Re: harddrive encryption

2011-01-19 Thread Roland Smith
On Tue, Jan 18, 2011 at 06:15:50PM +0100, Roland Smith wrote: > > What do you folks think of the relative merits of AES vs Blowfish for > > disk encryption? > > Neither have been broken with their complete number of rounds. Versions of > both can be broken with a reduced number of rounds. See > ht

Re: harddrive encryption

2011-01-18 Thread RW
On Tue, 18 Jan 2011 08:10:40 -0800 Chip Camden wrote: > It seems prudent to me to reduce the attack surface to that which > really needs to be defended -- "When you defend everything, you > defend nothing". Not to mention avoiding the overhead of encrypting > OS files. I don't think the plain t

Re: harddrive encryption

2011-01-18 Thread User Wojtek
no at installation if you use standard installer. as i don't use standard installer at all, i don't have such a problem. i use any bootable FreeBSD media (actualy my own made pendrive), and then make labels, do newfs, mount, unpack files etc. if you can't do that then you may follow my advice

Re: harddrive encryption

2011-01-18 Thread Bruce Cran
On Mon, 17 Jan 2011 21:30:39 +0100 Alokat wrote: > is it possible to encrypt my full harddrive (excluding /boot) during > a freebsd installation. Or do I have to do this after the > installation manually? The FreeBSD installer (sysinstall) doesn't support anything other than plain UFS but PCBSD'

Re: harddrive encryption

2011-01-18 Thread Roland Smith
On Tue, Jan 18, 2011 at 08:10:40AM -0800, Chip Camden wrote: > It seems prudent to me to reduce the attack surface to that which really > needs to be defended -- "When you defend everything, you defend nothing". > Not to mention avoiding the overhead of encrypting OS files. Indeed. > What do you

Re: harddrive encryption

2011-01-18 Thread Chip Camden
Quoth Roland Smith on Tuesday, 18 January 2011: > On Mon, Jan 17, 2011 at 10:05:53PM -0700, Modulok wrote: > > On 1/17/11, Roland Smith wrote: > > > On Mon, Jan 17, 2011 at 09:30:39PM +0100, Alokat wrote: > > >> Hi, > > >> > > >> is it possible to encrypt my full harddrive (excluding /boot) during

Re: harddrive encryption

2011-01-17 Thread Roland Smith
On Mon, Jan 17, 2011 at 10:05:53PM -0700, Modulok wrote: > On 1/17/11, Roland Smith wrote: > > On Mon, Jan 17, 2011 at 09:30:39PM +0100, Alokat wrote: > >> Hi, > >> > >> is it possible to encrypt my full harddrive (excluding /boot) during a > >> freebsd installation. Or do I have to do this after

Re: harddrive encryption

2011-01-17 Thread Modulok
On 1/17/11, Roland Smith wrote: > On Mon, Jan 17, 2011 at 09:30:39PM +0100, Alokat wrote: >> Hi, >> >> is it possible to encrypt my full harddrive (excluding /boot) during a >> freebsd installation. Or do I have to do this after the installation >> manually? > > Currently you have to do it manuall

Re: harddrive encryption

2011-01-17 Thread Jon Radel
On 1/17/11 5:53 PM, Roland Smith wrote: Do not rely on a keyfile that resides on a disk in the machine (that would make encryption futile)! Use a passphrase instead. I'd think that depends on your use case. If you're encrypting removable drives and then shipping them elsewhere, such as for off

Re: harddrive encryption

2011-01-17 Thread Chip Camden
Quoth Roland Smith on Tuesday, 18 January 2011: > > Since you are making a backup, why not just run geli(8), newfs(8) the new > encrpyted partition and restore the data? I don't think it is much slower, and > it is a _lot_ safer. > That makes a lot of sense. I don't know why I had such a mental

Re: harddrive encryption

2011-01-17 Thread Roland Smith
On Mon, Jan 17, 2011 at 02:38:38PM -0800, Chip Camden wrote: > Quoth Chuck Swiger on Monday, 17 January 2011: > > On Jan 17, 2011, at 12:30 PM, Alokat wrote: > > > is it possible to encrypt my full harddrive (excluding /boot) during a > > > freebsd installation. Or do I have to do this after the i

Re: harddrive encryption

2011-01-17 Thread Roland Smith
On Mon, Jan 17, 2011 at 09:30:39PM +0100, Alokat wrote: > Hi, > > is it possible to encrypt my full harddrive (excluding /boot) during a > freebsd installation. Or do I have to do this after the installation > manually? Currently you have to do it manually afterwards. Personally, I would not

Re: harddrive encryption

2011-01-17 Thread Chip Camden
Quoth Chuck Swiger on Monday, 17 January 2011: > On Jan 17, 2011, at 12:30 PM, Alokat wrote: > > is it possible to encrypt my full harddrive (excluding /boot) during a > > freebsd installation. Or do I have to do this after the installation > > manually? > > I don't believe the current installer

Re: harddrive encryption

2011-01-17 Thread Chuck Swiger
On Jan 17, 2011, at 12:30 PM, Alokat wrote: > is it possible to encrypt my full harddrive (excluding /boot) during a > freebsd installation. Or do I have to do this after the installation manually? I don't believe the current installer knows about HD encryption. Do it after the install by follo

harddrive encryption

2011-01-17 Thread Alokat
Hi, is it possible to encrypt my full harddrive (excluding /boot) during a freebsd installation. Or do I have to do this after the installation manually? cYa, alokat ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/lis