Re: Encrypted slice with geli
On Wed, 22 Apr 2009 02:42:11 +0200, Bernt Hansson wrote: >Bill Moran said the following on 2009-04-21 14:41: >>In response to Bernt Hansson : >>>Giorgos Keramidas said the following on 2009-04-20 23:59: On Mon, 20 Apr 2009 21:38:54 +0200, Bernt Hansson wrote: > Hello list! > > I was thinking of makeing a slice encrypted with geli. > > My question is: does geli init -s 4096 /dev/ad* erase the data on the > slice. The handbook didn't say yes or no, and I don't want to try > without asking. No, >>> >>> No, what? does it erase the data or not. >> >> It depends on exactly what part of the process you're talking about > > My question is: does geli init -s 4096 /dev/ad* erase the data on the > slice. No, but it *does* write in parts of the slice. In particular, it writes geli metadata to the last sector of the device. If this sector happens to be "in use" by the existing data on the device, you will lose the data of this particular sector. The rest of the actual data stored on the rest underlying device is not affected by the "geli init" command. >> and it depends on exactly what you mean by "erase". > > Destroy it so it's no longer aviable. No, the actual data will *still* be on the raw device after you run the initial "geli init" command. Even _after_ you newfs the new encrypted device, block allocation algorithms for the filesystem may selectively write in some parts of the unencrypted device but skip others. This means that until you explicitly fill the encrypted device to its full capacity, it may _still_ be possible to peek under geli and see some of the previously stored data. This is precisely why the geli manpage suggests that you overwrite the full encrypted device with data from `/dev/random'. >> If your question is, "I'm switching a partition to using geli, do I >> need to back up my data before doing so?" the answer is YES! > > I do NOT want to backup the data unencrypted. > >>> But I want to keep the info on the slice. >> >> Then you need to copy it elsewhere, then copy it back after the slice >> is encrypted. > > Dont have the space for that. If you find the space for a full backup, then you can backup the data in *encrypted* form too, i.e. by saving two geli keys in a removable device (a USB flash disk maybe) and then going through two geli devices: 0. save two geli keys on a removable device, i.e. key-a and key-b 1. geli init the backup device with key-a and geli attach it 2. overwrite the backup device with /dev/random data 3. newfs and mount the backup device 4. dump everything from the original unencrypted device to the newly encrypted backup device 5. geli init the original device with key-b and attach it 6. overwrite the new encrypted device with /dev/random data 7. newfs and mount the newly encrypted device 8. restore from the encrypted backup device to the new encrypted device 9. verify that everything works in the newly encrypted device 10. detach the encrypted backup device and overwrite it with /dev/random data once more All you need is a backup device that is large enough to hold a full backup of your data and a moderately safe place to store the encryption keys while you are doing the whole backup and restore dance. ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Re: Encrypted slice with geli
On Wed, Apr 22, 2009 at 02:42:11AM +0200, Bernt Hansson wrote: > Bill Moran said the following on 2009-04-21 14:41: > > In response to Bernt Hansson : > > > >> Giorgos Keramidas said the following on 2009-04-20 23:59: > >>> On Mon, 20 Apr 2009 21:38:54 +0200, Bernt Hansson > >>> wrote: > Hello list! > > I was thinking of makeing a slice encrypted with geli. > > My question is: does geli init -s 4096 /dev/ad* erase the data on the > slice. The handbook didn't say yes or no, and I don't want to try > without asking. > >>> No, > >> No, what? does it erase the data or not. > > > > It depends on exactly what part of the process you're talking about > > > My question is: does geli init -s 4096 /dev/ad* erase the data on the > slice It only uses the last sector to store the metadata. See geli(8). > > and it depends on exactly what you mean by "erase". > > Destroy it so it's no longer aviable. > > > Geli doesn't explicitly destroy your data at any point in the process. > > However, most HOWTOs I've ready will tell you at some step or another > > to overwrite the partition using dd and /dev/zero, which _does_ > > destroy the data. > > Yes. That much I do know. > > > Also, even if you skip the dd step, geli will alter the partition in > > such a way that typical tools will not see the data. However, if you > > know your stuff, you can bypass normal tools and still read (part of?) > > the data. > > Not good. Hence the advice to overwrite the partition with zeros beforehand. > > If your question is, "I'm switching a partition to using geli, do I > > need to back up my data before doing so?" the answer is YES! > > I do NOT want to backup the data unencrypted. Then get an encrypted backup. E.g. a disk with a USB connection that you can encrypt and use it as back-up. If you want to convert a filesystem in-place, I don't think that's possible with the current tools. But it might be possible to create a tool to do that. That tool should do the following: initialize and attach the geli provider. (daXs1a is the unencrypted partition) (N is the number of sectors on that partition) for k=1 to N-1 do read sector k from device daXs1a write sector k to device daXs1a.eli done Note that this is kinda fragile. One botched sector and there will be trouble. It is also not optimized, because it will also encrypt sectors that aren't in use in the original filesystem. Roland -- R.F.Smith http://www.xs4all.nl/~rsmith/ [plain text _non-HTML_ PGP/GnuPG encrypted/signed email much appreciated] pgp: 1A2B 477F 9970 BA3C 2914 B7CE 1277 EFB0 C321 A725 (KeyID: C321A725) pgpShRNZObJyF.pgp Description: PGP signature
Re: Encrypted slice with geli
Bill Moran said the following on 2009-04-21 14:41: In response to Bernt Hansson : Giorgos Keramidas said the following on 2009-04-20 23:59: On Mon, 20 Apr 2009 21:38:54 +0200, Bernt Hansson wrote: Hello list! I was thinking of makeing a slice encrypted with geli. My question is: does geli init -s 4096 /dev/ad* erase the data on the slice. The handbook didn't say yes or no, and I don't want to try without asking. No, No, what? does it erase the data or not. It depends on exactly what part of the process you're talking about My question is: does geli init -s 4096 /dev/ad* erase the data on the slice and it depends on exactly what you mean by "erase". Destroy it so it's no longer aviable. Geli doesn't explicitly destroy your data at any point in the process. However, most HOWTOs I've ready will tell you at some step or another to overwrite the partition using dd and /dev/zero, which _does_ destroy the data. Yes. That much I do know. Also, even if you skip the dd step, geli will alter the partition in such a way that typical tools will not see the data. However, if you know your stuff, you can bypass normal tools and still read (part of?) the data. Not good. If your question is, "I'm switching a partition to using geli, do I need to back up my data before doing so?" the answer is YES! I do NOT want to backup the data unencrypted. But I want to keep the info on the slice. Then you need to copy it elsewhere, then copy it back after the slice is encrypted. Dont have the space for that. ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Re: Encrypted slice with geli
In response to Bernt Hansson : > Giorgos Keramidas said the following on 2009-04-20 23:59: > > On Mon, 20 Apr 2009 21:38:54 +0200, Bernt Hansson > > wrote: > >> Hello list! > >> > >> I was thinking of makeing a slice encrypted with geli. > >> > >> My question is: does geli init -s 4096 /dev/ad* erase the data on the > >> slice. The handbook didn't say yes or no, and I don't want to try > >> without asking. > > > > No, > > No, what? does it erase the data or not. It depends on exactly what part of the process you're talking about, and it depends on exactly what you mean by "erase". Geli doesn't explicitly destroy your data at any point in the process. However, most HOWTOs I've ready will tell you at some step or another to overwrite the partition using dd and /dev/zero, which _does_ destroy the data. Also, even if you skip the dd step, geli will alter the partition in such a way that typical tools will not see the data. However, if you know your stuff, you can bypass normal tools and still read (part of?) the data. So, if your question is "I want to securely destroy the data on a partition, can geli do that?" the answer is No. If your question is, "I'm switching a partition to using geli, do I need to back up my data before doing so?" the answer is YES! > But I want to keep the info on the slice. Then you need to copy it elsewhere, then copy it back after the slice is encrypted. -- Bill Moran http://www.potentialtech.com http://people.collaborativefusion.com/~wmoran/ ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Re: Encrypted slice with geli
Giorgos Keramidas said the following on 2009-04-20 23:59: On Mon, 20 Apr 2009 21:38:54 +0200, Bernt Hansson wrote: Hello list! I was thinking of makeing a slice encrypted with geli. My question is: does geli init -s 4096 /dev/ad* erase the data on the slice. The handbook didn't say yes or no, and I don't want to try without asking. No, No, what? does it erase the data or not. but if you plan to use geli to encrypt data that will end up on the slice it may be a useful thing to: a) keep a backup copy of the data in its unencrypted form Bad idea. b) overwrite the entire partition with random bytes (increased entropy means that it is harder to 'attack' the final encrypted data stream when geli starts writing over parts of the encrypted slice) But I want to keep the info on the slice. ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Re: Encrypted slice with geli
On Mon, 20 Apr 2009 14:17:40 -0600 Modulok wrote: > Cryptographically speaking: No, the majority of your data still > exists as magnetic signatures on the physical disk. (Though is not > directly accessible.) This is a bit misleading, the data in the unwritten disk sectors is still accessible through the device, so it would still be possible to image the disk and perform offline reconstruction of the data. You wouldn't need to rely on magnetic hysteresis. ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Re: Encrypted slice with geli
On Mon, 20 Apr 2009 21:38:54 +0200, Bernt Hansson wrote: > Hello list! > > I was thinking of makeing a slice encrypted with geli. > > My question is: does geli init -s 4096 /dev/ad* erase the data on the > slice. The handbook didn't say yes or no, and I don't want to try > without asking. No, but if you plan to use geli to encrypt data that will end up on the slice it may be a useful thing to: a) keep a backup copy of the data in its unencrypted form b) overwrite the entire partition with random bytes (increased entropy means that it is harder to 'attack' the final encrypted data stream when geli starts writing over parts of the encrypted slice) c) attach the randomized partition with geli d) newfs the xxx.eli device ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Re: Encrypted slice with geli
On 4/20/09, Bernt Hansson wrote: > Hello list! > > I was thinking of makeing a slice encrypted with geli. > > My question is: does geli init -s 4096 /dev/ad* erase the data on the > slice. The handbook didn't say yes or no, and I don't want to try > without asking. Short answer: Yes, it will blow away your data. It will make any data which previously lived in the slice inaccessible. Only do this on an empty slice. Cryptographically speaking: No, the majority of your data still exists as magnetic signatures on the physical disk. (Though is not directly accessible.) If your intent was to securely and irrevocably destroy the data on a slice, the command you showed will not do that. -Modulok- ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Re: Encrypted slice with geli
In response to Bernt Hansson : > Hello list! > > I was thinking of makeing a slice encrypted with geli. > > My question is: does geli init -s 4096 /dev/ad* erase the data on the > slice. The handbook didn't say yes or no, and I don't want to try > without asking. Creating an encrypted slice with geli destroys any data that was previous on the slice. -- Bill Moran http://www.potentialtech.com http://people.collaborativefusion.com/~wmoran/ ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
