I run a machine in a colo across the country from me, and I wanted to have some backups closer to the machine. So I signed up for a NAS login with my provider. Since I didn’t want to leave all my files sitting on their disks in the clear, I built up an encrypted volume over the network. It’s not fast, but it works.
Here were the setup steps:
- mkdir -p /mnt/nas-raw /mnt/backups
- smbmount //backup.server.at.my.isp/mount.source.path /mnt/nas-raw -o username=myaccount,password=mypassword
- modprobe loop && sleep 2
- dd if=/dev/zero of=/mnt/nas-raw/volume bs=32k
- losetup /dev/loop0 /mnt/nas-raw/volume
- cryptsetup create crypt-backups /dev/loop0 –cipher=aes-cbc-essiv:sha256
- Type volume pass-phrase
- mkfs.ext3 /dev/mapper/crypt-backups
- mount /dev/mapper/crypt-backups /mnt/backups
To unmount it:
- umount /mnt/backups
- cryptsetup remove crypt-backups
- losetup -d /dev/loop0
- umount /mnt/nas-raw
And then to remount it later:
- smbmount //backup.server.at.my.isp/mount.source.path /mnt/nas-raw -o username=myaccount,password=mypassword
- modprobe loop && sleep 2
- losetup /dev/loop0 /mnt/nas-raw/volume
- cryptsetup create crypt-backups /dev/loop0 –cipher=aes-cbc–essiv:sha256
- Type volume pass-phrase
- mount /dev/mapper/crypt-backups /mnt/backups
By scripting the “remount” steps, I can actually echo the volume password into an ssh connection:
echo ‘my volume pass-phrase here’ | ~/bin/do-crypto-mount
ssh root@colo.machine.isp “/etc/dirvish/dirvish-cronjob && df -h /mnt/backups”
~/bin/do-crypto-umount
Very handy!
Update: I added the --cipher option to include the essiv type, which should be used.
© 2006 – 2008, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 License.
Note to self:
It’s much faster (especially on a NAS) to allocate the loopback volume using “truncate” instead of a full “dd”. A sparse file can be created and the loop device will still do the right thing. This command will make a 10G file named “volume”:
perl -e ‘open(FILE,”>$ARGV[0]”); seek(FILE,$ARGV[1],0); truncate(FILE,$ARGV[1]);’ \
volume $(( 10 * 1024 * 1024 * 1024 ))
Comment by kees — December 25, 2006 @ 9:57 am
Note to self: dd can do sparse files too:
dd if=/dev/null of=test bs=1 seek=1G
Comment by kees — April 22, 2009 @ 8:30 am