Topic: [Resloved] Full Disk Encryption

about security.....


If I have a password on my account (Ubuntu 10.4) and a password on grub to prevent logon into recovery mode.

How would I stop someone from booting a live cd and commenting out the grub line hence booting as root and changing or removing the user password.

And before you say "if you have physical access your rooted"

On windows, TrueCrypt can encrypt the ENTIRE drive. Files, bootloader, password stores in registry, everything.

So even with Physical access the user is still protected from unauthorized use of the PC.


So... How would I either solve this problem or get the same solution on Linux?

Thanks for any advice
big_smile

Last edited by andrews (2010-07-13 14:33:48)

The following statement is false.
The above statement is true.
Now solve for X

Re: [Resloved] Full Disk Encryption

www.truecrypt.org states that Linux is supported so long as you have either 2.4 or 2.6 kernel.


I've never used the program or heard of it before now; I would search their website for tutorials on how to get it working on Linux.


I'm sorry I can't be of more help to you, but I hope you solve your problem soon.

Re: [Resloved] Full Disk Encryption

it's not that it supports Linux.
It's that the entire drive encryption is only available for windows.
Linux cannot do that, at least truecrypt cant

The following statement is false.
The above statement is true.
Now solve for X

Re: [Resloved] Full Disk Encryption

Ohhhh, I'm sorry I didn't understand that part at first.

BestCrypt apparently uses pre-boot authentication, doesn't that mean you would be as protected as if you were using whole drive encryption on Windows? The computer apparently can't even run the bootloader right? Or am I mistaken?

Also, try looking through these, which I haven't really done but you might find some help:

http://ubuntuforums.org/showthread.php?t=716161
http://ubuntuforums.org/showthread.php? … encryption


Also from the Ubuntu forum:
..."The easiest way to set up full-disk encryption  is to do it when first installing your system.

This can be done by using the Alternate CD instead of the Live CD and selecting 'Install with encrypted LVM' at the partitioning stage."

Now, the problem is that this advice is specifically for Ubuntu...


I recall some people talking about using a script to turn a minimal Ubuntu installation into #! 9.10; if you're using the alpha Statler then there's a problem.

Last edited by Schadt91 (2010-07-13 02:25:08)

Re: [Resloved] Full Disk Encryption

AHA!
you hit the nail on the foot.
that LVM sounds exactly like what im looking for

The following statement is false.
The above statement is true.
Now solve for X

Re: [Resloved] Full Disk Encryption

Do let us know what you find out, and if you try it let us know how it works out; I'm sure you're not the only one here with an interest in the subject.
smile

Re: [Resloved] Full Disk Encryption

If your concern is just whether someone can boot your computer without a password, have you considered a good old-fashioned BIOS password?

while ( ! ( succeed = try() ) );

Re: [Resloved] Full Disk Encryption

I have 100% no experience with LVM what so ever, but I have seen that statler has the option at install to use LVM's as well.

Second thing what is so safe that I don't use it: bios or boot password. (I'm so damn scared that I forget it tongue )
A friend of mine has it, and before you get the bootscreen of the bios itself (probably th elogo of your brand of pc) you have to insert a password, if you don't have that password you can't do anything with the pc, except for turning it back off.

Edit: Typing to slow and much, exactly what pvsage says tongue

Last edited by Andreas (2010-07-13 05:02:53)

Meh. Interested for a Dropbox alternative? Go to https://launchpad.net/tart

Re: [Resloved] Full Disk Encryption

pvsage wrote:

If your concern is just whether someone can boot your computer without a password, have you considered a good old-fashioned BIOS password?

His concern is someone being able to boot a Live CD and edit the GRUB line to boot in single-user mode. And since the  perpetrator has physical access, they could just as well clear a BIOS password (remove battery).

Note: ** Please read before posting **

BTW if you wish to contact me, send me an e-mail instead of a PM.

Re: [Resloved] Full Disk Encryption

anonymous wrote:
pvsage wrote:

If your concern is just whether someone can boot your computer without a password, have you considered a good old-fashioned BIOS password?

His concern is someone being able to boot a Live CD and edit the GRUB line to boot in single-user mode. And since the  perpetrator has physical access, they could just as well clear a BIOS password (remove battery).

true but once you have physical access, full access is just a matter of time what ever you do, a bios password is more protection than you are likely to see on most computers, and likely to set the bar high enough to deter most would be hackers, if they are willing to remove the battery, theyre willing to remove the harddrive for decryption later on.

- - - - - - - - Wiki Pages - - - - - - -
#! install guide           *autostart programs, modify the menu & keybindings
configuring Conky       *installing scripts

Re: [Resloved] Full Disk Encryption

You can run #! entirely from a CD or USB drive; in this scenario, nothing is stored on the computer's hard drive and there is nothing for a hacker to hack. Store your files over the network on a secure server, or on an encrypted USB stick that you can take with you, or lock up someplace safe, when you are not using the computer.

You can also of course encrypt your #! install as described above, I would think that's the best solution for the typical user (I'm not implying that you are, or aren't, a typical user of course).

Re: [Resloved] Full Disk Encryption

benj1 wrote:

true but once you have physical access, full access is just a matter of time what ever you do

The OP already knows that. Thats why he wants full disk-encryption like is possible with Truecrypt on Windows.

Note: ** Please read before posting **

BTW if you wish to contact me, send me an e-mail instead of a PM.

Re: [Resloved] Full Disk Encryption

The LVM encryption sounds like the solution. I googled this question several times before and got nothing.
I'm glad I could finally find a sollution.
Thanks everyone

The following statement is false.
The above statement is true.
Now solve for X

Re: [Resloved] Full Disk Encryption

I did remember that BIOS can (or at least could) be cleared by popping the battery; I wasn't sure if newer BIOS chips had some less volatile media.  When I learned about the pop-the-BIOS-battery-to-clear-the-password trick, Intel was still recovering from the floating point math glitch in the original Pentium, so some of my knowledge is dated.

Is BIOS still powered by a button cell?

while ( ! ( succeed = try() ) );

Re: [Resloved] Full Disk Encryption

Motherboards still come the battery. And I think some motherboard can clear the BIOS with a jumper so its even easier than removing the battery.

Note: ** Please read before posting **

BTW if you wish to contact me, send me an e-mail instead of a PM.

Re: [Resloved] Full Disk Encryption

All modern motherboard clear BIOS setting with jumpers.
This is to provide recovery if a BIOS firmware update goes bad or it is in some way corrupted.

The following statement is false.
The above statement is true.
Now solve for X

Re: [Resloved] Full Disk Encryption

Many laptops, eg IBM thinkpads, store the BIOS password in a dedicated chip, which has to be physically replaced to wipe the password.
Doesn't stop anyone taking the disk out and putting into another machine though, even if you could lock the drive somehow, they could still remove the platters and scan them - encryption is the only secure way.

I'm also very interested how you get on with LVM and encryption, andrews.

Re: [Resloved] Full Disk Encryption

@jackbang
You can hack the password on Thinkpads. There are three types of passwords on the Thinkpad. The power on password (POP) which is reseted by removing the backup battery. The HDD password. And the Supervisor password (SVP).
The supervisor password is stored in the dedicated security chip you are talking about.
If you have a Thinkpad that is not too new, you can read the security chip via a simple interface. I just did this yesterday with an older Thinkpad R40. Check this page:
http://sodoityourself.com/hacking-ibm-thinkpad-bios

Re: [Resloved] Full Disk Encryption

Interesting GuruX.  I guess that process was required of whoever nicked mine mad

20

Re: [Resloved] Full Disk Encryption

If you set up an encrypted LVM, you will have essentially the same method of encryption that TrueCrypt offers. TC also has some added extras like hidden operating systems and volumes, which are useful for situations in which plausible deniability is required (for example, if a kidnapper is forcing you to give them your password). There is a minimal performance hit when using an encrypted LVM, but I've never even noticed it on any reasonably-powered laptop.

In Ubuntu (post-Karmic, I think), there is also an option to encrypt a user's files transparently. So if you login as that user, you can access your files normally, but if not they are encrypted. This model has some advantages over full-disk or LVM encryption, but also some disadvantages. One advantage is that you can have one machine with multiple users and each can decrypt and view only their own files (by contrast, once an LVM is decrypted any user can view the entire disk). It can also be helpful if you mess up some part of your system and can't boot normally, since you can boot from a LiveCD and access the system files to repair them easily (by contrast, you'd need to decrypt and mount your LVM to fix a system crash, which is doable but not trivial). A disadvantage of user home directory encryption is that files outside of that directory are not encrypted, and information can easily "leak" out into other parts of the drive if you're not careful (although at least in Ubunu Lucid, I believe the swap partition is also encrypted by default).

I would never have a laptop without encryption nowadays. My data is worth much more to me than my hardware. Even if a thief were uninterested in my data, the time it would take me to change all of my access info and other sensitive data if it were stolen would be a major loss to me.

Personally I haven't decided which method I prefer (LVM or home directory encryption). I am the only user on my machines, and LVM "feels" safer to me because I know that everything on the drive will always be encrypted. But I've used home directory encryption on my last two Ubuntu installations on my main laptop, and twice now I've had to edit system files from a USB boot disk in order to fix some startup issue, and I was very glad I wasn't using LVM then (the second time I was waiting for a flight in an airport when I borked my system, and I never would've been able to recover it and work on the plane if I'd had LVM encryption).

A BIOS password is only useful if the thieves don't want to steal your data, since they could easily pull your hard drive if they do. I highly recommend getting an encrypted cloud backup system also. I sleep so much better since I backed up everything important to JungleDisk/Amazon S3.