Active Topics
-
Camera phone competition March 2023 "Endless" (35)
to General by Maemish - 1 day, 22 hrs ago -
TLS 1.2 for N9 is ready (28)
to MeeGo / Harmattan by smartblu9 - 1 day, 23 hrs ago -
Maemo repository (3)
to Community by torsen - 2 days, 15 hrs ago -
Error after installing Leste on sdcard (11)
to Maemo 7 / Leste by Maemish - 3 days, 12 hrs ago -
Introducing ubiboot N9 (multiboot OS loader) (1,393)
to Alternatives by smatkovi - 4 days, 19 hrs ago - more...
| The Following 2 Users Say Thank You to soeiro For This Useful Post: | ||
 |
|
2010-07-27
, 02:48
|
|
Posts: 451 |
Thanked: 424 times |
Joined on Apr 2010
@ England
|
#32
|
Has any futher progress been made with this?
I'm in need of encrypting my eMMC (pictures, videos, texts etc); I only have a small SD card atm which I'm using to dualboot so I can't really use that.
I'm in need of encrypting my eMMC (pictures, videos, texts etc); I only have a small SD card atm which I'm using to dualboot so I can't really use that.
__________________
BTC:
19ePiXZUdxqNAq9tStLzZV4dduSQeGPJzj
BTC:
19ePiXZUdxqNAq9tStLzZV4dduSQeGPJzj
|
|
2010-09-04
, 13:50
|
|
Posts: 4 |
Thanked: 0 times |
Joined on Sep 2010
@ Netherlands
|
#33
|
How to make Jebba's kernel modules stay active?
I followed the instructions given in
http://wiki.maemo.org/User:Jebba/Ker..._custom_kernel
to the line
Enjoy
after having done that, I put in the n900 my SD-card (partitioned in vfat and Luks-ext3 part), vfat mounted automatically and then I used the cryptsetup luksOpen command, gave password and mounted ext3. All worked nicely.
Then I rebooted the device and although the cryptsetup command was there, the needed modules were no longer available.
So I used again the 2 x dpkg commands given by Jebba and rebooted.All worked again as it should. Reboot again made the needed modules disappear again.
BTW: I also changed /etc/fstab and the reboot put the original /etc/fstab in its place again.
What happened, why do the modules disppear and why is /etc/fstab restored?
I followed the instructions given in
http://wiki.maemo.org/User:Jebba/Ker..._custom_kernel
to the line
Enjoy
after having done that, I put in the n900 my SD-card (partitioned in vfat and Luks-ext3 part), vfat mounted automatically and then I used the cryptsetup luksOpen command, gave password and mounted ext3. All worked nicely.
Then I rebooted the device and although the cryptsetup command was there, the needed modules were no longer available.
So I used again the 2 x dpkg commands given by Jebba and rebooted.All worked again as it should. Reboot again made the needed modules disappear again.
BTW: I also changed /etc/fstab and the reboot put the original /etc/fstab in its place again.
What happened, why do the modules disppear and why is /etc/fstab restored?
|
|
2010-09-04
, 13:59
|
|
Posts: 4 |
Thanked: 0 times |
Joined on Sep 2010
@ Netherlands
|
#34
|
Originally Posted by jd4200
Dual boot your N900?? How and with what?
Has any futher progress been made with this?
I'm in need of encrypting my eMMC (pictures, videos, texts etc); I only have a small SD card atm which I'm using to dualboot so I can't really use that.
|
|
2010-09-04
, 17:18
|
|
Posts: 4 |
Thanked: 0 times |
Joined on Sep 2010
@ Netherlands
|
#35
|
Originally Posted by Daniel-1944
By chance I found a mention in Internet that booting with the keyboard uncovered or covered makes a difference. So I tried booting with the keyboard open and was pleased to see that now the cryptsetup modules are available.
How to make Jebba's kernel modules stay active?
.
.
.
BTW: I also changed /etc/fstab and the reboot put the original /etc/fstab in its place again.
What happened, why do the modules disappear and why is /etc/fstab restored?
Conclusion: keeping the keyboard closed will also keep the extra modules inaccessible.
However, /etc/fstab remains the original one, not the one with my changes, so that one is not influenced by having the keyboard open or closed.
|
|
2010-09-07
, 12:27
|
|
Posts: 1 |
Thanked: 10 times |
Joined on Sep 2010
|
#36
|
Hello,
I have managed to somehow set up encrypted /home/user using truecrypt, using the internal flash partition /dev/mmcblk0p1, which is normally mounted as /home/user/MyDocs.
First step is to back up /home/user/MyDocs contents, as they will be overwritten!
Second step was to unmount the partition, and encrypting it using truecrypt, with ext3 filesystem. After that, mount it some place as /mnt, set the correct ownership and permisions (owner user.users), and copy the contents of /home/user (including the hidden folders) to the new truecrypt encrypted partition.
Now, a tricky part comes in. Somehow, the N900 will not be able to browse the /home/user/MyDocs folder, unless it is mounted directly. The only workaround i could find, is to create an image under the new /home/user folder (which will be encrypted) , and mount it separate under /home/user/MyDocs , as a loop device. It does not matter which type of filesystem you use , as the N900 can accept both fat32 and ext3 fs under MyDocs folder.
The interesting part is that you get somehow plausible deniability, as when you first start the phone, it will not show the contacts, pictures, user accounts, documents, until you use the following script to mount the encrypted partition:
(after encryption, at start-up you will get a message stating "unsupported filesystem" and the /dev/mmcblk0p1 will not be mounted)
#!/bin/bash
truecrypt --filesystem=none /dev/mmcblk0p1
mount /dev/loop0 /home/user
#if i don't mount it like this, it takes too long to mount
losetup /dev/loop5 /home/user/docs.img
mount /dev/loop5 /home/user/MyDocs
#workaround to be able to "see" the MyDocs folder using the #filemanager.
truecrypt -l
sleep 2
killall signond
#restart the daemon that manages IM user accounts (and maybe #e-mail accounts?)
sleep 2
killall mission-control rtcom-messaging-ui rtcom-call-ui rtcom-accounts-ui
#restart the messaging services, to re-read messaging accounts
sleep 2
killall hildon-desktop hildon-home hildon-status-menu
#restart the better part of hildon, to re-read desktop, calendar, #shortcuts, etc from the new /home/user encrypted partition.
Script has to run as root.
This actually works, by replacing /home/user folder with an encrypted one, and the /home/user/MyDocs with a loop image (you can choose the size). There is no significant performance decrease, and does not affect the battery. Also, you do not need to modify the kernel.
Works perfect on the N900 with last version of firmware and kernel,
and last version of tryuecrypt ported on N900 Maemo 5.
Now, there is also a method of encrypting the swap partition, using truecrypt with one-time key files. Here is the script:
(has to be ran after mounting the encrypted /home/user partition)
#!/bin/bash
swapoff -a
#disable swap
cd /home/user
dd if=/dev/urandom of=key1.txt bs=1024K count=1
dd if=/dev/urandom of=key2.txt bs=1024K count=1
dd if=/dev/urandom of=key3.txt bs=1024K count=1
dd if=/dev/urandom of=key4.txt bs=1024K count=1
dd if=/dev/urandom of=key5.txt bs=1024K count=1
#create 5 one time use key-files under the encrypted /home/user
truecrypt -t -c --random-source=/dev/urandom --quick --encryption=AES --hash=SHA-512 --volume-type=normal --filesystem=none -k key1.txt,key2.txt,key3.txt,key4.txt,key5.txt -p="" /dev/mmcblk0p3
truecrypt -t -p="" -k key1.txt,key2.txt,key3.txt,key4.txt,key5.txt --protect-hidden=no --filesystem=none /dev/mmcblk0p3
rm -f key*.txt
#create a truecrypt partition on the /dev/mmcblk0p3 and remove #the temporary key files
mkswap /dev/loop1
swapon /dev/loop1
#format and activate the swap
However, this has not been tested.
Once again, this method works by replacing the entire /home/user folder, along with all its contents, including calendar entries, email and IM accounts, emails and conversations. If you decide to try it, make sure you back up the important stuff first.
I could not find a reliable way to encrypt the swap, the /tmp and the /var/tmp folders, yet. Maybe someone else will.
Cheers,
J
I have managed to somehow set up encrypted /home/user using truecrypt, using the internal flash partition /dev/mmcblk0p1, which is normally mounted as /home/user/MyDocs.
First step is to back up /home/user/MyDocs contents, as they will be overwritten!
Second step was to unmount the partition, and encrypting it using truecrypt, with ext3 filesystem. After that, mount it some place as /mnt, set the correct ownership and permisions (owner user.users), and copy the contents of /home/user (including the hidden folders) to the new truecrypt encrypted partition.
Now, a tricky part comes in. Somehow, the N900 will not be able to browse the /home/user/MyDocs folder, unless it is mounted directly. The only workaround i could find, is to create an image under the new /home/user folder (which will be encrypted) , and mount it separate under /home/user/MyDocs , as a loop device. It does not matter which type of filesystem you use , as the N900 can accept both fat32 and ext3 fs under MyDocs folder.
The interesting part is that you get somehow plausible deniability, as when you first start the phone, it will not show the contacts, pictures, user accounts, documents, until you use the following script to mount the encrypted partition:
(after encryption, at start-up you will get a message stating "unsupported filesystem" and the /dev/mmcblk0p1 will not be mounted)
#!/bin/bash
truecrypt --filesystem=none /dev/mmcblk0p1
mount /dev/loop0 /home/user
#if i don't mount it like this, it takes too long to mount
losetup /dev/loop5 /home/user/docs.img
mount /dev/loop5 /home/user/MyDocs
#workaround to be able to "see" the MyDocs folder using the #filemanager.
truecrypt -l
sleep 2
killall signond
#restart the daemon that manages IM user accounts (and maybe #e-mail accounts?)
sleep 2
killall mission-control rtcom-messaging-ui rtcom-call-ui rtcom-accounts-ui
#restart the messaging services, to re-read messaging accounts
sleep 2
killall hildon-desktop hildon-home hildon-status-menu
#restart the better part of hildon, to re-read desktop, calendar, #shortcuts, etc from the new /home/user encrypted partition.
Script has to run as root.
This actually works, by replacing /home/user folder with an encrypted one, and the /home/user/MyDocs with a loop image (you can choose the size). There is no significant performance decrease, and does not affect the battery. Also, you do not need to modify the kernel.
Works perfect on the N900 with last version of firmware and kernel,
and last version of tryuecrypt ported on N900 Maemo 5.
Now, there is also a method of encrypting the swap partition, using truecrypt with one-time key files. Here is the script:
(has to be ran after mounting the encrypted /home/user partition)
#!/bin/bash
swapoff -a
#disable swap
cd /home/user
dd if=/dev/urandom of=key1.txt bs=1024K count=1
dd if=/dev/urandom of=key2.txt bs=1024K count=1
dd if=/dev/urandom of=key3.txt bs=1024K count=1
dd if=/dev/urandom of=key4.txt bs=1024K count=1
dd if=/dev/urandom of=key5.txt bs=1024K count=1
#create 5 one time use key-files under the encrypted /home/user
truecrypt -t -c --random-source=/dev/urandom --quick --encryption=AES --hash=SHA-512 --volume-type=normal --filesystem=none -k key1.txt,key2.txt,key3.txt,key4.txt,key5.txt -p="" /dev/mmcblk0p3
truecrypt -t -p="" -k key1.txt,key2.txt,key3.txt,key4.txt,key5.txt --protect-hidden=no --filesystem=none /dev/mmcblk0p3
rm -f key*.txt
#create a truecrypt partition on the /dev/mmcblk0p3 and remove #the temporary key files
mkswap /dev/loop1
swapon /dev/loop1
#format and activate the swap
However, this has not been tested.
Once again, this method works by replacing the entire /home/user folder, along with all its contents, including calendar entries, email and IM accounts, emails and conversations. If you decide to try it, make sure you back up the important stuff first.
I could not find a reliable way to encrypt the swap, the /tmp and the /var/tmp folders, yet. Maybe someone else will.
Cheers,
J
| The Following 10 Users Say Thank You to jsweiss For This Useful Post: | ||
|
|
2011-05-17
, 16:15
|
|
Posts: 49 |
Thanked: 39 times |
Joined on May 2011
|
#37
|
Did anyone try this? would be great if you could share your experiences in this thread.
|
|
2012-01-03
, 02:49
|
|
Posts: 45 |
Thanked: 5 times |
Joined on Oct 2008
|
#38
|
After puzzling through the various options for securing the N900, I decided to go with cryptsetup/dmcrypt/LUKS for the SD card 'mmc1' and to skip trying to encrypt /home and /MyDocs for the time being (1, it's a PITA and 2, simply locking your phone will deter thieves from getting at your data on the internal RAM (yes, the bug that exposed it to the USB port when powered down has been fixed in PR 1.2)
But the SD card, anyone can pull it out of the phone. So why not use Linux-native LUKS filesystem encryption to secure it?
I've seen bits and pieces of how to use cryptsetup to secure your SD card on this and other forums but never a full 'cut and paste' guide n00bs like me could use. So here goes.
(It's worth mentioning first that I'm using the Kernel Power kernel replacement http://wiki.maemo.org/Kernel_Power
This may or may not be necessary.
For root shell access, I've got sudser and rootsh and bash3 from the applications manager. For more see here http://wiki.maemo.org/Root_access)
Substitute your fave editor for nano, which I think I also installed seperately, in the steps below.
1. Install cryptsetup
2. Backup your SD-card contents
- I put the SD card in my Linux desktop's media reader and simply copied the directory to a safe place
3(a). Format your SD-card for LUKs - OPTION1 use Linux desktop
- I actually just used Ubuntu's Nautilus file manager to view the computer's drives, then right-clicked on the SD card, picked Format, and chose 'Encrypted, Compatible with Linux (FAT)' It then asks you to enter your passphrase.
After putting the card back in the N900 I did the following just to make sure the filesystem is ext3 (why not use a journalled file system)
3(b). Format your SD-card for LUKs - OPTION 2 use N900 console
- You could instead use the N900's console with the SD card in the phone (see here)
4. Make a script to help automate the process
- I didn't find anything conclusive to automount the SD card on startup in these forums, but was able to modify a script I found here to make it pretty painless.
Paste the following in
CTRL-O and CTRL-X to save and exit nano
finally,
5. (Optional) Edit the system mount script to remove annoying 'filesystem not supported' error message that happens when SD card crypt is first opened in script above. You can just ignore it though if you want.
Look for the line that reads
b | c | e | 4 | 6 | 14 | 16 | 1b | 1c | 1e)
and change it to
b | c | e | 4 | 6 | 14 | 16 | 83 | 1b | 1c | 1e)
and press CTRL-O, CTRL-X to save and exit.
6. To open the SD card, you can now type (from the shell)
To close the SD card, type
Huzzah! Hope that helps someone out.
But the SD card, anyone can pull it out of the phone. So why not use Linux-native LUKS filesystem encryption to secure it?
I've seen bits and pieces of how to use cryptsetup to secure your SD card on this and other forums but never a full 'cut and paste' guide n00bs like me could use. So here goes.
(It's worth mentioning first that I'm using the Kernel Power kernel replacement http://wiki.maemo.org/Kernel_Power
This may or may not be necessary.
For root shell access, I've got sudser and rootsh and bash3 from the applications manager. For more see here http://wiki.maemo.org/Root_access)
Substitute your fave editor for nano, which I think I also installed seperately, in the steps below.
1. Install cryptsetup
Code:
sudo apt-get install cryptsetup
- I put the SD card in my Linux desktop's media reader and simply copied the directory to a safe place
3(a). Format your SD-card for LUKs - OPTION1 use Linux desktop
- I actually just used Ubuntu's Nautilus file manager to view the computer's drives, then right-clicked on the SD card, picked Format, and chose 'Encrypted, Compatible with Linux (FAT)' It then asks you to enter your passphrase.
After putting the card back in the N900 I did the following just to make sure the filesystem is ext3 (why not use a journalled file system)
Code:
# unmount the SD card sudo umount /media/mmc1 # open the crypt (type your passphrase in again) sudo cryptsetup luksOpen /dev/mmcblk1 mmc1 # now add the ext3 file system inside the crypt sudo mkfs.ext3 -j -m 1 -O dir_index,filetype,sparse_super /dev/mapper/mmc1
- You could instead use the N900's console with the SD card in the phone (see here)
Code:
# unmount the SD card sudo umount /media/mmc1 # format the card, use a strong passphrase! sudo cryptsetup --verbose --verify-passphrase luksFormat /dev/mmcblk1 # open the crypt (type your passphrase in again) sudo cryptsetup luksOpen /dev/mmcblk1 mmc1 # now add a file system inside the crypt - ext3 is good sudo mkfs.ext3 -j -m 1 -O dir_index,filetype,sparse_super /dev/mapper/mmc1
- I didn't find anything conclusive to automount the SD card on startup in these forums, but was able to modify a script I found here to make it pretty painless.
Code:
# drop a script in /home - couldn't get executable permission for scripts in /home/MyDocs cd ~ cd .. mkdir scripts sudo nano crypt.sh
Code:
#!/bin/sh case $1 in start) modprobe dm_crypt cryptsetup luksOpen /dev/mmcblk1p1 mmc1 echo "Mounting SD card..." mount /dev/mapper/mmc1 /media/mmc1 chmod 777 /media/mmc1 ;; stop) echo "Unmounting SD card..." umount /media/mmc1 cryptsetup luksClose /dev/mapper/mmc1 ;; *) echo "Usage: crypt [ start | stop ]" ;; esac
finally,
Code:
sudo chmod +x crypt.sh
Code:
cd /usr/sbin sudo nano oss-mmc-mount.sh
b | c | e | 4 | 6 | 14 | 16 | 1b | 1c | 1e)
and change it to
b | c | e | 4 | 6 | 14 | 16 | 83 | 1b | 1c | 1e)
and press CTRL-O, CTRL-X to save and exit.
6. To open the SD card, you can now type (from the shell)
Code:
sudo ~/scripts/crypt.sh start
Code:
sudo ~/scripts/crypt.sh stop
| The Following User Says Thank You to tehowe For This Useful Post: | ||
|
|
2012-01-06
, 22:08
|
|
Posts: 124 |
Thanked: 105 times |
Joined on Jul 2010
|
#39
|
Quick question.. does this mount the encrypted partition on a pc when you plug in in usb mode? (with the partition decrypted and mounted, of course)
|
|
2012-01-10
, 19:17
|
|
Posts: 45 |
Thanked: 5 times |
Joined on Oct 2008
|
#40
|
Originally Posted by nman
If you mean encrypting the SD card as above, then any recent Linux installation on your desktop should ask you for the password before mounting the SD card. That's what happens in Ubuntu 11.04 at least.
Quick question.. does this mount the encrypted partition on a pc when you plug in in usb mode? (with the partition decrypted and mounted, of course)
It seems that "osso-mmc-mount.sh" verifies for each file system if it is in a supported list (which only have a few allowed IDs). When I included id "83" there, and changed mmc-mount it stopped complaining. The n900 also started to mount the microSDHC automatically.
It might be the same script in your case. It might be going through all available partitions and feeding them to this script or similar...
Help improve N900, vote for:
Information about what the email client is doing
Find applications easily with tags for sub-menus
A better help system
Limit download of emails per connection type (don't fetch attachments)
A better use of internal flash