If you carry around business information on your laptop, it's a good idea to encrypt /tmp and the swap volume, and not only your home directory. You could already do this with a little scripting on Fedora Core 6. With Fedora 7, it got a little easier. First, create /etc/crypttab with the following content:

swap    /dev/vg1/swap   /dev/urandom    swap,cipher=aes-cbc-essiv:sha256
tmp     /dev/vg1/tmp    /dev/urandom    tmp,cipher=aes-cbc-essiv:sha256

In /etc/fstab you only list the swap volume:

/dev/mapper/swap        none            swap    defaults        0 0

Because the encrypted volumes are created after /etc/fstab is processed, the following script has to take care of mounting /tmp:

#!/bin/bash
#
# cryptotmp setup crypted tmp partition
#
# chkconfig: 2345 01 90
# description: adds crypted tmp partition.

. /etc/init.d/functions

# See how we were called.
case "$1" in
    start)
        mount /dev/mapper/tmp /tmp
        restorecon /tmp

        action "Adding encrypted tmp"

        touch /var/lock/subsys/cryptotmp
        ;;
    stop)
        rm -f /var/lock/subsys/cryptotmp
        ;;
    *)
        echo $"Usage: $0 {start|stop}"
        exit 1
esac

exit 0

Save it as /etc/init.d/cryptotmp and run

chmod +x /etc/init.d/cryptotmp
chkconfig --add cryptotmp

When the system boots, it overwrites the contents of /dev/vg1/swap and /dev/vg1/tmp, using a random key for encryption. Once the system shuts down, the content will no longer be accessible, as the encryption key is not stored anywhere.

Warning: The above configuration erases /dev/vg1/swap and /dev/vg1/tmp when the system boots. Files stored in /tmp are lost when the system is shut down. Also, suspend to disk does not work with an encrypted swap volume.

14:30, 12 Jun 2007 by Carsten Clasohm Permalink

Comments

Script adding?

Hi, I'm trying to get work encrypted swap and /tmp.
Yes, without scripting "encrypted tmp" does not work.
But if swap encryption works without scripting why do we have to add a script?

by Anonymous Visitor, 06 Oct 2007

tmp crypt not necessary

You can mount /tmp as tmpfs and it will use RAM and swap. Since you just encrypted swap, there is no need to re-encrypt /tmp.

Just put the following in fstab:
'tmpfs  /dev/shm  tmpfs  size=512M,noexec,nosuid  0 0'

That will cap /tmp usage to 512M. It grows/shrinks dynamically.
--
http://tofu.org/drupal

by Anonymous Visitor, 04 Aug 2008

Add a Comment

Comments are reviewed before they appear on this page.

Title:

Comment:

Text above is