Linux Data Encryption

This article describes one of the options for encrypting data in Linux.



The article does not claim to truism and does not reveal anything new.

The idea is described and an example of its implementation is shown.

Actually, the main idea:

When equipment is removed (thieves) (the hard drive, or the computer as a whole), the ability to obtain any information should be completely absent. Ie, the attacker should not receive any information at all, any information carrier should be completely encrypted.

Options with bootable flash drives were immediately rejected for ideological reasons, since it is not always possible to quickly disable it.

As a result, the scheme was chosen with network boot.

Task:

Provide data encryption located on the Windows server.

Example of implementation:

1. We perform network booting (pxe + nfs)

2. Run sshd and wait for the encrypted partitions to be mounted.

3. Through ssh we mount cryptic partitions

4. We start the VirtualBox virtual machine with Windows onboard

Initial data:

Network: 192.168.1.0/24

The main gateway: 192.168.1.1

DNS: 192.168.1.1

Remote boot server: 192.168.1.13 (boot server)

Server with encrypted data: 192.168.1.14 (loadable server)



Everything described below will happen on a server with Debian Lenny preinstalled.



We set up and configure dhcp server for network boot.

')

netboot:~# apt-get install dhcp3-server

netboot:~# mcedit /etc/dhcp3/dhcpd.conf



option domain-name-servers 192.168.1.1;

default-lease-time 86400;

max-lease-time 604800;

authoritative;

subnet 192.168.1.0 netmask 255.255.255.0 {

range 192.168.1.20 192.168.1.60;

filename "pxelinux.0";

next-server 192.168.1.13;

option subnet-mask 255.255.255.0;

option broadcast-address 192.168.1.255;

option routers 192.168.1.1;

}



Next, install and configure the tftp server.



netboot:~# apt-get install tftpd-hpa

netboot:~# mcedit etc/default/tftpd-hpa



RUN_DAEMON="yes"

OPTIONS="-l -s /opt/vcrypt/boot"



For network booting we need the pxelinux.0 file from the syslinux package

Install the syslinux package. And customize pxe.



netboot:~# apt-get install syslinux

netboot:~# mkdir -p /opt/vcrypt/boot

netboot:~# cp /usr/lib/syslinux/pxelinux.0 /opt/vcrypt/boot/

netboot:~# mkdir /opt/vcrypt/boot/pxelinux.cfg

netboot:~# touch /opt/vcrypt/boot/pxelinux.cfg/default

netboot:~# mcedit /opt/vcrypt/boot/pxelinux.cfg/default



DEFAULT vcrypt

TIMEOUT 30

PROMPT 1

LABEL vcrypt

KERNEL vmlinuz

APPEND root=/dev/nfs nfsroot=192.168.1.13:/opt/vcrypt/ initrd=initrd.img ip=192.168.1.14::192.168.1.1:255.255.255.0:



The meaning of this config: by default we load the vcrypt section, which indicates which kernel and ram disk to use, and that we have the root partition on the remote nfs server.



With the tftp and pxe settings we finished, now we will install and configure the nfs server.



netboot:~# apt-get install nfs-kernel-server nfs-common portmap

netboot:~# mcedit /etc/exports



/opt/vcrypt 192.168.1.14(rw,no_root_squash,async,no_subtree_check)



We indicate which directory and for whom we open access.



netboot:~# invoke-rc.d nfs-kernel-server reload



Reboot the nfs server so that it processes the new config.



Now it remains to install the system, which we will remotely download. The easiest option is to use the debootstrap utility.



netboot:~# apt-get install debootstrap



The installation process is as simple as five cents, we specify the architecture, the distribution kit, where to install it and the mirror (where to get the packages from).

 netboot:~#debootstrap --arch i386 lenny /opt/vcrypt/ http://ftp.us.debian.org/debian 

When the debootstrap is completed, the system in the / opt / vcrypt / folder will be almost ready for work.



Chroot the newly installed system

netboot:~# LANG=C chroot /opt/vcrypt/ /bin/bash



Set up the time zone, network and resolv, set the hostname and update the apt cache



netboot:/# nano /etc/default/rcS



TMPTIME=0

SULOGIN=no

DELAYLOGIN=no

UTC=no

VERBOSE=no

FSCKFIX=no

RAMRUN=no

RAMLOCK=no



netboot:/# dpkg-reconfigure tzdata

netboot:/# nano /etc/network/interfaces



auto lo

iface lo inet loopback

auto eth0

iface eth0 inet static

address 192.168.1.14

netmask 255.255.255.0

gateway 192.168.1.1



netboot:/# nano /etc/resolv.conf



nameserver 192.168.1.1



netboot:/# echo cryptserv > /etc/hostname

netboot:/# apt-get update



Install and configure locales.

I chose only en_US.UTF8 and ru_RU.UTF8. For observance of full koshernost - default exhibited en_US.UTF8.



netboot:/# apt-get install locales

netboot:/# dpkg-reconfigure locales



Create a kernel installation configuration file and install the kernel



netboot:/# touch /etc/kernel-img.conf

netboot:/# nano /etc/kernel-img.conf



do_symlinks = yes

relative_links = yes

do_bootloader = no

do_bootfloppy = no

do_initrd = yes

link_in_boot = no



netboot:/# apt-get install linux-image-2.6.26-2-686



Configuring the initrd to boot over the network. I want to note that we perform all manipulations exclusively in the chroot system.



netboot:/boot# nano /etc/initramfs-tools/initramfs.conf



MODULES=netboot

BUSYBOX=y

KEYMAP=n

BOOT=nfs

DEVICE=eth0

NFSROOT=auto



We delete the old one and generate a new initrd, although it is possible to delete it in worker-peasant fashion:

rm /boot/initrd.img-`uname -r`

but since childhood I have disliked the rm command



netboot:/# update-initramfs -v -c -k `uname -r` -d

netboot:/# update-initramfs -v -c -k `uname -r`



Making symbolic links to the kernel and ramdisk



netboot:/# cd /boot

netboot:/boot# ln -s vmlinuz-2.6.26-2-686 vmlinuz

netboot:/boot# ln -s initrd.img-2.6.26-2-686 initrd.img



Install luks



netboot:/# apt-get install cryptsetup hashalot



Set root password and install ssh server



netboot:/# passwd

netboot:/# apt-get install openssh-server



After the above manipulation, the remote boot server is fully operational.



If the download is successful, then at 192.168.1.14 you will have a fully working server running sshd.



Login and encrypt encryption:



h1g@h1g-laptop:~$ ssh -l root 192.168.1.14



Fill the disk with random data to make it difficult to detect encrypted data.

You can also check for bad blocks, but this is up to you.



cryptserv:~# dd if=/dev/urandom of=/dev/sda



Create an encrypted partition (hard disk, media)



cryptserv:~# cryptsetup --verbose --verify-passphrase luksFormat /dev/sda



I hope you will use a pass phrase of at least 15 characters long, consisting of numbers and letters of different case.



Open the encrypted device and associate it with the virtual device / dev / mapper / vcrypt. Create a file system. Create a mount point



cryptserv:~# cryptsetup luksOpen /dev/sda vcrypt

cryptserv:~# mkfs.ext3 -j -m 1 -O dir_index,filetype,sparse_super /dev/mapper/vcrypt

cryptserv:~# mkdir /home/crypt

cryptserv:~# mount /dev/mapper/vcrypt /home/crypt/



Next, install VirtualBox. To my deep regret, not Sun, Oracle VirtualBox

 cryptserv:~# echo "deb http://download.virtualbox.org/virtualbox/debian lenny non-free" >> /etc/apt/sources.list 
    

      
      
      
    

   cryptserv:~# wget -q http://download.virtualbox.org/virtualbox/debian/oracle_vbox.asc -O- | apt-key add - 
    

      
      
      
    

   cryptserv:~# apt-get install virtualbox-3.2 

cryptserv:~# echo "deb http://download.virtualbox.org/virtualbox/debian lenny non-free" >> /etc/apt/sources.list

cryptserv:~# wget -q http://download.virtualbox.org/virtualbox/debian/oracle_vbox.asc -O- | apt-key add -

cryptserv:~# apt-get install virtualbox-3.2

 cryptserv:~# echo "deb http://download.virtualbox.org/virtualbox/debian lenny non-free" >> /etc/apt/sources.list 
    

      
      
      
    

   cryptserv:~# wget -q http://download.virtualbox.org/virtualbox/debian/oracle_vbox.asc -O- | apt-key add - 
    

      
      
      
    

   cryptserv:~# apt-get install virtualbox-3.2 

cryptserv:~# echo "deb http://download.virtualbox.org/virtualbox/debian lenny non-free" >> /etc/apt/sources.list

cryptserv:~# wget -q http://download.virtualbox.org/virtualbox/debian/oracle_vbox.asc -O- | apt-key add -

cryptserv:~# apt-get install virtualbox-3.2



Create a container for the virtual machine. Let it be called Bender1 with a template for Win2k3 server



cryptserv:~# VBoxManage createvm --name bender1 --ostype Windows2003 —register



We allocate 1 GB of RAM to the container, set access to the network via the network bridge, enable the virtual rdp server on port 3389



cryptserv:~# VBoxManage modifyvm bender1 --memory 1024 --floppy disabled --audio none --nic1 bridged --bridgeadapter1 eth0 --vram 12 --accelerate3d off --boot1 disk --acpi on --cableconnected1 on --usb off --vrdp on --vrdpport 3389 --vtxvpid on



Create an IDE controller for our virtual machine



cryptserv:~# VBoxManage storagectl bender1 --name "IDE Controller" --add ide



Create a virtual hard disk of 20 GB and connect it to the controller



cryptserv:~# VBoxManage createhd --filename /home/crypt/bender1.vdi --size 20480 --register

cryptserv:~# VBoxManage storageattach bender1 --storagectl "IDE Controller" --port 0 --device 0 --type hdd --medium /home/crypt/bender1.vdi



We connect the legal installation DVD image to the controller.



cryptserv:~# VBoxManage storageattach bender1 --storagectl "IDE Controller" --port 1 --device 0 --type dvddrive —medium /home/crypt/some_legal_windows_image.iso



We expose the download from the legal DVD image



cryptserv:~# VBoxManage modifyvm bender1 --boot1 dvd



Now everything is ready to launch "Bender"



cryptserv:~# VBoxManage startvm bender1 --type vrdp



Connect to rdp server and enjoy the installation of a legal win2k3. The process of installing and configuring the win2k3 server to describe does not see the point.



h1g@h1g-laptop:~$ rdesktop -k en-us 192.168.1.14:3389



After a successful installation, we send a “shutdown” signal to “Bender”



cryptserv:~# VBoxManage controlvm bender1 acpipowerbutton



Switch to boot disk



cryptserv:~# VBoxManage modifyvm bender1 --boot1 disk



Sample scripts to enable and disable the virtual machine.



cryptserv:~# cat start_vm.sh

1. #! / bin / bash
2. / sbin / cryptsetup luksOpen / dev / sda vcrypt && mount / dev / mapper / vcrypt / home / crypt && / usr / bin / VBoxManage startvm bender1 - type vrdp

cryptserv:~# cat shutdown_vm.sh

1. #! / bin / bash
2. / usr / bin / VBoxManage controlvm bender1 acpipowerbutton
3. while [`ps aux | grep " bender1 --startvm " | grep -v grep | wc -l` -ne 0 ]
4. do
5. echo "VM is poweroff. Wait plz"
6. sleep 1
7. done
8. umount / home / crypt && / sbin / cryptsetup luksClose / dev / mapper / vcrype

Again, I repeat, here is an example of a basic system setup. No configuration of the firewall, binding of the tftp server to the mac of the server being loaded, sssh server, encryption of the “bootable system”, etc. are described.

Every administrator decides for himself.

Nobody limits the flight of your paranoia of fantasy, but you need to remember that not all drugs are equally useful.