![]() |
TrueCrypt 7 with GUI and kernel crypto
You are doing everything at own risk if you follow the instructions.
Kernel Crypto Without crypto modules, TC will be probably slower and you have to mount with truecrypt -m nokernelcrypto. AES and Twofish with the block cipher mode XTS are supported by power kernel v48 out of the box. If you want kernel crypto for older versions, take a look at this page. Precompiled Available in extras-devel Compilation in scratchbox Verification of the downloaded packages is up to you. Setup scratchbox as described here http://wiki.maemo.org/Documentation/...l_Installation Log in and choose the ARM target. Add these two friends to /etc/apt/sources.list Code:
deb http://repository.maemo.org/extras/ fremantle-1.3 free non-free Code:
apt-get update ; apt-get install g++ nasm make libwxgtk2.8-dev libwxgtk2.8-0 libfuse-dev libfuse2 pkg-config Code:
cd truecrypt-7.0a-source copy truecrypt-7.0a-source/Main/truecrypt to /usr/bin/truecrypt on your N900 Code:
apt-get install libwxgtk2.8-0 libfuse2 dmsetup (on your N900) If you don't want to use kernel crypto, you have to mount it with something like this: truecrypt -m nokernelcrypto [disk/container] [mountpoint]. Otherwise you will have some errors. Security Tips Password leaks If the auto complete function of maemo is enabled, most of the passwords entered to a GUI will be saved into a database. Turn this feature off before using TC. Database path: /home/user/.osso/dictionaries/.personal.dictionary. Protection when mounted There is of course no protection when your device is turned on and the partition or file container mounted. If someone steals your phone, your tc protected files will become accessible. To prevent this, you can enable the lock code. This should be secure unless your attacker has SSH access or something similar to that. Swap See some paragraphs below. Issues GUI does not fit. To fix this, we can deactivate the Maemo Theme for tc: Code:
:~# unset GTK2_RC_FILES Autostart Script http://img5.imagebanana.com/img/2q6e...0115212646.png /etc/event.d/truecrypt Quote:
Quote:
This will mount the volumes you want on hildon start up. The known dialog("Enter password for...") will ask you to enter your password and to provide the keys etc. Protection of private data in /home/user/ The following steps are very messy. A better solution - but harder - is the encryption of the /home/ partition. check this If the partition or the file container which contains these things is not mounted, you can't use your crypted data and this will result in some error messages. And again, you are doing it at your own risk and only you are responsible for data loss. So, mount your TC volume. Please keep in mind that the following steps are not recommended/possible if you are using FAT thanks to user permissions and stuff like that which fat can not handle the way traditional linux filesystems do. a) Moving phonebook This will move your phone book. Symbolic links will point to the path in your encrypted volume. However, this is just a "mv", which means, no secure delete will occur on the source directories. Code:
cd /home/user/ Code:
cd /home/user The same principle can be adapted to other directories, for example .mozilla. Swap encryption Unencrypted parts can remain in the swap partition. We should deal with that. Please make sure that you have the tools and the kernel modules! Encryption of the Swap-Partition 1. cat /proc/swaps - Find out which device is your swap partition. Usually it is /dev/mmcblk0p3. 2. Open /etc/event.d/rcS-late 3. Find "swapon -a" 4. Replace it with: Code:
modprobe dm_crypt It's recommended to test it first without editing the bootscripts. General tips FAT If you want to write to FAT volumes as user, read this (--fs-options). ext performance For ext volumes, the following options are recommended. Code:
truecrypt [source] [mountpoint] --fs-options=noatime,nodiratime,data=writeback root user To avoid multiple issues (e. g. setting device mappings and mounting), run tc as root. |
Re: [HOWTO]TrueCrypt with GUI and kernel crypto
Great post, I'm trying to get full system encryption to work without any major issues. If that's not possible, I will use your softlink method instead. If anyone is interested in sharing their experiences, please do so in this thread.
|
Re: [HOWTO]TrueCrypt 7 with GUI and kernel crypto
truecrypt gui just doesn't fit on the screen, better to build without
|
Re: [HOWTO]TrueCrypt 7 with GUI and kernel crypto
couldn't actually build without gui, wxWidgets decency hell
nevertheless, I can't mount a volume, any idea what is wrong? Code:
Nokia-N900:/home/user/MyDocs# truecrypt -t test.tc |
Re: [HOWTO]TrueCrypt 7 with GUI and kernel crypto
Hey there,
great tutorial. After six hours of trying I finally got it working. Wouldn't it be possible to load the compiled Trucrypt7.0a into extra-devel? It would safe a lot of time, since the newest desktop-version is Truecrypt7.0a and you need the same version for encrypt MyDocs via the PC. Anyway I got the following problem: I mount my encrypted MyDocs like this Code:
truecrypt -m nokernelcrypto --protect-hidden=no /dev/mmcblk0p1 /home/user/MyDocs Cheers blck EDIT: Got it! Adding --fs-options=rw,uid=29999 to the tcmount did it. |
Re: [HOWTO]TrueCrypt 7 with GUI and kernel crypto
Quote:
Edit: :~# unset GTK2_RC_FILES :~# truecrypt Screenshots: http://img7.imagebanana.com/img/px4n...0625134520.png http://www.imagebanana.com/view/kegr...0625134600.png It is useable. Quote:
Quote:
Quote:
|
Re: TrueCrypt 7 with GUI and kernel crypto
Boom. Now that v48 is out we finally got the xts block cipher mode kernel module coming with the kernel. This (should) give faster performance for disk encryption software like TrueCrypt, which uses XTS by default. Version 6* which is in the repos is now actually obsolete (it's hardcoded with -m nokernelcrypto).
|
Re: TrueCrypt 7 with GUI and kernel crypto
<Estel cast thread resurrection sign> *boom*
NIN101, any chances of putting latest truecrypt into maemo repos? It's a little shame, that we still got hardcoded -nokernelcrypto version in -devel. Anyway, thanks for doing 7.1, whenever it sits ;) Also, please remember, that You don't need to be maintainer, to upload new version into -devel. /Estel |
Re: TrueCrypt 7 with GUI and kernel crypto
I considered months ago to package it, even created debs, but I finally didn't upload the stuff to extras-devel. Because I have no motivation to deal with problems like kernel fragmentation¹. Of course, we could depend on kernel-power. But it's not that cool to force kernels. Users who install KP should manage to do a cp to /usr/bin or compile it (the best way). Modules for most known kernels could be shipped with some postinstall magic - but this is not exactly brilliant. A wrapper script with a fallback to -m nokernelcrypto if the needed modules are not found is cool, but... dunno.
Pretty annoying starting situation |
Re: TrueCrypt 7 with GUI and kernel crypto
Quote:
|
All times are GMT. The time now is 23:15. |
vBulletin® Version 3.8.8