0

Basically I didn't encrypt my Linux (Debian) partition when installing it.

However I found a way to encrypt at least home folder so in theory I could put everything there which I want to make sure it's not accessible should my computer be stolen etc.

However there are certain folders (/etc, /bin, /var, ..) which for sure can't be moved away to home folder to encrypt them as well. Given that with my user (!= "root") I have root access (but upon inputting the password for each su(do) ), I was thinking to limitate the access to sensitive file/folders by allowing only my main user (even without su(do)) to access them only after login in KDE and at the same time making sure no other part of system would be broken.

Is it possible? (perhaps which chmod etc)

Alos, I'm not sure what folders are supposed to contain app data and other sensitive information 'by default'?

  • 1
    You don't want to change permissions of anything in those other directories. You run the very real risk of making your system completely unusable. – John Jan 6 '16 at 15:48
  • I understand the risk. any other way to make them inaccessible to anyone which accesses computer without my password? Also, what about the sensitive data location? – dragonmnl Jan 6 '16 at 15:51
  • 3
    If this is a system that you really need to protect, perhaps it would just be better to reinstall with the settings you want. – Eric Renouf Jan 6 '16 at 15:56
3

Permissions only protect against other users of the system, who access the system through normal software means. They are totally useless against someone who has access to the hardware, only encryption can protect against that. Setting permissions is like writing “secret” on an envelope; it works if the operating system is the only entity that's manipulating the envelope, but not if the attacker has stolen the envelope.

Places where sensitive files are likely to end up include mainly:

  • the swap area;
  • /tmp (if it isn't in RAM);
  • /var/tmp (but few programs write there);
  • email and printer (and possibly other) spools under /var/spool;
  • possibly some information in /etc, such as Wifi passwords.

It's difficult to be sure to cover all the sensitive files; to be safe you'd need to encrypt all of /var. Furthermore there's no simple way (nor even a mildly advanced way) to put system files under ecryptfs: ecryptfs is fundamentally oriented towards encrypting a single user's files. While it isn't mathematically impossible, I wouldn't recommend attempting it unless you know what to do when it breaks (and it will break); it's one of these if-you-need-to-ask-then-don't-do-it things. I wouldn't do it, I'd encrypt the whole system instead.

You can encrypt the system after installation, but it isn't easy. The basic idea to boot from rescue media, shrink the existing partition to span less than the whole disk, move it to the end of the disk, create an encrypted container in the now free beginning of the disk, create an LVM volume on it, create a filesystem, move the files from the plaintext area, resize the plaintext volume to be small (~200 MB), move /boot to the plaintext volume, extend the encrypted container and the LVM volume to the whole disk, make some swap space again, enlarge filesystem, mount the plaintext volume under /boot, and reinstall Grub and regenerate the initramfs. (I hope I didn't forget anything…)

If you're concerned about sensitive files outside your home, reinstalling would probably be easier.

An easier compromise would be to make /home an encrypted volume, rather than encrypting your home as a directory tree. (This may also slightly improve performance.) The basic idea is:

  1. Boot from rescue media.
  2. Shrink the existing filesystem and containing partition (ext2resize, parted).
  3. Create a dmcrypt volume in the freed space (cryptsetup).
  4. Make two LVM volumes on the dmcrypt volume (pvcreate, vgcreate, lvcreate × 2), one for swap (mkswap) and one for /home (mkfs).
  5. Mount the volume for /home and move /home there.
  6. Update /etc/fstab and /etc/crypttab.
  7. Now you can move other sensitive directories (e.g. printer spool) to /home, and make a symbolic link to follow them.
  8. To protect the sensitive files that you just erased, wipe the free space on the plaintext volume.
  • thank you for your very detailed explanation. very much appreciated. I will think of it and eventually encrypt the home folder via ecryptfs or reinstalling everything. I'm in fact using Timeshift for disk backup. Do you know if once I reinstalled Debian with encryption enabled, I will be able to restore Timeshift (system-wide) backup (since it comes from a non-encrypted installation)? – dragonmnl Jan 7 '16 at 21:47
  • @dragonmnl Sorry, I don't know how Timeshift works. It probably operates on files, so it wouldn't know or care about the underlying encryption (just like any other application), but I'm only speculating. Beware that if you run a program as a cron job (scheduled task) while not logged it and you use ecryptfs, the program will see the underlying encrypted files; if you use dmcrypt, which operates at the disk level, the program will see the normal file contents. – Gilles Jan 7 '16 at 22:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.