Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 10 down vote favorite
2

I have got a bit lost and am not sure which technology to choose for full disk encryption. It is hard to tell if the information out there is still up to date. Is there a current best practice solution for this?

share|improve this question

5 Answers

up vote 8 down vote accepted

There are basicly 2 'standard' tools for partions:

  • TrueCrypt - cross-platform, open, plausible deniability
  • dm-crypt - Linux-specific, uses Linux Crypto API, can take advantages of any crypto hardware acceleration Linux supports, and device-mapper.

There's also cryptoloop, dm-crypt's predecessor

share|improve this answer
Removed "can't use hardware AES" for TrueCrypt. No longer true as of v7, released recently: truecrypt.org/docs/?s=version-history – Warren Young Aug 20 '10 at 3:47
4  
But as far as I know TrueCrypt can only encrypt windows drives if I want to boot my OS from it. So that would make dm-crypt the only solution. – Mobbit Aug 20 '10 at 5:03
up vote 3 down vote

There are a number of options.

Distributions like OpenSUSE/SLES offer the option to encrypt one or more partitions at installation time.

Most of the time this is not an option as chances are, you do not want to reinstall your operating system.

I use the "encfs" file system, this should work on both Linux, MacOS and FreeBSD as encfs is built on top of FUSE (http://fuse.sourceforge.net/):

http://www.arg0.net/encfs

The idea is that you can designate certain directories as encrypted directories, and those would require you to enter a password at mount time to access them.

share|improve this answer
up vote 3 down vote

I've been using Debian with encrypted file system and swap on my notebook for three years without problems.

It asks for the password early during the Linux boot and then continues to boot right into my desktop (I disabled the login dialog).

The setup is roughly sda5 -> sda5_crypt -> physical volume dm-0 -> volume group Linux -> logical volumes /dev/Linux/root for / and /dev/Linux/swap for swap.

Swap is encrypted to avoid leaking information.

There is also an unencrypted 200MB boot partition for kernel, grub etc.

I remember that it was a complicated dance in the Debian installer until I got this right.

share|improve this answer
1  
Modern Debian-Installers handle this without any complicated work. It all just works. – derobert Aug 20 '10 at 18:25
up vote 2 down vote

I've used True Crypt before and find it to work very well.

share|improve this answer
2  
It's true that TrueCrypt supports full-disk encryption with Linux, but it can only do that on the boot disk with Windows. I suspect the original poster is wanting to encrypt their boot disk, rather than a secondary disk that can be mounted after the system boots far enough that you can get a password to TrueCrypt. – Warren Young Aug 20 '10 at 3:44
up vote 0 down vote

You might want to try ReiserFS or Reiser4. It is really secure and supports encryption; it's the only open-source filesystem the US army uses, and if something is good enough for the US army, it could be enough good for you .-)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.