, just that they don't solve the same
problems that encrypted drives/partitions/containers (attempt to)
solve.

-- 
Todd        OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp
======================================================================
Reality is that which, when you stop believing in it, doesn't go away.
    -- Philip K. Dick

[Peter Lauri]

That would not give me what I want. This because the machine should still be
functional with correct permisttions etc. I have confidential information
that my customer owns, and due to my customers policy I cannot take out the
working machine from their premises unless I encrypt everything that has to
do with the work I am doing for them.

Best regards,
Peter Lauri

www.dwsasia.com - company web site
www.lauri.se - personal web site
www.carbonfree.org.uk - become Carbon Free


-----Original Message-----
From: fedora-list-bounces(a)redhat.com [mailto:[e-mail]]
On Behalf Of linuxmaillists(a)charter.net
Sent: Tuesday, February 27, 2007 12:48 AM
To: For users of Fedora
Subject: Re: Encrypt parts of drive?

On Monday 26 February 2007, Peter Lauri wrote:

>  Is there anyway to encrypt parts of a drive? For example:
>  I need to encrypt a specific home directory
>  /home/confidentialuser/ but not the rest of the drive, is
>  that possible? 
Have you looked at permissions yet?

setting the file permissions like this chmod 700 will make 
the file available only to the owner and no one else

-- 
fedora-list mailing list
fedora-list(a)redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list

[Todd Zullinger]

Peter Lauri wrote:
>  First, sorry for bugging you guys with questions. I am rather new,
>  and I hope I can contribute later on with more experience. 
Promise? :)

>  Is there anyway to encrypt parts of a drive? For example: I need to
>  encrypt a specific home directory /home/confidentialuser/ but not
>  the rest of the drive, is that possible? 
One way to do this is via fuse-encfs (yum install fuse-encfs).

See the examples in the man page.

There are other ways as well, using dm-crypt to create an encrypted
container.  It's been a while since I played with any of them, so
hopefully others can chime in with the pros and cons of various
methods.

-- 
Todd        OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp
======================================================================
A baby first laughs at the age of four weeks.  By that time his eyes
focus well enough to see you clearly.

[Peter Lauri]

Hi,

How would this affect speed? I would only have customers data encrypted as
well as my own working directory where I keep all cvs etc. System parts
would be without encryption.

Best regards,
Peter Lauri

www.dwsasia.com - company web site
www.lauri.se - personal web site
www.carbonfree.org.uk - become Carbon Free


-----Original Message-----
From: fedora-list-bounces(a)redhat.com [mailto:[e-mail]]
On Behalf Of Todd Zullinger
Sent: Tuesday, February 27, 2007 12:59 AM
To: fedora-list(a)redhat.com
Subject: Re: Encrypt parts of drive?

Peter Lauri wrote:
>  First, sorry for bugging you guys with questions. I am rather new,
>  and I hope I can contribute later on with more experience. 
Promise? :)

>  Is there anyway to encrypt parts of a drive? For example: I need to
>  encrypt a specific home directory /home/confidentialuser/ but not
>  the rest of the drive, is that possible? 
One way to do this is via fuse-encfs (yum install fuse-encfs).

See the examples in the man page.

There are other ways as well, using dm-crypt to create an encrypted
container.  It's been a while since I played with any of them, so
hopefully others can chime in with the pros and cons of various
methods.

-- 
Todd        OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp
======================================================================
A baby first laughs at the age of four weeks.  By that time his eyes
focus well enough to see you clearly.

[Vivek J. Patankar]

On 2/27/07, Peter Lauri <lists(a)dwsasia.com&gt; wrote:
>  How would this affect speed? I would only have customers data
> encrypted as
>  well as my own working directory where I keep all cvs etc. System parts
>  would be without encryption. 
The access delay, if any, is hardly noticable. I use fuse-encfs to
store my financial data and revelation database and have not noticed
any access speed issues.
If you are encrypting your entire home directory using fuse-encfs, you
will have to unlock before you login. I would recomment creating a
secure folder within your home which you keep encrypted. Note that you
have to lock/unlock your secure directory manually.

-- 
Regards
Vivek

Registered Linux User #374218
Fedora Core release 6 (Zod)
Linux 2.6.18-1.2798.fc6 x86_64

[Peter Lauri]

So if I forget to lock it and the computer is stolen then it is not
encrypted? Is the lock/unlock part just for the system to be able to read
from it?

Best regards,
Peter Lauri

www.dwsasia.com - company web site
www.lauri.se - personal web site
www.carbonfree.org.uk - become Carbon Free



-----Original Message-----
From: fedora-list-bounces(a)redhat.com [mailto:[e-mail]]
On Behalf Of Vivek J. Patankar
Sent: Tuesday, February 27, 2007 6:43 AM
To: For users of Fedora
Subject: Re: Encrypt parts of drive?

On 2/27/07, Peter Lauri <lists(a)dwsasia.com&gt; wrote:
>  How would this affect speed? I would only have customers data
> encrypted as
>  well as my own working directory where I keep all cvs etc. System parts
>  would be without encryption. 
The access delay, if any, is hardly noticable. I use fuse-encfs to
store my financial data and revelation database and have not noticed
any access speed issues.
If you are encrypting your entire home directory using fuse-encfs, you
will have to unlock before you login. I would recomment creating a
secure folder within your home which you keep encrypted. Note that you
have to lock/unlock your secure directory manually.

-- 
Regards
Vivek

Registered Linux User #374218
Fedora Core release 6 (Zod)
Linux 2.6.18-1.2798.fc6 x86_64

-- 
fedora-list mailing list
fedora-list(a)redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list

[Vivek J. Patankar]

Peter Lauri wrote:
>  So if I forget to lock it and the computer is stolen then it is not
>  encrypted? Is the lock/unlock part just for the system to be able to read
>  from it? 
If the laptop is shutdown, the encrypted filesystem is automatically 
unmounted. I have made it a habit to unmount it manually as I don't 
/shutdown/ my laptop, I hibernate it.

A howto by Todd Warner is a good resource to read before starting with 
fuse-encfs. It'll clear the basics.
http://www.dma.org/~tw/howtos/howto-fuse-encfs-the-web.html

-- 
Regards
Vivek J. Patankar

Registered Linux User #374218
Fedora Core release 6 (Zod)
Linux 2.6.18-1.2798.fc6 x86_64

[Todd Zullinger]

Peter Lauri wrote:
>  How would this affect speed? I would only have customers data
>  encrypted as well as my own working directory where I keep all cvs
>  etc. 
On most halfway decent/recent systems you won't notice much difference
at all, but that's just my opinion.  I'd say install encfs and give it
a quick try to see if it seems reasonable to you.  It's a fairly quick
and simple thing to setup. :)

>  System parts would be without encryption. 
You may consider encrypting your swap (or disabling swap entirely if
you have lots of RAM.  That way no confidential data should reach the
disk in any usable form.

There was an article in a recent Red Hat magazine issue on disk
encryption that may prove interesting to you:

http://www.redhatmagazine.com/2007/01/18/disk-encryption-in-fedora-past-p...

HTH,

-- 
Todd        OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp
======================================================================
Quick to judge, quick to anger, slow to understand.
Ignorance and prejudice and fear walk hand in hand.

[Peter Lauri]

Thanks. I will read the article and go thru all parts with my manager so he
can approve me taking out the laptop.

Best regards,
Peter Lauri

www.dwsasia.com - company web site
www.lauri.se - personal web site
www.carbonfree.org.uk - become Carbon Free




-----Original Message-----
From: fedora-list-bounces(a)redhat.com [mailto:[e-mail]]
On Behalf Of Todd Zullinger
Sent: Tuesday, February 27, 2007 7:01 AM
To: fedora-list(a)redhat.com
Subject: Re: Encrypt parts of drive?

Peter Lauri wrote:
>  How would this affect speed? I would only have customers data
>  encrypted as well as my own working directory where I keep all cvs
>  etc. 
On most halfway decent/recent systems you won't notice much difference
at all, but that's just my opinion.  I'd say install encfs and give it
a quick try to see if it seems reasonable to you.  It's a fairly quick
and simple thing to setup. :)

>  System parts would be without encryption. 
You may consider encrypting your swap (or disabling swap entirely if
you have lots of RAM.  That way no confidential data should reach the
disk in any usable form.

There was an article in a recent Red Hat magazine issue on disk
encryption that may prove interesting to you:

http://www.redhatmagazine.com/2007/01/18/disk-encryption-in-fedora-past-pres
ent-and-future/

HTH,

-- 
Todd        OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp
======================================================================
Quick to judge, quick to anger, slow to understand.
Ignorance and prejudice and fear walk hand in hand.

[Ric Moore]

On Tue, 2007-02-27 at 07:08 +0200, Peter Lauri wrote:
>  Thanks. I will read the article and go thru all parts with my manager
> so he
>  can approve me taking out the laptop.
>  
>  Best regards,
>  Peter Lauri 
You don't happen to work for the V.A.? <g> Ric

-- 
================================================
My father, Victor Moore (Vic) used to say:
"There are two Great Sins in the world...
..the Sin of Ignorance, and the Sin of Stupidity.
Only the former may be overcome." R.I.P. Dad.
Linux user# 44256 Sign up at: http://counter.li.org/
http://www.sourceforge.net/projects/oar
http://www.wayward4now.net
================================================

[Tim]

On Tue, 2007-02-27 at 00:00 -0500, Todd Zullinger wrote:
>  You may consider encrypting your swap (or disabling swap entirely if
>  you have lots of RAM.  That way no confidential data should reach the
>  disk in any usable form. 
I imagine you'd also want to change how you use /tmp, as well.  Perhaps
using tmpfs (which'll use RAM instead of disc space).

-- 
(This PC runs FC4, my others FC5 & FC6, in case that's important
 to the thread)

Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.

[Todd Zullinger]

Tim wrote:
>  On Tue, 2007-02-27 at 00:00 -0500, Todd Zullinger wrote:
> > You may consider encrypting your swap (or disabling swap entirely
> > if you have lots of RAM.  That way no confidential data should
> > reach the disk in any usable form.
>  
>  I imagine you'd also want to change how you use /tmp, as well.
>  Perhaps using tmpfs (which'll use RAM instead of disc space). 
Good point.  (In theory you could also set TMPDIR to somewhere that's
secured, but then you'd get burned by any apps that are hardwired to
use /tmp.  So tmpfs is a better option.)

-- 
Todd        OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp
======================================================================
Never take life seriously.  Nobody gets out alive anyway.

[Tim]

Tim:
> > I imagine you'd also want to change how you use /tmp, as
> well.
> > Perhaps using tmpfs (which'll use RAM instead of disc space). 
Todd Zullinger:
>  Good point.  (In theory you could also set TMPDIR to somewhere
> that's
>  secured, but then you'd get burned by any apps that are hardwired to
>  use /tmp.  So tmpfs is a better option.) 
Though that has it's own problems.  I notice that Nautilus wants to
use /tmp to create disc burning image files, you'd have to wade through
gconf to point that elsewhere, unless you had enough RAM to do that
off-disc.  I don't know about other programs that make large temporary
files.

There's also a /var/tmp/ directory, but I've not seen anything make use
of it.  Though, again, you could mount it using tmpfs.

-- 
(This box runs FC6, my others run FC4 & FC5, in case that's
 important to the thread.)

Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.

[Mikkel]

Tim wrote:
>  Tim:
> >> I imagine you'd also want to change how you use /tmp, as well.
> >> Perhaps using tmpfs (which'll use RAM instead of disc space).
>  
>  Todd Zullinger:
> > Good point.  (In theory you could also set TMPDIR to somewhere that's
> > secured, but then you'd get burned by any apps that are hardwired to
> > use /tmp.  So tmpfs is a better option.)
>  
>  Though that has it's own problems.  I notice that Nautilus wants to
>  use /tmp to create disc burning image files, you'd have to wade through
>  gconf to point that elsewhere, unless you had enough RAM to do that
>  off-disc.  I don't know about other programs that make large temporary
>  files.
>  
>  There's also a /var/tmp/ directory, but I've not seen anything make use
>  of it.  Though, again, you could mount it using tmpfs.
>   
There is a /usr/tmp that is a link to /var/tmp. I am not sure if it
gets used ether.

You can also set TMP to someplace useful. I am not sure how many
programs pay attention to it. I know that with Mandriva, TMP pointed
to a directory in the user's home directory, and most programs
appeared to used it. A bunch of my scripts also check for TMP, and
use it if it is set, or default to /tmp if it is not.

Mikkel
-- 

  Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!