Projet

Général

Profil

Ecryptfs » Historique » Version 3

Mehdi Abaakouk, 02/06/2013 21:13

1 2 Mehdi Abaakouk
{{>toc}} 
2 3 Mehdi Abaakouk
3 1 Mehdi Abaakouk
h1. Ecryptfs
4 1 Mehdi Abaakouk
5 1 Mehdi Abaakouk
6 1 Mehdi Abaakouk
h2. La méthod root
7 1 Mehdi Abaakouk
8 1 Mehdi Abaakouk
* Permet de choisir le répertoire crypté
9 1 Mehdi Abaakouk
* Utilise une passephrase 
10 1 Mehdi Abaakouk
* Ne dépends pas de logiciel exterieur
11 1 Mehdi Abaakouk
12 1 Mehdi Abaakouk
h3. Configuration
13 1 Mehdi Abaakouk
14 1 Mehdi Abaakouk
Création des répertoires 
15 1 Mehdi Abaakouk
16 1 Mehdi Abaakouk
<pre>
17 1 Mehdi Abaakouk
# mkdir -m 500 -p mysecretdir
18 1 Mehdi Abaakouk
# mkdir -m 700 -p .mysecretdir
19 1 Mehdi Abaakouk
</pre>
20 1 Mehdi Abaakouk
21 1 Mehdi Abaakouk
Initialisation du répertoire crypté:
22 1 Mehdi Abaakouk
23 1 Mehdi Abaakouk
<pre>
24 1 Mehdi Abaakouk
# sudo mount -t ecryptfs -o no_sig_cache .mysecretdir mysecretdir
25 1 Mehdi Abaakouk
26 1 Mehdi Abaakouk
Passphrase: *your_passphrase*
27 1 Mehdi Abaakouk
Select cipher: 
28 1 Mehdi Abaakouk
 1) aes: blocksize = 16; min keysize = 16; max keysize = 32
29 1 Mehdi Abaakouk
 2) blowfish: blocksize = 8; min keysize = 16; max keysize = 56
30 1 Mehdi Abaakouk
 3) des3_ede: blocksize = 8; min keysize = 24; max keysize = 24
31 1 Mehdi Abaakouk
 4) twofish: blocksize = 16; min keysize = 16; max keysize = 32
32 1 Mehdi Abaakouk
 5) cast6: blocksize = 16; min keysize = 16; max keysize = 32
33 1 Mehdi Abaakouk
 6) cast5: blocksize = 8; min keysize = 5; max keysize = 16
34 1 Mehdi Abaakouk
Selection [aes]: *<enter>*
35 1 Mehdi Abaakouk
Select key bytes: 
36 1 Mehdi Abaakouk
 1) 16
37 1 Mehdi Abaakouk
 2) 32
38 1 Mehdi Abaakouk
 3) 24
39 1 Mehdi Abaakouk
Selection [16]: *<enter>*
40 1 Mehdi Abaakouk
Enable plaintext passthrough (y/n) [n]: *<enter>*
41 1 Mehdi Abaakouk
Enable filename encryption (y/n) [n] : *y*
42 1 Mehdi Abaakouk
Filename Encryption Key (FNEK) Signature [XXXXXXXXXXXXXXXXXXX]: *<enter>*
43 1 Mehdi Abaakouk
Attempting to mount with the following options:
44 1 Mehdi Abaakouk
  ecryptfs_unlink_sigs
45 1 Mehdi Abaakouk
  ecryptfs_fnek_sig=XXXXXXXXXXXXXX
46 1 Mehdi Abaakouk
  ecryptfs_key_bytes=16
47 1 Mehdi Abaakouk
  ecryptfs_cipher=aes
48 1 Mehdi Abaakouk
  ecryptfs_sig=XXXXXXXXXXXXXX
49 1 Mehdi Abaakouk
Mounted eCryptfs
50 1 Mehdi Abaakouk
</pre>
51 1 Mehdi Abaakouk
52 1 Mehdi Abaakouk
On peux memoriser les options choisi dans son /etc/fstab comme ceci pour quelle ne soit pas redemandé à chaque montage:
53 1 Mehdi Abaakouk
54 1 Mehdi Abaakouk
<pre>
55 1 Mehdi Abaakouk
/home/sileht/.mysecretdir /home/sileht/mysecretdir ecryptfs noauto,ecryptfs_enable_filename_crypto=y,ecryptfs_unlink_sigs,ecryptfs_fnek_sig=XXXXXXXXXXXXXX,ecryptfs_key_bytes=16,ecryptfs_cipher=aes,ecryptfs_sig=XXXXXXXXXXXXXX,ecryptfs_passthrough=no,no_sig_cache 0 0
56 1 Mehdi Abaakouk
</pre>
57 1 Mehdi Abaakouk
58 1 Mehdi Abaakouk
59 1 Mehdi Abaakouk
h3. Utilisation:
60 1 Mehdi Abaakouk
61 1 Mehdi Abaakouk
si il n'est pas monté: 
62 1 Mehdi Abaakouk
63 1 Mehdi Abaakouk
<pre>
64 1 Mehdi Abaakouk
# sudo mount mysecretdir
65 1 Mehdi Abaakouk
</pre>
66 1 Mehdi Abaakouk
67 1 Mehdi Abaakouk
Puis,
68 1 Mehdi Abaakouk
69 1 Mehdi Abaakouk
<pre>
70 1 Mehdi Abaakouk
# echo "TEST" > mysecretdir/test
71 1 Mehdi Abaakouk
# sudo umount mysecretdir
72 1 Mehdi Abaakouk
73 1 Mehdi Abaakouk
# find .mysecretdir 
74 1 Mehdi Abaakouk
.mysecretdir
75 1 Mehdi Abaakouk
.mysecretdir/ECRYPTFS_FNEK_ENCRYPTED.FWZSxtNBzRhUc-T0igL-f2xajxDl2TU2MN3yqm0Itm4EZOA0-Ks4Ul599k--
76 1 Mehdi Abaakouk
77 1 Mehdi Abaakouk
# sudo mount mysecretdir 
78 1 Mehdi Abaakouk
Passphrase: 
79 1 Mehdi Abaakouk
Attempting to mount with the following options:
80 1 Mehdi Abaakouk
  ecryptfs_unlink_sigs
81 1 Mehdi Abaakouk
  ecryptfs_fnek_sig=5ef7964dfddb60a0
82 1 Mehdi Abaakouk
  ecryptfs_key_bytes=16
83 1 Mehdi Abaakouk
  ecryptfs_cipher=aes
84 1 Mehdi Abaakouk
  ecryptfs_sig=5ef7964dfddb60a0
85 1 Mehdi Abaakouk
Mounted eCryptfs
86 1 Mehdi Abaakouk
87 1 Mehdi Abaakouk
# cat mysecretdir/test 
88 1 Mehdi Abaakouk
TEST
89 1 Mehdi Abaakouk
90 1 Mehdi Abaakouk
</pre>
91 2 Mehdi Abaakouk
92 1 Mehdi Abaakouk
h2. La méthode userland
93 1 Mehdi Abaakouk
94 1 Mehdi Abaakouk
* Le répertoire crypté est forcément Private et .Private
95 1 Mehdi Abaakouk
* Ce mountage est automatiquement monté/démonté à l'ouverture/fermeture de session (optionnel)
96 1 Mehdi Abaakouk
* Utilise le mot de passe de login et le trousseau de clé de la session utilisateur
97 1 Mehdi Abaakouk
98 1 Mehdi Abaakouk
h3. Configuration
99 1 Mehdi Abaakouk
100 1 Mehdi Abaakouk
<pre>
101 1 Mehdi Abaakouk
# ecryptfs-setup-private [--noautomount]
102 1 Mehdi Abaakouk
Enter your login passphrase [sileht]: *<login password>*
103 1 Mehdi Abaakouk
Enter your mount passphrase [leave blank to generate one]: *<enter>*
104 1 Mehdi Abaakouk
105 1 Mehdi Abaakouk
************************************************************************
106 1 Mehdi Abaakouk
YOU SHOULD RECORD YOUR MOUNT PASSPHRASE AND STORE IT IN A SAFE LOCATION.
107 1 Mehdi Abaakouk
  ecryptfs-unwrap-passphrase ~/.ecryptfs/wrapped-passphrase
108 1 Mehdi Abaakouk
THIS WILL BE REQUIRED IF YOU NEED TO RECOVER YOUR DATA AT A LATER TIME.
109 1 Mehdi Abaakouk
************************************************************************
110 1 Mehdi Abaakouk
111 1 Mehdi Abaakouk
112 1 Mehdi Abaakouk
Done configuring.
113 1 Mehdi Abaakouk
114 1 Mehdi Abaakouk
Testing mount/write/umount/read...
115 1 Mehdi Abaakouk
Inserted auth tok with sig [00c5d51878ceb7a2] into the user session keyring
116 1 Mehdi Abaakouk
Inserted auth tok with sig [adb24429adf745ac] into the user session keyring
117 1 Mehdi Abaakouk
Inserted auth tok with sig [00c5d51878ceb7a2] into the user session keyring
118 1 Mehdi Abaakouk
Inserted auth tok with sig [adb24429adf745ac] into the user session keyring
119 1 Mehdi Abaakouk
Testing succeeded.
120 1 Mehdi Abaakouk
121 1 Mehdi Abaakouk
Logout, and log back in to begin using your encrypted directory.
122 1 Mehdi Abaakouk
</pre>
123 1 Mehdi Abaakouk
124 1 Mehdi Abaakouk
Et c'est tout!
125 1 Mehdi Abaakouk
126 1 Mehdi Abaakouk
127 1 Mehdi Abaakouk
h3. Utilisation
128 1 Mehdi Abaakouk
129 1 Mehdi Abaakouk
<pre>
130 1 Mehdi Abaakouk
# ecryptfs-mount-private 
131 1 Mehdi Abaakouk
Enter your login passphrase: *<login password>*
132 1 Mehdi Abaakouk
Inserted auth tok with sig [00c5d51878ceb7a2] into the user session keyring
133 1 Mehdi Abaakouk
134 1 Mehdi Abaakouk
# echo TEST > Private/test
135 1 Mehdi Abaakouk
136 1 Mehdi Abaakouk
# ecryptfs-umount-private
137 1 Mehdi Abaakouk
# find .Private
138 1 Mehdi Abaakouk
.Private
139 1 Mehdi Abaakouk
.Private/ECRYPTFS_FNEK_ENCRYPTED.FWahgYEdfTR3f-RdHuZMGUBU4uG4WV898FA9hmsdE.MuvMqujcoOMMUII---
140 1 Mehdi Abaakouk
141 1 Mehdi Abaakouk
# ecryptfs-mount-private 
142 1 Mehdi Abaakouk
Enter your login passphrase: *<login password>*
143 1 Mehdi Abaakouk
Inserted auth tok with sig [00c5d51878ceb7a2] into the user session keyring
144 1 Mehdi Abaakouk
145 1 Mehdi Abaakouk
# cat Private/test
146 1 Mehdi Abaakouk
TEST
147 1 Mehdi Abaakouk
</pre>