Paranoia without borders or encrypt LVM from files

After reading today's topic from a BSD blog about data encryption, I had the idea to create LVM-volume from one file and encrypt it.

I will not pull the cat by the tail, but immediately show how I did.







In this case, files on one hard disk are encrypted in one partition (/ tmp), but no one forbids placing container files anywhere. Let's get started!

')

Create 5 files of 50 MB each, which will be containers:



/tmp # for i in `seq 1 5`; do dd if=/dev/zero of=safe.$i bs=1M count=50; done

50+0 records in

50+0 records out

52428800 bytes (52 MB) copied, 0.235608 s, 223 MB/s





Check:

/tmp # ls

-rw-r--r-- 1 root root 50M 2009-11-28 03:02 safe.1

-rw-r--r-- 1 root root 50M 2009-11-28 03:02 safe.2

-rw-r--r-- 1 root root 50M 2009-11-28 03:02 safe.3

-rw-r--r-- 1 root root 50M 2009-11-28 03:02 safe.4

-rw-r--r-- 1 root root 50M 2009-11-28 03:02 safe.5





Now turn our safes into devices using losetup :

/tmp # for i in `seq 1 5`; do losetup /dev/loop$i /tmp/safe.$i; done



Now we have 5 devices of 50 MB each in size to store large amounts of data, combining them into one Logical Volume.



If the pvcreate utility is not available, install it.

apt-get install lvm2 (for ubuntu)



/tmp # pvcreate /dev/loop{1,2,3,4,5}

Physical volume "/dev/loop1" successfully created

/tmp # vgcreate vg0 /dev/loop{1,2,3,4,5}

Volume group "vg0" successfully created

/tmp # vgscan

Reading all physical volumes. This may take a while...

Found volume group "vg0" using metadata type lvm2

/tmp # lvcreate --size 200M --name lvopt vg0

Logical volume "lvopt" created





Now we have a 200MB LV located in / dev / vg0 / lvopt

We encrypt it, for example, using twofish :

/tmp # cryptsetup -y create datasafe /dev/vg0/lvopt

Enter passphrase:

Verify passphrase:





That's all you can now check what happened. First, let's format a new device in ext4:

mkfs.ext4dev /dev/mapper/datasafe

mke2fs 1.41.9 (22-Aug-2009)



:

mount -t ext4 /dev/mapper/datasafe /mdia/safe/





Fill our safe with data to make sure it works. The data will be taken from / dev / zero

cat /dev/zero >> /media/safe/test

cat: write error: No space left on device





Now in LV there is a test file occupying all the available space, let's check:

df -h

Filesystem Size Used Avail Use% Mounted on

[....]

/dev/mapper/datasafe 194M 193M 0 100% /media/safe





Now unmount our LV:

umount /media/safe/

cryptsetup remove datasafe





And try to read the contents of the device now:



less -f /dev/vg0/lvopt



Make sure the device is encrypted!



Container files can be of different sizes and be located on any hard drives, which should make it difficult to detect them, as well as combining them into one device.