Lab Notes: A Simple Encrypted Filesystem on Linux
by Lawrence Teo
September 14, 2007
Here are some quick notes on how to create a simple encrypted filesystem
on Linux. This example was done on a Zenwalk 4.8-beta system running the
Linux 2.6.22.5 kernel, but the steps should be applicable on any Linux
system (no Zenwalk-ism's were used).
First-Time Setup
First, you need to insert the cryptoloop kernel module:
modprobe cryptoloop
Then, create the file that will be used for the encrypted filesystem
using the dd(1) command. The following command creates a 500MB file
with random bits from the /dev/urandom device.
dd if=/dev/urandom of=/home/username/.crypto bs=1024k count=500
Use the losetup(8) command to associate a loopback device with that file.
losetup -e aes /dev/loop0 /home/username/.crypto
Now we create an ext2 filesystem on that device:
mke2fs /dev/loop0
You can now create a mountpoint and mount your encrypted filesystem:
mkdir /home/username/mntcrypt
mount -t ext2 /dev/loop0 /home/username/mntcrypt
When you're done using the encrypted filesystem, you can unmount
it and deassociate the loop device.
umount /home/username/mntcrypt
losetup -d /dev/loop0
For convenience, you can prepare an entry in your /etc/fstab file for
future use:
/home/username/.crypto /home/username/mntcrypt ext2 defaults,noauto,loop,encryption=aes 0 0
Subsequent Steps
Once the first-time setup steps are done, you can mount your encrypted
filesystem with the following steps in the future:
modprobe cryptoloop
mount /home/username/mntcrypt
|