linux.gentoo.user

--=-C6sk79oHr37tTtTbbMT3
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable


On Sun, 2008-03-30 at 09:50 +0200, Dirk Heinrichs wrote:
> Am Samstag, 29. M=C3=A4rz 2008 schrieb Florian Philipp:
>=20
> > My goal is to open a Luks-mapping for /var with a gpg-encrypted file
> > on /boot and then open a mapping for /var/tmp with a plaintext file
> > on /var.
>=20
> See below. But while we're at it, can anybody tell me what's the advantag=
e of=20
> a gpg-encrypted keyfile over a keyfile generated from /dev/urandom?

Keys for urandom work great for /tmp and swap but how should I use this
for a partition which is supposed to keep its content between reboots?

>=20
> > I thought it would work with the following settings:
> >
> > /etc/conf.d/cryptfs
>=20
> It's /etc/conf.d/dmcrypt nowadays.

Interesting, why is there no hint that cryptfs is deprecated/obsolete?

>=20
> > target=3Dvar
> > source=3D'/dev/mapper/vg-crypt_var'
> > key=3D'/boot/key.gpg:gpg'
> >
> > target=3Dvar_tmp
> > source=3D'/dev/mapper/vg-crypt_var_tmp'
> > key=3D'/var/lib/tmp_key'
> >
> >
> > I've read the warning in /etc/conf.d/cryptfs about /usr on a separate
> > partition and followed their advice.
>=20
> Which warning, btw.? Works just fine here.
>=20

"# Note when using gpg keys and /usr on a separate partition, you will
# have to copy /usr/bin/gpg to /bin/gpg so that it will work properly
# and ensure that gpg has been compiled statically.
# See http://bugs.gentoo.org/90482 for more information."


> > However, the setup doesn't work. I'm not asked for the passphrase, the
> > mappings are not created. What did I forget?
>=20
> That the mappings are created all in one go before anything is mounted, s=
o you=20
> can't put the keyfile for /var into /boot. The only thing that would work=
is=20
> to put the keyfile on the root fs, because that's the only one that is=20
> mounted when the mappings are created, like:
>=20
> target=3D'c-usr'
> source=3D'/dev/evms/usr'
> key=3D'/etc/crypt/keyfile'
>=20
> Bye...
>=20
> Dirk

Thanks, I'll try it.

--=-C6sk79oHr37tTtTbbMT3
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.7 (GNU/Linux)

iD8DBQBH73hyqs4uOUlOuU8RAmz8AJ9qAYVqJEdBVCJI7DHaGB+xM1MULQCfYPMM
dr21UXeRbQ0OZ/SDPpLTko8=
=G4ol
-----END PGP SIGNATURE-----

--=-C6sk79oHr37tTtTbbMT3--

--
gentoo-user@lists.gentoo.org mailing list