TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Create AES256 encrypted loop devices (.img files) under Linux

12 点作者 thefox超过 14 年前

8 条评论

thyrsus超过 14 年前
When would one use this?<p>When I install Fedora, it gives me the opportunity to encrypt any file system other than /boot. Since this requires you to enter the password at boot, that's good for a laptop, probably bad for a server.<p>You need root privilege to mount a loopback file system. Either (a) you've got the root password (b) the admin has given sufficient sudo privileges or (c) you use pam_mount to mount the encrypted filesystem (probably as your home directory). Am I missing other scenarios?<p>The trouble with the pam_mount scenario is that the key for the file system needs to be based on your login password. Either your account creation process involves telling the admin your password, or someone's built a collection of self service tools I'm unaware of. Changing your password also means building a new encrypted filesystem, which again involves giving the admin the new password, or invoking self service tools I'm unaware of.<p>If there are other scenarios in which to use this kind of encrypted file system, I'd appreciate hearing about them.
thyrsus超过 14 年前
The script initializes the image from /dev/zero, which means that an attacker can tell which blocks of the filesystem image are data and which are empty. Unless you really can't afford to wait the minute or so for it to finish, use /dev/urandom - or /dev/random, if you've got access to sufficient entropy (did you pay extra for a hardware random number generator?).
rlpb超过 14 年前
This uses cryptoloop, which SHOULD NOT BE USED IF YOU WANT STRONG SECURITY. See: <a href="http://mareichelt.de/pub/texts.cryptoloop.php" rel="nofollow">http://mareichelt.de/pub/texts.cryptoloop.php</a><p>You can do better with LUKS or Truecrypt. LUKS comes with most distributions. It comes with a handy wrapper called "cryptsetup" which does the setup for you.
beoba超过 14 年前
The link is for a perl script which is effectively a frontend for 'losetup', whose manpage describes how to create and mount images.
评论 #2058255 未加载
nonUser超过 14 年前
Why do we need a script for this task? Yet another newbie script on HN...
sp332超过 14 年前
I'd use AES128, it's more secure (well, so far anyway). There's a weakness in the AES256 algorithm that makes it weaker then AES128. Not weak enough that I would really be worried , but if you have the choice...
评论 #2058459 未加载
jerf超过 14 年前
A coworker of mine pointed me to EncFS, which I think is generally a better idea because you don't commit to sizing in advance: <a href="http://www.arg0.net/encfs" rel="nofollow">http://www.arg0.net/encfs</a><p>I have been satisfied with its performance used as the backing store for virtual machine images, though not having a dual-core may be problematic.
评论 #2058440 未加载
thefox超过 14 年前
Thx for your feedback.