Tag Info

Hot answers tagged

14

Yes, you're looking for mkpasswd, which (at least on Debian) is part of the whois package. Don't ask why... anthony@Zia:~$ mkpasswd -m help Available methods: des standard 56 bit DES-based crypt(3) md5 MD5 sha-256 SHA-256 sha-512 SHA-512 Unfortunately, my version at least doesn't do bcrypt. If your C library does, it should (and the manpage gives ...


14

On any of the Red Hat distros such as Fedora, CentOS, or RHEL the command mkpasswd doesn't include the same set of switches as the version typically included with Debian/Ubuntu. NOTE: The command mkpasswd is actually part of the expect package, and should probably be avoided. You can find out what package it belongs to with either of these commands. $ yum ...


12

I don't think the OpenBSD installer supports directly creating and installing to an encrypted partition. There's little use in encrypting the system partition anyway¹. So I suggest installing the system normally, then creating an encrypted filesystem image and putting your sensitive data (/home, parts of /var, perhaps a few files in /etc) there. Boot into ...


12

I think your requirement is valid, but on the other hand it is also difficult, because you are mixing symmetric and asymmetric encryption. Please correct me if I'm wrong. Reasoning: The passphrase for your private key is to protect your private key and nothing else. This leads to the following situation: You want to use your private key to encrypt ...


10

A guide to do such a setup with BusyBox and Dropbear is shown in this blog post. early-ssh didn't work for me and is apparently not needed anymore. I have summarized what you need to do in the following. For more details, have a look at the post above: Install BusyBox and Dropbear on your server sudo apt-get install dropbear busybox Update your ...


10

Journaling is a technique that helps with recovery from problems that occur when multi-write operations are interrupted. Such interruptions can leave the file system in an inconsistent state between writes. Interruptions can happen with "normal" block devices and dm-crypt block devices alike. For a file system, a block device is a block device. Block device ...


10

I think early-ssh provides what you're searching for: Early-ssh is a simple initramfs hook, which installs Dropbear SSH server into your initramfs, and starts it at boottime, so you will be able to do a lot of things remotely over SSH, before your root partition gets mounted, for example: * unlocking LUKS encrypted crypto devices - even your root ...


10

Use encfs (available as a package on most distributions). To set up: mkdir ~/.encrypted ~/encrypted encfs ~/.encrypted ~/encrypted # enter a passphrase mv existing-directory ~/encrypted The initial call to encfs sets up an encrypted filesystem. After that point, every file that you write under ~/encrypted is not stored directly on the disk, it is ...


10

I use the following method, which works fairly well: 1) Store your passwords in separate gpg encrypted files. For example ~/.passwd/<accountname>.gpg 2) Create a python extension file with a name of your choosing (e.g., ~/.offlineimap.py), with the following contents: def mailpasswd(acct): acct = os.path.basename(acct) path = ...


9

If you have the command line utility from OpenSSL, it can produce a digest in binary form, and it can even translate to base64 (in a separate invocation). echo -n foo | openssl dgst -binary -sha1 | openssl base64


9

I would prefer to use the openssl utility as it seems to be fairly ubiquitous. Convert RSA public key and private key to PEM format: $ openssl rsa -in ~/.ssh/id_rsa -outform pem > id_rsa.pem $ openssl rsa -in ~/.ssh/id_rsa -pubout -outform pem > id_rsa.pub.pem Encrypting a file with your public key: $ openssl rsautl -encrypt -pubin -inkey ...


9

Mutt has pretty good PGP integration. The wiki shows what settings you need to add to your .muttrc; these settings may already be present in the system-wide configuration file (for example, on Debian, PGP/gpg works out of the box). Mutt supports mbox, mh and maildir mailboxes. If you search in a mailbox that happens to contain encrypted mail, you'll be ...


9

Full disk encryption is usually done using the dm-crypt Device Mapper target, with a nested LVM (Logical Volume Manager) inside. So to reset your password you'll have to Unlock/open the crypto container; this is done using cryptsetup Activate the logical volumes; vgchange is used for this. Usually you won't need to care about this. Just let the initrd ...


8

Journaling is orthogonal to encryption. You would run an encrypted device to protect your files private, and you would use a journaling FS to protect the integrity of the data. Given the advancements over the last decade in Linux-based journaling systems, there's really no reason not to use one, except for possibly special scenarios like embedded systems or ...


8

There is no I/O-overhead involved in dm-crypt - just CPU overhead ... ;) On a Athlon 64 2.6 GHz dual core system for example I can copy from one dm-crypt disk to another with ~ 40 MB/sec (2.6.26 Kernel, Seagate 1.5 TB SATA disks). For performance make sure that the for your architecture optimized aes module is loaded, e.g. $ lsmod | grep aes aes_x86_64 ...


8

I think the current version of GRUB2 does not have support for loading and decrypting LUKS partitions by itself (it contains some ciphers but I think they are used only for its password support). I cannot check the experimental development branch, but there are some hints in the GRUB page that some work is planned to implement what you want to do. However, ...


8

First of all the hassle with encrypted root and early userspace is typically already handled by your distribution (as far as i know Fedora, Debian, Ubuntu and OpenSUSE support encrypted root out of the box). That means you don't have to care for the setup itself. One reason for encrypting / is just to be sure you don't leak any information at all. Think ...


8

In most scenarios, one of the following three schemes works well. You only want to encrypt a few particularly confidential files. Use encfs: mkdir ~/.encrypted.d ~/encrypted encfs ~/.encrypted.d ~/encrypted editor ~/encrypted/confidential-file Pros: no overhead to access non-confidential files; you can have different hierarchies with different ...


8

That question is worried about private keys stored on the server unencrypted. It's a scenario like: workstation 1 ---> gateway -> final server ⋮ | workstation n ------/ and the OP is worried about private keys on "gateway", which is a shared machine with multiple users. It is not possible to steal the private key by compromising ...


7

Truecrypt ticks all of those boxes. You have the option of either encrypting the whole USB key, or just having an encrypted container (as a file) It can then be decrypted regardless of platform, and can be configured to automount.


7

Warning, wall of text incoming. It's as well formatted as I could make it. If we're going to answer this, we're going to answer the whole thing. I'm not doing another answer on this, so here goes: Let's pretend you know absolutely nothing, and I'm feeding you keystrokes. This tells you everything you need to know to do this WHOLE thing, with a little ...


7

/etc, /var, and /tmp come to mind. All can potentially have sensitive contents. All can be given separate volumes, but it's common for each of these to be on the same filesystem as the root directory. Maybe you've moved one or more off into their own volumes, but have you moved them all? /etc contains: hashed passwords; possibly multiple sorts, such as ...


7

Well, the trivial (perhaps cheating) way would be to run: mysql -NBe "select password('right')" This will produce a password using whatever password hashing scheme your version of mysql uses. [EDIT: added -NB, which gets rid of the column names and ascii table art.]


7

Your password isn't encrypted. It is hashed. A salted MD5 hash has been generated and written to /etc/shadow. You cannot retrieve original value. The original value X has been hashed in this format: $id$salt$encrypted - id == 1 stands for MD5 (see NOTES on manpage of crypt(3))


7

Create a user and set his login shell to your command. For example: sudo apt-get install sl sudo adduser foo sudo chsh -s $(which sl) foo ssh foo@localhost Also have a look at man sshd_config for some other ways to configure you ssh server. (Like adding a ForceCommand.)


7

It sounds like the hard disk itself is having problems. ("short read," etc.) If so, dmesg | tail will probably show some I/O errors. Another way to check this is to run badblocks -n on the problem partition. Or better, on the entire disk. Whatever you test, it needs to be unmounted. This will take hours on a large modern disk. If there's anything on the ...


6

:h 'cryptmethod' says that PkZip and Blowfish (new in Vim 7.3) are possible encryption methods. A look around FEAT_CRYPT in vim/src/misc2.c confirms it. The weak encryption method is documented in PKWARE's zip file format documentation, and the new strong encryption is documented on Bruce Schneier's Blowfish page.


6

You can setup your system to require a key instead of a password and change some scripts to search for this key on a USB stick. I found a detailed explanation for this process on Debian Lenny. There are some notes in the end that describe necessary changes for newer versions of Debian.


6

From: http://www.openbsd.org/papers/bcrypt-paper.pdf We have implemented bcrypt and deployed it as part of the OpenBSD operating system. Bcrypt has been the default password scheme since OpenBSD 2.1


6

You have to create your key first. ZFS supports two types of file based keys. Hex, and raw. For this you can use openssl to generate the key. openssl rand -out /media/stick/key 16 The 16 creates a 16-byte (i.e., 128-bit) key. For a 192-bit or 256-bit key use 24 or 32 respectively. Then create your dataset as you normally would, specifying the key. zfs ...



Only top voted, non community-wiki answers of a minimum length are eligible