Secure Linux system?

Hi!

I'm looking into ways to make my laptop and other systems secure, very secure indeed. My questions...
What's the most user friendly Linux version of a BitLocker type product? I need the boot drive etc to be encrypted.
Is there a more secure file system I can use on Linux? for example when you delete a file it's metadata and data isn't left in a recoverable state on the disk like NTFS. I'm aware of additional tools to securely delete stuff and overwrite mft records, but it'd be nice if it was a feature of the file system without the extra hassle.

I think most modern distros incorporate LUKS/dm-crypt out-of-the-box - there's a Ubuntu 8.04 walkthrough here (note that you'll need the "alternate" install disc). It doesn't look too complicated, although I've never tried it myself.

The encryption works at block level, so I wouldn't worry too much about the filesystem sitting on top of it, no-one's getting at that data without the passphrase. :)

Quote:

---

Originally Posted by CaptainCrash

I think most modern distros incorporate LUKS/dm-crypt out-of-the-box - there's a Ubuntu 8.04 walkthrough here (note that you'll need the "alternate" install disc). It doesn't look too complicated, although I've never tried it myself.

The encryption works at block level, so I wouldn't worry too much about the filesystem sitting on top of it, no-one's getting at that data without the passphrase. :)

---

This helps a lot, thanks, but I'm still very curious to know if there is a more secure, usable, file system in existence, one where.. for example... the *MFT* is not allowed to grow infinitely with useless, redundant records.

for Windows... I wonder if there is a tool to create a duplicate of the MFT with the active records, minus the redundant ones.. checking everything is OK, and then replacing the old MFT with the new optimized MFT.

You could use Truecrypt to encrypt the entire drive, it has barely any impact on IO performance and you can just install it on an existing OS select encrypt OS drive and it will do the work in the background.

Quote:

---

Originally Posted by watercooled

You could use Truecrypt to encrypt the entire drive, it has barely any impact on IO performance and you can just install it on an existing OS select encrypt OS drive and it will do the work in the background.

---

Interesting.. I wonder if it has better performance than Bitlocker.. but more importantly.. may I setup TC in a manner similar to the way I have bitlocker setup now? e.g. My system requires me to attach a usb thumbdrive with the correct key file in order for it to boot up...

my only interest in a linux solution now would be if it offers a superior file system in the terms that I've described.

After reading about the NTFS MFT earlier.. I come to think that it is impossible to remove MFT records, only to overwrite them, which is something at least.. essential for security.

TC does support security tokens so yeah I think you should be able to do the same thing. Or if you mean it's just a regular flash drive you use then you could store a key file on, with or without a password.

Something like this to mount.

Creating the disk, either use a whole device from the partition table, lvm or create a bit file using dd, really you should write random data to the device first, but that will take alot of time, you could create a few large randomised files then cat them in random orders to the disk space.

/sbin/losetup /dev/loop2 /mydisk/secure.cyp
/sbin/cryptsetup -c aes-cbc-essiv:sha256 create dm-secure_cyp /dev/loop2
mkfs.ext3 /dev/loop2
/sbin/cryptsetup remove dm-secure_cyp
/sbin/losetup -d /dev/loop2

Alway create the device format it then remove it to make sure you have the password correct!


/sbin/losetup /dev/loop2 /mydisk/secure.cyp
/sbin/cryptsetup -c aes-cbc-essiv:sha256 create dm-secure_cyp /dev/loop2
mount /dev/mapper/dm-secure_cyp /home/secure

umount /home/secure
/sbin/cryptsetup remove dm-secure_cyp
/sbin/losetup -d /dev/loop2

Depends what you are trying to do.

If you are securing data-at-rest, then Truecrypt (as a whole disk encryptor) will work, as will oolon's solution above. Alternatively you could use a hardware solution such as Flagstone.

If you are after a more secure fiole access system, then Linux SE (Security Extensions) is a very customisaeable policy based system for access control - but not at all easy to set up!

If you are concerned about artefacts left behind on your disk, that is another problem although data-at-rest protection will also provide some protection against that.

TrueCrypt's very good, another vote from me. I use it at work to encrypt the machines we do data analysis on as some of our data is personally identifiable. When I did a performance test post-encryption to see what effect it had on our analysis processes, they actually ran slightly faster post-encryption. Not that I'm saying it will speed up the system, mind you, but based on that it certainly shouldn't slow it down :D

Yeah I heard it can increase disk performance but I haven't benchmarked it myself. Does it affect CPU load much?

Don't think so - I'd need to have another play to be sure, but the process I tested is fairly processor intensive, so I'd guess not :D I assume the disk performance improvements are because it caches more aggressively to aid in the on-the-fly encryption / decryption. I'll have a couple of new machines to do soon anyway, so might have a proper benching session on those to see what difference it makes...