Full disk encryption with Loop-AES

[deviant085]

Hi all, I was trying to find some information on full disk encryption in openBSD, preferably using Loop-AES. But after a bit of googleing i haven't been able to find much..

Could anyone help me out here?

[ocicat]

Originally Posted by deviant085

...I was trying to find some information on full disk encryption in openBSD,

OpenBSD does not support full disk encryption if the system itself resides on the disk. To encrypt select non-root partitions, study the manpages for:

• vnconfig(8)
• svnd(4)

Section 14.10 of the FAQ will provide some additional information.

bioctl(8) & softraid(8) also do disk encryption, but heed the warning in bioctl(8)'s manpage stating that it is currently considered experimental.

...preferably using Loop-AES.

vnconfig(8) uses Blowfish.

Two very recent threads on encryption can be found in the archives to the official misc@ mailing list:

• http://marc.info/?t=125719773600001&r=1&w=2
• http://marc.info/?t=125694744800002&r=1&w=2

[deviant085]

That you for your quick reply, i will have a look over all of that.

[s2scott]

As a quick pointer ... the barrier to full-disk encryption issue is the root (/) partition. The available solution(s) will likely pivot on whether you can or cannot tolerate an un-encrypted root partition.

/S

[deviant085]

I think the way I am going to overcome this issue of not being able to encrypt root is to enable encrypted swap, create an encrypted partition where applications can run in a chrooted environment.

I still have a few things to work out, but I think it should be an acceptable substitution

[jggimi]

Swap has been encrypted by default since 3.8.

[s2scott]

Originally Posted by deviant085

I think the way I am going ... create an encrypted partition where applications can run in a chrooted environment.

I run AXIGEN (mobile edition w/blackberry push support) post office pretty much as your thinking. I adapted the following guide. http://geektechnique.org/projectlab/...pted-nas-howto (its companion guide: http://geektechnique.org/projectlab/...nas-on-openbsd.)

The guide is now a bit dated as newer o/s techniques are available in 4.5 and 4.6, but I found it useful in its day.

It has worked so well that it has been set and forget ever since.

/S

[deviant085]

Originally Posted by jggimi

Swap has been encrypted by default since 3.8.

Are you sure? Because i had to modify /etc/sysctl.conf to turn in on in 4.6.

#vm.swapencrypt.enable=0         # 0=Do not encrypt pages that go to swap
to
vm.swapencrypt.enable=1         # 0=Do not encrypt pages that go to swap

[Oko]

Originally Posted by deviant085

Are you sure? Because i had to modify /etc/sysctl.conf to turn in on in 4.6.

#vm.swapencrypt.enable=0         # 0=Do not encrypt pages that go to swap
to
vm.swapencrypt.enable=1         # 0=Do not encrypt pages that go to swap

Man you have to do some reading before asking. Default behavior of OpenBSD box is opposite of what is commented in systct.conf. Those lines are
left like that so that if you want to turn off swap encryption you can just remove # and reboot the computer.

[deviant085]

Oh ok, didn't know that... Thanks for that..