[solved, by magic] Encryption dilemma

[doctordruidphd]

What I am trying to do: provide a location where a non-root user can store encrypted files, easily accessible, and can be backed up (by root) in encrypted form.

Problem: I am working with more than one distribution (lenny, kubuntu, sidux).

Truecrypt will not run on sidux (yes, it can be made to, partially, with a lot of fussing, including recompiling it with each kernel update, but I don't want to play in that sandbox).

Encfs looks good, but it cannot work with other distribution's files -- files encrypted in kubuntu cannot be read in sidux, etc.(at least as far as I have been able to determine)

cryptsetup/dm- etc. Works well, but I do not see any way to back up the encrypted partition as an encrypted partition, without a lot of fussing around (dd, etc).

Any ideas?

[josefko]

Re: Encryption dilemma

If you want only to encrypt files, there is a shell command that works not only with other distributions but even in Windows. You can program User Actions in Krusader to use it in GUI.

gpg -c --cipher-algo AES256 filename.filetype

Encrypted files will have added filetype gpg and you can do with them what you want.
Decrypt

gpg filename.filetype.gpg

[doctordruidphd]

Re: Encryption dilemma

Thanks for the suggestion.
I want to encrypt an entire directory structure, something like /home/username/encrypted, pointing somewhere else that holds the encrypted files, with on-the-fly access. Encfs is perfect, except other distributions can't read it.
This may not be do-able, just fishing for ideas.

[Snowhog]

Re: Encryption dilemma

Maybe: SD4L - ScramDisk for Linux

[kevinc]

Re: Encryption dilemma

Debian was first to allow encryption using dm-crypt during installation and this is the easiest way to go.
Kubuntu uses the Debian installer but this is limited to the alternate CD image and not on the desktop, but many prefer the alternate anyway for upgrades and normal installations.
When I last tried Sidux (2009.2) it did not include encryption during install but as I have dual boot, I simply kept Kubuntu on some partitions, I had been trying Lenny on some other partitions, then installed Sidux on the partition that I had used for Lenny / only. I used the same swap partition (encrypted) and once Sidux was installed added one line to both /etc/fstab and /etc/crypttab to mount the encrypted partition from Lenny.

I use an external hard disk for backup which is encrypted with dm-crypt. If you mount the encrypted partition as part of your /home then that user such as yourself, can use it. To backup, you need to use sudo.

I had no problem from within either Kubuntu, or Debian or Sidux to access (read or write) to the encrypted backup disk. Just use

sudo cryptsetup luksOpen /dev/sdb backup
sudo mount -t ext3 /dev/mapper/backup /mnt

to open the external drive - backup is whatever name you choose, /dev/sdb depends on how many drives you have attached.

do all of your copying, reading, writing, then close with

sudo umount /mnt
sudo cryptsetup luksClose backup

[doctordruidphd]

Re: Encryption dilemma

@Snowhog:
Thanks for the info. Scramdisk looks interesting. I will have to try it and see if it works.

Edit: Scramdisk is a no-go. The .deb file won't install -- it wants a -28 kernel, and both karmic and sidux use -31. The source won't compile -- evidently it doesn't like something in QT4. Oh well, great idea, though.

@kevinc:

I tried setting up another device, /dev/sda10, with cryptsetup, and it works just fine, no problem reading and writing files with other distributions. Problem is, I can't figure out how to back it up from the internal disk to the external disk. I could mount it and then back up its contents, to another encrypted /dev/sdc# on the external disk, I suppose. But that would mean setting up a separate partition on each backup drive to do this, as I use several external disks in backup rotation. Am I correct that this would be the only way to do it?

[doctordruidphd]

Re: Encryption dilemma

Solved, with no clue how or why.
I attempted to install truecrypt again today on sidux, and the bloody thing installed.
I have no idea how or why; it screamed like a banshee when I tried to install it yesterday.
Magic is never a satisfactory explanation, though sometimes it is the only reasonable one.

[Snowhog]

Re: [solved, by magic] Encryption dilemma

Don't you just love Linux?

[kevinc]

Re: [solved, by magic] Encryption dilemma

Interesting. There's no reason why Truecrypt should not have installed the first time. Truecrypt has the advantage of being available for Linux, Mac and Windows so a truecrypt container, file or partition should be accessible and usable by all three OS's.

I still prefer dm-crypt as it is built into the 2.6 kernel and it works well, and I don't use Mac or Windows.