Hot answers tagged

33

Yes, you're looking for mkpasswd, which (at least on Debian) is part of the whois package. Don't ask why... anthony@Zia:~$ mkpasswd -m help Available methods: des standard 56 bit DES-based crypt(3) md5 MD5 sha-256 SHA-256 sha-512 SHA-512 Unfortunately, my version at least doesn't do bcrypt. If your C library does, it should (and the manpage gives ...


31

On any of the Red Hat distros such as Fedora, CentOS, or RHEL the command mkpasswd doesn't include the same set of switches as the version typically included with Debian/Ubuntu. NOTE: The command mkpasswd is actually part of the expect package, and should probably be avoided. You can find out what package it belongs to with either of these commands. $ yum ...


20

I think your requirement is valid, but on the other hand it is also difficult, because you are mixing symmetric and asymmetric encryption. Please correct me if I'm wrong. Reasoning: The passphrase for your private key is to protect your private key and nothing else. This leads to the following situation: You want to use your private key to encrypt ...


18

A guide to do such a setup with BusyBox and Dropbear is shown in this blog post. early-ssh didn't work for me and is apparently not needed anymore. I have summarized what you need to do in the following. For more details, have a look at the post above: Install BusyBox and Dropbear on your server sudo apt-get install dropbear busybox Update your ...


17

I use the following method, which works fairly well: 1) Store your passwords in separate gpg encrypted files. For example ~/.passwd/<accountname>.gpg 2) Create a python extension file with a name of your choosing (e.g., ~/.offlineimap.py), with the following contents: def mailpasswd(acct): acct = os.path.basename(acct) path = ...


15

I think early-ssh provides what you're searching for: Early-ssh is a simple initramfs hook, which installs Dropbear SSH server into your initramfs, and starts it at boottime, so you will be able to do a lot of things remotely over SSH, before your root partition gets mounted, for example: * unlocking LUKS encrypted crypto devices - even your root ...


15

I would prefer to use the openssl utility as it seems to be fairly ubiquitous. Convert RSA public key and private key to PEM format: $ openssl rsa -in ~/.ssh/id_rsa -outform pem > id_rsa.pem $ openssl rsa -in ~/.ssh/id_rsa -pubout -outform pem > id_rsa.pub.pem Encrypting a file with your public key: $ openssl rsautl -encrypt -pubin -inkey ...


14

OpenBSD supports full-disk encryption only since OpenBSD 5.3. Earlier versions require a cleartext boot partition. I don't know when the installer was modified to support direct installation to an encrypted partition (with the bootloader still unencrypted of course, because something has to decrypt the next bit). There's little use in encrypting the system ...


14

In the openssl manual (openssl man page), search for RSA, and you'll see that the command for RSA encryption is rsautl. Then read the rsautl man page to see its syntax. echo 'Hi Alice! Please bring malacpörkölt for dinner!' | openssl rsautl -encrypt -pubin -inkey alice.pub >message.encrypted The default padding scheme is the original PKCS#1 v1.5 (still ...


13

Have a look at the cryptsetup readme for this in /usr/share/doc/cryptsetup/README.remote.gz (Ubuntu package cryptsetup). In there is a full guide to accomplish this. It is similar to dragly's answer, but I think this is a bit more elegant. (Dropbear formatted keys, passing the passphrase via a FIFO rather than a fragile shell script, etc.) unlocking ...


13

I think the current version of GRUB2 does not have support for loading and decrypting LUKS partitions by itself (it contains some ciphers but I think they are used only for its password support). I cannot check the experimental development branch, but there are some hints in the GRUB page that some work is planned to implement what you want to do. Update ...


12

For newer versions of ubuntu, for example, 14.04, I found a combination of @dragly and this blogposts' answers very helpful. To paraphrase: (On server) Install Dropbear sudo apt-get install dropbear (On server) Copy and assign permissions for root public/private key login sudo cp /etc/initramfs-tools/root/.ssh/id_rsa ~/. sudo chown user:user ...


12

First, if you just want good encryption, you should look at GnuPG. But if your experimenting and just want to learn how it works, you need to understand what RSA is. RSA isn't designed to encrypt any arbitrary string, it's an algorithm that encrypts an integer. Specifically, an integer from 0 to n-1 where n is the modulus value from the public key. When ...


12

Use encfs (available as a package on most distributions). To set up: mkdir ~/.encrypted ~/encrypted encfs ~/.encrypted ~/encrypted # enter a passphrase mv existing-directory ~/encrypted The initial call to encfs sets up an encrypted filesystem. After that point, every file that you write under ~/encrypted is not stored directly on the disk, it is ...


12

You can use the following command: openssl x509 -inform PEM -in cacert.pem -outform DER -out certificate.cer


11

Journaling is a technique that helps with recovery from problems that occur when multi-write operations are interrupted. Such interruptions can leave the file system in an inconsistent state between writes. Interruptions can happen with "normal" block devices and dm-crypt block devices alike. For a file system, a block device is a block device. Block device ...


11

Full disk encryption is usually done using the dm-crypt Device Mapper target, with a nested LVM (Logical Volume Manager) inside. So to reset your password you'll have to Unlock/open the crypto container; this is done using cryptsetup Activate the logical volumes; vgchange is used for this. Usually you won't need to care about this. Just let the initrd ...


10

Well, the trivial (perhaps cheating) way would be to run: mysql -NBe "select password('right')" This will produce a password using whatever password hashing scheme your version of mysql uses. [EDIT: added -NB, which gets rid of the column names and ascii table art.]


10

Run this command: $ /sbin/grub-crypt --sha-512 then enter the word you want hashed.


10

Indeed, the page describes setting up a partition, but it's similar for a swapfile: dd if=/dev/urandom of=swapfile.crypt bs=1M count=64 loop=$(losetup -f) losetup ${loop} swapfile.crypt cryptsetup open --type plain --key-file /dev/urandom ${loop} swapfile mkswap /dev/mapper/swapfile swapon /dev/mapper/swapfile The result: # swapon -s Filename ...


9

There is no I/O-overhead involved in dm-crypt - just CPU overhead ... ;) On a Athlon 64 2.6 GHz dual core system for example I can copy from one dm-crypt disk to another with ~ 40 MB/sec (2.6.26 Kernel, Seagate 1.5 TB SATA disks). For performance make sure that the for your architecture optimized aes module is loaded, e.g. $ lsmod | grep aes aes_x86_64 ...


9

First of all the hassle with encrypted root and early userspace is typically already handled by your distribution (as far as i know Fedora, Debian, Ubuntu and OpenSUSE support encrypted root out of the box). That means you don't have to care for the setup itself. One reason for encrypting / is just to be sure you don't leak any information at all. Think ...


9

In most scenarios, one of the following three schemes works well. You only want to encrypt a few particularly confidential files. Use encfs: mkdir ~/.encrypted.d ~/encrypted encfs ~/.encrypted.d ~/encrypted editor ~/encrypted/confidential-file Pros: no overhead to access non-confidential files; you can have different hierarchies with different ...


9

Mutt has pretty good PGP integration. The wiki shows what settings you need to add to your .muttrc; these settings may already be present in the system-wide configuration file (for example, on Debian, PGP/gpg works out of the box). Mutt supports mbox, mh and maildir mailboxes. If you search in a mailbox that happens to contain encrypted mail, you'll be ...


9

Backup Reformat Restore cryptsetup luksRemoveKey would only remove an encryption key if you had more than one. The encryption would still be there. The Fedora Installation_Guide Section C.5.3 explains how luksRemoveKey works. That it's "impossible" to remove the encryption while keeping the contents is just an educated guess. I base that on two things: ...


9

Lines in the known_hosts file are not encrypted, they are hashed. You can't decrypt them, because they're not encrypted. You can't “unhash” them, because that what a hash is all about — given the hash, it's impossible¹ to discover the original string. The only way to “unhash” is to guess the original string and verify your guess. If you have a list of host ...


9

In the comments, I suggested you create a cgroup, set memory.swappiness to zero (to minimize swapping) and run your application inside of that. If you did that, your application probably wouldn't swap unless you were running so incredibly low on physical memory that swapping pages for programs in that cgroup was the only way to make enough physical memory ...


8

Journaling is orthogonal to encryption. You would run an encrypted device to protect your files private, and you would use a journaling FS to protect the integrity of the data. Given the advancements over the last decade in Linux-based journaling systems, there's really no reason not to use one, except for possibly special scenarios like embedded systems or ...


8

/etc, /var, and /tmp come to mind. All can potentially have sensitive contents. All can be given separate volumes, but it's common for each of these to be on the same filesystem as the root directory. Maybe you've moved one or more off into their own volumes, but have you moved them all? /etc contains: hashed passwords; possibly multiple sorts, such as ...


8

After backing up (step 1) and unmounting (between 2 and 3), run fsck to ensure that the filesystem is healthy: e2fsck -f /dev/mapper/ExistingExt4 Other than that, the steps are OK. what should I choose for $SECTORS? Is this step even necessary? This step is necessary, otherwise the partition would still show up at the old side. This is confirmed ...



Only top voted, non community-wiki answers of a minimum length are eligible