Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Is there a preferred method to set up full-disk encryption under OpenBSD, similar to dm-crypt under Linux?

I'm looking for full-disk encryption, as if someone were to steal my notebook they could potentially access the data stored on it. Another reason is that I'm not always next to my notebook, so someone could potentially compromise the integrity of my netbook. These are the two major issues which make me believe that full-disk encryption is important for me.

share|improve this question
    
You had two completely unrelated questions. Since I answered one and no one has answered the other yet, I removed the part about Chrome from your question. Feel free to post a new question about running Chrome on OpenBSD. –  Gilles Mar 19 '11 at 23:50
    
    
From OpenBSD 5.3, full disc encryption is available! > softraid(4) RAID1 and crypto volumes are now bootable on i386 and > amd64 (full disk encryption). So besides the bootloader, EVERYTHING is encrpyted. :) –  evachristine Mar 5 at 8:01

3 Answers 3

up vote 12 down vote accepted

I don't think the OpenBSD installer supports directly creating and installing to an encrypted partition. There's little use in encrypting the system partition anyway¹. So I suggest installing the system normally, then creating an encrypted filesystem image and putting your sensitive data (/home, parts of /var, perhaps a few files in /etc) there.

Boot into your OpenBSD installation and create a file that will contain the encrypted filesystem image. Make sure to choose a reasonable size since it'll be hard to change later (you can create an additional image, but you'll have to enter the passphrase separately for each image). The vnconfig man page has examples (though they're missing a few steps). In a nutshell:

dd if=/dev/urandom of=/ENCRYPTED.img bs=1m count=4096
vnconfig -k svnd0 /ENCRYPTED.img  # type your passphrase
{ echo a a; echo w; echo q; } | disklabel -E /svnd0  # create a single slice
newfs /dev/svnd0a
mount /dev/svnd0a /mnt
mv /home/* /mnt
umount /mnt
umount /dev/svnd0c

Add corresponding entries to /etc/fstab:

 /ENCRYPTED.img  /dev/svnd0c  vnd rw,noauto,-k
 /dev/svnd0a     /home        ffs rw,noauto

Add commands to mount the encrypted volume and the filesystem in it at boot time to /etc/rc.local:

echo "Mounting encrypted volumes:"
mount /dev/svnd0c
fsck -p /dev/svnd0a
mount /home

Check that everything is working correctly by running these commands (mount /dev/svnd0c && mount /home).

Note that rc.local is executed late in the boot process, so you can't put files used by the standard services such as ssh or sendmail on the encrypted volume. If you want to do that, put these commands in /etc/rc instead, just after mount -a. Then move the parts of your filesystem you consider to be sensitive and move them to the /home volume.

mkdir /home/etc /home/var
mv /etc/ssh /home/etc
ln -s ../home/etc/ssh /home/etc
mv /var/mail /var/spool /home/var
ln -s ../home/var/mail ../home/var/spool /var

You should encrypt your swap as well, but OpenBSD does that automatically nowadays.

Another way to get an encrypted filesystem is through the software raid driver softraid. See the softraid and bioctl man pages or Lykle de Vries's OpenBSD encrypted NAS HOWTO for more information. Booting from a softraid volume is not supported.

¹ As far as I can tell, OpenBSD's volume encryption is protected for confidentiality (with Blowfish), not for integrity. Protecting the OS's integrity is important, but there's no need for confidentiality. There are ways to protect the OS's integrity as well, but they are beyond the scope of this answer.

share|improve this answer
    
Can you clarify the statement "Protecting the OS's integrity is important, but there's no need for confidentiality"? Do you mean that OpenBSD's volume encryption is just marketing gimmick or not-that-important-thing? –  user2362 Mar 23 '11 at 23:40
    
More about integrity: unix.stackexchange.com/questions/9998/… –  user2362 Mar 23 '11 at 23:52
3  
@hhh: OpenBSD's encryption provides confidentiality. That's important for your own data, not important for the OS files that anyone can download. (i.e. volume encrpytion is important but not the full story.) Integrity is defense against someone covertly changing your data, or worse, installing malware if they have physical access to your disk — an evil maid attack. Evil maid attacks are hard to defend against (I don't know what OpenBSD has to offer), but also hard to carry out. –  Gilles Mar 24 '11 at 0:07

Softraid with the CRYPTO discipline was intended by the OBSD designers to support full-disk encryption. There was another method as well with SVND that is now deprecated.

share|improve this answer

http://geekyschmidt.com/2011/01/19/configuring-openbsd-softraid-fo-encryption is basically a graphical how-to of softraid full disc encryption. Of course never blindly follow guides and make sure all the bioctl settings are correct.

share|improve this answer

We're looking for long answers that provide some explanation and context. Don't just give a one-line answer; explain why your answer is right, ideally with citations. Answers that don't include explanations may be removed.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.