"The Linux Gazette...making Linux just a little more fun!"

(?) The Answer Guy (!)


By James T. Dennis, answerguy@ssc.com
Starshine Technical Services, http://www.starshine.org/

(?) Crypto Support for Linux

From dreamwvr, August sometime in 1998 (in an old thread on the Linux-Admin List which I've been reading as part of the research for my book).

i believe it is called efs which stands for encrypted file system...

(!) Glynn Clements wrote:
There is Matt Blaze's CFS (cryptogrphic filesystem) which is basically a userspace filesytem over NFS to the loopback interface. This was part of a larger package called ESM, encrypted session manager. That wasn't Linux specific, but does work under it.

(?)Joseph Martin wrote:
I am helping a friend set up a new computer system. He is particularly interested in security. The regular linux authentication at the console should work well enough, however I was wondering about even more security. Are there any encrypted file systems we could set up? For example the computer boots up, loads the system from a ext2 partition and then presents a login prompt. After login a mount command is given, a password supplied and the partition data made visible and acessable. After use of partition it is unmounted and rendered unusuable again. Anything like that exist?

(!) You can use the loop device, which turns a file into a device which can then be mounted (assuming that it contains a valid filesystem).
The loop device supports on-the-fly encryption/decryption using DES or IDEA (but you have to get the appropriate kernel source files separately; they aren't part of the standard kernel source due to legal nonsense).
Alternatively, you can just encrypt the file with any encryption package (e.g. PGP), and decrypt it before mounting. However, this requires sufficient disk space to store two copies of the file.
Glynn Clements
(!)There is also the TCFS --- a transparent CFS from Italy. This is Linux specific code. (http://tcfs.dia.unisa.it)
There was also supposed to be a userfs module for encryption --- but I don't know if that was ever completed to production quality.
The best place to get most crypto code is to just fetch it from ftp://ftp.replay.com (or http://www.replay.com) which is located offshore (Netherlands?) to put it beyond the jurisdiction of my government's inane trade regulations. (Apologies to the free world).
I thought I read on the kernel list that http://www.kerneli.org was supposed to be a site where international (non-U.S. exportable) patches would be gathered and made available. However that address only returns a lame one line piece of text to lynx. I fared better with their ftp site at:
ftp://ftp.kerneli.org/pub/Linux/kerneli/v2.1
Where I saw a list of files of the form: patch-int-2.1.* (which I presume are "international" patches).
Userspace toys can be found in:
ftp://ftp.kerneli.org/pub/Linux/redhat-contrib/hacktic/i386
(RPM format, of course).
Meanwhile the loopfs encryption module seems to be located at Linux Mama (canonical home of unofficial Linux kernel patches)
http://www.linuxmama.com/dev-server.html
which has a link to:
ftp://fractal.mta.ca/pub/crypto/aem
TCFS is also suitable for encrytion of files on an NFS server (only the encrypted blocks traverse your network --- the client system does the decryption. That's a big win for security and performance).
As for encryption of other network protocols: There's the standard ssh, ssltelnet/sslftp (SSLeay), STEL, suite for applications layer work, and a couple of IPSec projects for Linux at the network/transport layer. A friend of mine has been deeply interested in the FreeS/WAN project at:
http://www.xs4all.nl/~freeswan
... or at:
http://www.flora.org/freeswan
(a mirror)
... This consists of a kernel patch and some programs to manage the creation of keys etcv.html">dell remoteroot

[ Table Of Contents ] [ Front Page ] [ Previous Section ] [ Next Section ] ./usr/share/doc/lg/issue35/tag/crypto.html0100644000000000000000000006524106773443024017276 0ustar rootroot The Answer Guy 35: FS Security using Linux

"The Linux Gazette...making Linux just a little more fun!"

(?) The Answer Guy (!)


By James T. Dennis, answerguy@ssc.com
Starshine Technical Services, http://www.starshine.org/

(?) Crypto Support for Linux

From dreamwvr, August sometime in 1998 (in an old thread on the Linux-Admin List which I've been reading as part of the research for my book).

i believe it is called efs which stands for encrypted file system...

(!) Glynn Clements wrote:
There is Matt Blaze's CFS (cryptogrphic filesystem) which is basically a userspace filesytem over NFS to the loopback interface. This was part of a larger package called ESM, encrypted session manager. That wasn't Linux specific, but does work under it.

(?)Joseph Martin wrote:
I am helping a friend set up a new computer system. He is particularly interested in security. The regular linux authentication at the console should work well enough, however I was wondering about even more security. Are there any encrypted file systems we could set up? For example the computer boots up, loads the system from a ext2 partition and then presents a login prompt. After login a mount command is given, a password supplied and the partition data made visible and acessable. After use of partition it is unmounted and rendered unusuable again. Anything like that exist?

(!) You can use the loop device, which turns a file into a device which can then be mounted (assuming that it contains a valid filesystem).
The loop device supports on-the-fly encryption/decryption using DES or IDEA (but you have to get the appropriate kernel source files separately; they aren't part of the standard kernel source due to legal nonsense).
Alternatively, you can just encrypt the file with any encryption package (e.g. PGP), and decrypt it before mounting. However, this requires sufficient disk space to store two copies of the file.
Glynn Clements
(!)There is also the TCFS --- a transparent CFS from Italy. This is Linux specific code. (http://tcfs.dia.unisa.it)
There was also supposed to be a userfs module for encryption --- but I don't know if that was ever completed to production quality.
The best place to get most crypto code is to just fetch it from ftp://ftp.replay.com (or http://www.replay.com) which is located offshore (Netherlands?) to put it beyond the jurisdiction of my government's inane trade regulations. (Apologies to the free world).
I thought I read on the kernel list that http://www.kerneli.org was supposed to be a site where international (non-U.S. exportable) patches would be gathered and made available. However that address only returns a lame one line piece of text to lynx. I fared better with their ftp site at:
ftp://ftp.kerneli.org/pub/Linux/kerneli/v2.1
Where I saw a list of files of the form: patch-int-2.1.* (which I presume are "international" patches).
Userspace toys can be found in:
ftp://ftp.kerneli.org/pub/Linux/redhat-contrib/hacktic/i386
(RPM format, of course).
Meanwhile the loopfs encryption module seems to be located at Linux Mama (canonical home of unofficial Linux kernel patches)
http://www.linuxmama.com/dev-server.html
which has a link to:
ftp://fractal.mta.ca/pub/crypto/aem
TCFS is also suitable for encrytion of files on an NFS server (only the encrypted blocks traverse your network --- the client system does the decryption. That's a big win for security and performance).
As for encryption of other network protocols: There's the standard ssh, ssltelnet/sslftp (SSLeay), STEL, suite for applications layer work, and a couple of IPSec projects for Linux at the network/transport layer. A friend of mine has been deeply interested in the FreeS/WAN project at:
http://www.xs4all.nl/~freeswan
... or at:
http://www.flora.org/freeswan
(a mirror)
... This consists of a kernel patch and some programs to manage the creation of keys etcv.html">dell remoteroot

[ Table Of Contents ] [ Front Page ] [ Previous Section ] [ Next Section ] ./usr/share/doc/lg/issue35/tag/crypto.html0100644000000000000000000006524106773443024017276 0ustar rootroot The Answer Guy 35: FS Security using Linux

"The Linux Gazette...making Linux just a little more fun!"

(?) The Answer Guy (!)


By James T. Dennis, answerguy@ssc.com
Starshine Technical Services, http://www.starshine.org/

(?) Crypto Support for Linux

From dreamwvr, August sometime in 1998 (in an old thread on the Linux-Admin List which I've been reading as part of the research for my book).

i believe it is called efs which stands for encrypted file system...

(!) Glynn Clements wrote:
There is Matt Blaze's CFS (cryptogrphic filesystem) which is basically a userspace filesytem over NFS to the loopback interface. This was part of a larger package called ESM, encrypted session manager. That wasn't Linux specific, but does work under it.

(?)Joseph Martin wrote:
I am helping a friend set up a new computer system. He is particularly interested in security. The regular linux authentication at the console should work well enough, however I was wondering about even more security. Are there any encrypted file systems we could set up? For example the computer boots up, loads the system from a ext2 partition and then presents a login prompt. After login a mount command is given, a password supplied and the partition data made visible and acessable. After use of partition it is unmounted and rendered unusuable again. Anything like that exist?

(!) You can use the loop device, which turns a file into a device which can then be mounted (assuming that it contains a valid filesystem).
The loop device supports on-the-fly encryption/decryption using DES or IDEA (but you have to get the appropriate kernel source files separately; they aren't part of the standard kernel source due to legal nonsense).
Alternatively, you can just encrypt the file with any encryption package (e.g. PGP), and decrypt it before mounting. However, this requires sufficient disk space to store two copies of the file.
Glynn Clements
(!)There is also the TCFS --- a transparent CFS from Italy. This is Linux specific code. (http://tcfs.dia.unisa.it)
There was also supposed to be a userfs module for encryption --- but I don't know if that was ever completed to production quality.
The best place to get most crypto code is to just fetch it from ftp://ftp.replay.com (or http://www.replay.com) which is located offshore (Netherlands?) to put it beyond the jurisdiction of my government's inane trade regulations. (Apologies to the free world).
I thought I read on the kernel list that http://www.kerneli.org was supposed to be a site where international (non-U.S. exportable) patches would be gathered and made available. However that address only returns a lame one line piece of text to lynx. I fared better with their ftp site at:
ftp://ftp.kerneli.org/pub/Linux/kerneli/v2.1
Where I saw a list of files of the form: patch-int-2.1.* (which I presume are "international" patches).
Userspace toys can be found in:
ftp://ftp.kerneli.org/pub/Linux/redhat-contrib/hacktic/i386
(RPM format, of course).
Meanwhile the loopfs encryption module seems to be located at Linux Mama (canonical home of unofficial Linux kernel patches)
http://www.linuxmama.com/dev-server.html
which has a link to:
ftp://fractal.mta.ca/pub/crypto/aem
TCFS is also suitable for encrytion of files on an NFS server (only the encrypted blocks traverse your network --- the client system does the decryption. That's a big win for security and performance).
As for encryption of other network protocols: There's the standard ssh, ssltelnet/sslftp (SSLeay), STEL, suite for applications layer work, and a couple of IPSec projects for Linux at the network/transport layer. A friend of mine has been deeply interested in the FreeS/WAN project at:
http://www.xs4all.nl/~freeswan
... or at:
http://www.flora.org/freeswan
(a mirror)
... This consists of a kernel patch and some programs to manage the creation of keys etcv.html">dell remoteroot

[ Table Of Contents ] [ Front Page ] [ Previous Section ] [ Next Section ] ./usr/share/doc/lg/issue35/tag/crypto.html0100644000000000000000000006524106773443024017276 0ustar rootroot The Answer Guy 35: FS Security using Linux

"The Linux Gazette...making Linux just a little more fun!"

(?) The Answer Guy (!)


By James T. Dennis, answerguy@ssc.com
Starshine Technical Services, http://www.starshine.org/

(?) Crypto Support for Linux

From dreamwvr, August sometime in 1998 (in an old thread on the Linux-Admin List which I've been reading as part of the research for my book).

i believe it is called efs which stands for encrypted file system...

(!) Glynn Clements wrote:
There is Matt Blaze's CFS (cryptogrphic filesystem) which is basically a userspace filesytem over NFS to the loopback interface. This was part of a larger package called ESM, encrypted session manager. That wasn't Linux specific, but does work under it.

(?)Joseph Martin wrote:
I am helping a friend set up a new computer system. He is particularly interested in security. The regular linux authentication at the console should work well enough, however I was wondering about even more security. Are there any encrypted file systems we could set up? For example the computer boots up, loads the system from a ext2 partition and then presents a login prompt. After login a mount command is given, a password supplied and the partition data made visible and acessable. After use of partition it is unmounted and rendered unusuable again. Anything like that exist?