Encrypted /tmp and swap with Fedora 7 [fedoraproject.org]
If you carry around business information on your laptop, it's a good idea to encrypt /tmp and the swap volume, and not only your home directory. You could already do this with a little scripting on Fedora Core 6. With Fedora 7, it got a little easier. First, create /etc/crypttab with the following content:
swap /dev/vg1/swap /dev/urandom swap,cipher=aes-cbc-essiv:sha256 tmp /dev/vg1/tmp /dev/urandom tmp,cipher=aes-cbc-essiv:sha256
In /etc/fstab you only list the swap volume:
/dev/mapper/swap none swap defaults 0 0
Because the encrypted volumes are created after /etc/fstab is processed, the following script has to take care of mounting /tmp:
#!/bin/bash
#
# cryptotmp setup crypted tmp partition
#
# chkconfig: 2345 01 90
# description: adds crypted tmp partition.
. /etc/init.d/functions
# See how we were called.
case "$1" in
start)
mount /dev/mapper/tmp /tmp
restorecon /tmp
action "Adding encrypted tmp"
touch /var/lock/subsys/cryptotmp
;;
stop)
rm -f /var/lock/subsys/cryptotmp
;;
*)
echo $"Usage: $0 {start|stop}"
exit 1
esac
exit 0
Save it as /etc/init.d/cryptotmp and run
chmod +x /etc/init.d/cryptotmp chkconfig --add cryptotmp
When the system boots, it overwrites the contents of /dev/vg1/swap and /dev/vg1/tmp, using a random key for encryption. Once the system shuts down, the content will no longer be accessible, as the encryption key is not stored anywhere.
Warning: The above configuration erases /dev/vg1/swap and /dev/vg1/tmp when the system boots. Files stored in /tmp are lost when the system is shut down. Also, suspend to disk does not work with an encrypted swap volume.
14:30, 12 Jun 2007 by Carsten Clasohm Permalink