Ecryptfs » Historique » Version 3
Mehdi Abaakouk, 02/06/2013 21:13
1 | 2 | Mehdi Abaakouk | {{>toc}} |
---|---|---|---|
2 | 3 | Mehdi Abaakouk | |
3 | 1 | Mehdi Abaakouk | h1. Ecryptfs |
4 | 1 | Mehdi Abaakouk | |
5 | 1 | Mehdi Abaakouk | |
6 | 1 | Mehdi Abaakouk | h2. La méthod root |
7 | 1 | Mehdi Abaakouk | |
8 | 1 | Mehdi Abaakouk | * Permet de choisir le répertoire crypté |
9 | 1 | Mehdi Abaakouk | * Utilise une passephrase |
10 | 1 | Mehdi Abaakouk | * Ne dépends pas de logiciel exterieur |
11 | 1 | Mehdi Abaakouk | |
12 | 1 | Mehdi Abaakouk | h3. Configuration |
13 | 1 | Mehdi Abaakouk | |
14 | 1 | Mehdi Abaakouk | Création des répertoires |
15 | 1 | Mehdi Abaakouk | |
16 | 1 | Mehdi Abaakouk | <pre> |
17 | 1 | Mehdi Abaakouk | # mkdir -m 500 -p mysecretdir |
18 | 1 | Mehdi Abaakouk | # mkdir -m 700 -p .mysecretdir |
19 | 1 | Mehdi Abaakouk | </pre> |
20 | 1 | Mehdi Abaakouk | |
21 | 1 | Mehdi Abaakouk | Initialisation du répertoire crypté: |
22 | 1 | Mehdi Abaakouk | |
23 | 1 | Mehdi Abaakouk | <pre> |
24 | 1 | Mehdi Abaakouk | # sudo mount -t ecryptfs -o no_sig_cache .mysecretdir mysecretdir |
25 | 1 | Mehdi Abaakouk | |
26 | 1 | Mehdi Abaakouk | Passphrase: *your_passphrase* |
27 | 1 | Mehdi Abaakouk | Select cipher: |
28 | 1 | Mehdi Abaakouk | 1) aes: blocksize = 16; min keysize = 16; max keysize = 32 |
29 | 1 | Mehdi Abaakouk | 2) blowfish: blocksize = 8; min keysize = 16; max keysize = 56 |
30 | 1 | Mehdi Abaakouk | 3) des3_ede: blocksize = 8; min keysize = 24; max keysize = 24 |
31 | 1 | Mehdi Abaakouk | 4) twofish: blocksize = 16; min keysize = 16; max keysize = 32 |
32 | 1 | Mehdi Abaakouk | 5) cast6: blocksize = 16; min keysize = 16; max keysize = 32 |
33 | 1 | Mehdi Abaakouk | 6) cast5: blocksize = 8; min keysize = 5; max keysize = 16 |
34 | 1 | Mehdi Abaakouk | Selection [aes]: *<enter>* |
35 | 1 | Mehdi Abaakouk | Select key bytes: |
36 | 1 | Mehdi Abaakouk | 1) 16 |
37 | 1 | Mehdi Abaakouk | 2) 32 |
38 | 1 | Mehdi Abaakouk | 3) 24 |
39 | 1 | Mehdi Abaakouk | Selection [16]: *<enter>* |
40 | 1 | Mehdi Abaakouk | Enable plaintext passthrough (y/n) [n]: *<enter>* |
41 | 1 | Mehdi Abaakouk | Enable filename encryption (y/n) [n] : *y* |
42 | 1 | Mehdi Abaakouk | Filename Encryption Key (FNEK) Signature [XXXXXXXXXXXXXXXXXXX]: *<enter>* |
43 | 1 | Mehdi Abaakouk | Attempting to mount with the following options: |
44 | 1 | Mehdi Abaakouk | ecryptfs_unlink_sigs |
45 | 1 | Mehdi Abaakouk | ecryptfs_fnek_sig=XXXXXXXXXXXXXX |
46 | 1 | Mehdi Abaakouk | ecryptfs_key_bytes=16 |
47 | 1 | Mehdi Abaakouk | ecryptfs_cipher=aes |
48 | 1 | Mehdi Abaakouk | ecryptfs_sig=XXXXXXXXXXXXXX |
49 | 1 | Mehdi Abaakouk | Mounted eCryptfs |
50 | 1 | Mehdi Abaakouk | </pre> |
51 | 1 | Mehdi Abaakouk | |
52 | 1 | Mehdi Abaakouk | On peux memoriser les options choisi dans son /etc/fstab comme ceci pour quelle ne soit pas redemandé à chaque montage: |
53 | 1 | Mehdi Abaakouk | |
54 | 1 | Mehdi Abaakouk | <pre> |
55 | 1 | Mehdi Abaakouk | /home/sileht/.mysecretdir /home/sileht/mysecretdir ecryptfs noauto,ecryptfs_enable_filename_crypto=y,ecryptfs_unlink_sigs,ecryptfs_fnek_sig=XXXXXXXXXXXXXX,ecryptfs_key_bytes=16,ecryptfs_cipher=aes,ecryptfs_sig=XXXXXXXXXXXXXX,ecryptfs_passthrough=no,no_sig_cache 0 0 |
56 | 1 | Mehdi Abaakouk | </pre> |
57 | 1 | Mehdi Abaakouk | |
58 | 1 | Mehdi Abaakouk | |
59 | 1 | Mehdi Abaakouk | h3. Utilisation: |
60 | 1 | Mehdi Abaakouk | |
61 | 1 | Mehdi Abaakouk | si il n'est pas monté: |
62 | 1 | Mehdi Abaakouk | |
63 | 1 | Mehdi Abaakouk | <pre> |
64 | 1 | Mehdi Abaakouk | # sudo mount mysecretdir |
65 | 1 | Mehdi Abaakouk | </pre> |
66 | 1 | Mehdi Abaakouk | |
67 | 1 | Mehdi Abaakouk | Puis, |
68 | 1 | Mehdi Abaakouk | |
69 | 1 | Mehdi Abaakouk | <pre> |
70 | 1 | Mehdi Abaakouk | # echo "TEST" > mysecretdir/test |
71 | 1 | Mehdi Abaakouk | # sudo umount mysecretdir |
72 | 1 | Mehdi Abaakouk | |
73 | 1 | Mehdi Abaakouk | # find .mysecretdir |
74 | 1 | Mehdi Abaakouk | .mysecretdir |
75 | 1 | Mehdi Abaakouk | .mysecretdir/ECRYPTFS_FNEK_ENCRYPTED.FWZSxtNBzRhUc-T0igL-f2xajxDl2TU2MN3yqm0Itm4EZOA0-Ks4Ul599k-- |
76 | 1 | Mehdi Abaakouk | |
77 | 1 | Mehdi Abaakouk | # sudo mount mysecretdir |
78 | 1 | Mehdi Abaakouk | Passphrase: |
79 | 1 | Mehdi Abaakouk | Attempting to mount with the following options: |
80 | 1 | Mehdi Abaakouk | ecryptfs_unlink_sigs |
81 | 1 | Mehdi Abaakouk | ecryptfs_fnek_sig=5ef7964dfddb60a0 |
82 | 1 | Mehdi Abaakouk | ecryptfs_key_bytes=16 |
83 | 1 | Mehdi Abaakouk | ecryptfs_cipher=aes |
84 | 1 | Mehdi Abaakouk | ecryptfs_sig=5ef7964dfddb60a0 |
85 | 1 | Mehdi Abaakouk | Mounted eCryptfs |
86 | 1 | Mehdi Abaakouk | |
87 | 1 | Mehdi Abaakouk | # cat mysecretdir/test |
88 | 1 | Mehdi Abaakouk | TEST |
89 | 1 | Mehdi Abaakouk | |
90 | 1 | Mehdi Abaakouk | </pre> |
91 | 2 | Mehdi Abaakouk | |
92 | 1 | Mehdi Abaakouk | h2. La méthode userland |
93 | 1 | Mehdi Abaakouk | |
94 | 1 | Mehdi Abaakouk | * Le répertoire crypté est forcément Private et .Private |
95 | 1 | Mehdi Abaakouk | * Ce mountage est automatiquement monté/démonté à l'ouverture/fermeture de session (optionnel) |
96 | 1 | Mehdi Abaakouk | * Utilise le mot de passe de login et le trousseau de clé de la session utilisateur |
97 | 1 | Mehdi Abaakouk | |
98 | 1 | Mehdi Abaakouk | h3. Configuration |
99 | 1 | Mehdi Abaakouk | |
100 | 1 | Mehdi Abaakouk | <pre> |
101 | 1 | Mehdi Abaakouk | # ecryptfs-setup-private [--noautomount] |
102 | 1 | Mehdi Abaakouk | Enter your login passphrase [sileht]: *<login password>* |
103 | 1 | Mehdi Abaakouk | Enter your mount passphrase [leave blank to generate one]: *<enter>* |
104 | 1 | Mehdi Abaakouk | |
105 | 1 | Mehdi Abaakouk | ************************************************************************ |
106 | 1 | Mehdi Abaakouk | YOU SHOULD RECORD YOUR MOUNT PASSPHRASE AND STORE IT IN A SAFE LOCATION. |
107 | 1 | Mehdi Abaakouk | ecryptfs-unwrap-passphrase ~/.ecryptfs/wrapped-passphrase |
108 | 1 | Mehdi Abaakouk | THIS WILL BE REQUIRED IF YOU NEED TO RECOVER YOUR DATA AT A LATER TIME. |
109 | 1 | Mehdi Abaakouk | ************************************************************************ |
110 | 1 | Mehdi Abaakouk | |
111 | 1 | Mehdi Abaakouk | |
112 | 1 | Mehdi Abaakouk | Done configuring. |
113 | 1 | Mehdi Abaakouk | |
114 | 1 | Mehdi Abaakouk | Testing mount/write/umount/read... |
115 | 1 | Mehdi Abaakouk | Inserted auth tok with sig [00c5d51878ceb7a2] into the user session keyring |
116 | 1 | Mehdi Abaakouk | Inserted auth tok with sig [adb24429adf745ac] into the user session keyring |
117 | 1 | Mehdi Abaakouk | Inserted auth tok with sig [00c5d51878ceb7a2] into the user session keyring |
118 | 1 | Mehdi Abaakouk | Inserted auth tok with sig [adb24429adf745ac] into the user session keyring |
119 | 1 | Mehdi Abaakouk | Testing succeeded. |
120 | 1 | Mehdi Abaakouk | |
121 | 1 | Mehdi Abaakouk | Logout, and log back in to begin using your encrypted directory. |
122 | 1 | Mehdi Abaakouk | </pre> |
123 | 1 | Mehdi Abaakouk | |
124 | 1 | Mehdi Abaakouk | Et c'est tout! |
125 | 1 | Mehdi Abaakouk | |
126 | 1 | Mehdi Abaakouk | |
127 | 1 | Mehdi Abaakouk | h3. Utilisation |
128 | 1 | Mehdi Abaakouk | |
129 | 1 | Mehdi Abaakouk | <pre> |
130 | 1 | Mehdi Abaakouk | # ecryptfs-mount-private |
131 | 1 | Mehdi Abaakouk | Enter your login passphrase: *<login password>* |
132 | 1 | Mehdi Abaakouk | Inserted auth tok with sig [00c5d51878ceb7a2] into the user session keyring |
133 | 1 | Mehdi Abaakouk | |
134 | 1 | Mehdi Abaakouk | # echo TEST > Private/test |
135 | 1 | Mehdi Abaakouk | |
136 | 1 | Mehdi Abaakouk | # ecryptfs-umount-private |
137 | 1 | Mehdi Abaakouk | # find .Private |
138 | 1 | Mehdi Abaakouk | .Private |
139 | 1 | Mehdi Abaakouk | .Private/ECRYPTFS_FNEK_ENCRYPTED.FWahgYEdfTR3f-RdHuZMGUBU4uG4WV898FA9hmsdE.MuvMqujcoOMMUII--- |
140 | 1 | Mehdi Abaakouk | |
141 | 1 | Mehdi Abaakouk | # ecryptfs-mount-private |
142 | 1 | Mehdi Abaakouk | Enter your login passphrase: *<login password>* |
143 | 1 | Mehdi Abaakouk | Inserted auth tok with sig [00c5d51878ceb7a2] into the user session keyring |
144 | 1 | Mehdi Abaakouk | |
145 | 1 | Mehdi Abaakouk | # cat Private/test |
146 | 1 | Mehdi Abaakouk | TEST |
147 | 1 | Mehdi Abaakouk | </pre> |