LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Security Week: December 22nd, 2014
Linux Advisory Watch: December 19th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Setting up the loop device

5. Setting up the loop device

Cryptoloop can be used either on a file or an entire file system. The following describes how to set it up on a particular partition. This partition can be any partition you like; the following example uses /dev/sda1. I have chosen to use AES as a cipher, but you can substitute any cipher you like that has been enabled in the kernel. You can get a list of the algorithms supported by your currently running kernel by looking into /proc/crypto. An excellent resource, discussing the different cryptographic algorithms, are Bruce Schneier's books, Applied Cryptography and Practical Cryptography. Both AES and Serpent are probably a reasonable choice. AES has been cryptanalyzed a lot and no serious weaknesses have been discovered so far. Serpent has not been analyzed as much, but is considered to be even a little bit stronger than AES. However, Serpent is also slower than AES. Stay away from DES, it is both slow and weak. Triple-DES may be an option, but AES is probably more secure and faster, so there is really no reason to use Triple-DES anymore.

  1. It is recommended that you format your partition and fill it with random data before you create the encrypted file system on it. This will make it harder for an attacker to detect patterns in your encrypted partition.

    WARNING!

    Be careful what you type here for your partition. If you do make a mistake, you can easily overwrite the wrong partition with random garbage!

    Filling a partition with random data can be done as follows:

    dd if=/dev/urandom of=/dev/sda1 bs=1M
    

    You may get an error message that the device is full. You can ignore it.

  2. Select a cipher and key size. A list of ciphers supported by your kernel can be obtained from /proc/crypto. I recommend that you use AES with a 256-bit key.

  3. Set up the loop device. This is done using the losetup command from the util-linux package. The following command creates an encrypted filesystem using the loop device 0 using the AES cipher with a 256-bit key on the device /dev/sda1:

    losetup -e aes-256 /dev/loop0 /dev/sda1
    

    The command prompts for a password. Select a strong password and try to remember it without having to stick a Post-It note to your monitor. There is one big downside to using Cryptoloop. Since the password is hashed to create the encryption key, it is not easy to change the password later on. The most straight-forward way of changing the password is to create a new encrypted partition or file and move all data into it. For this reason, make sure you select a strong password from the start. AES may be a strong algorithm, but if you chose a weak password, that security goes down the drain.

    If losetup fails with an INVALID ARGUMENT error message, there is a problem with your util-linux package. Make sure you have followed the instructions above on how to install a patched version of util-linux. Older and unpatched version use a different way of passing the key size, and do not work with the 2.6 Crypto API.

  4. Create a file system. You can chose whatever file system you like. The following creates an ext3 file system using the loop device:

    mkfs.ext3 /dev/loop0
    
  5. Mount the encrypted file system. First you need to create a mount point, such as /mnt/crypto:

    mkdir /mnt/crypto

    Then you need to mount the file system. At this stage you need to tell mount explicitly which loop device to use:

    mount -t ext3 /dev/loop0 /mnt/crypto
    
  6. You can now play with your encrypted file system until you are bored.

  7. Unmount the file system. After you are done playing, unmount the filesystem:

    umount /mnt/crypto
  8. Detach the loop device. The loop device is still attached to your partition. Detach it with:

    losetup -d /dev/loop0
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Weekend Edition
Report: U.S. planning “proportional response” to Sony hack, blamed on North Korea
Heartbleed, Shellshock, Tor and more: The 13 biggest security stories of 2014
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.