{"id":86,"date":"2006-07-29T11:59:00","date_gmt":"2006-07-29T19:59:00","guid":{"rendered":"http:\/\/outflux.net\/blog\/archives\/2006\/07\/29\/encrypted-network-filesystems\/"},"modified":"2008-07-17T11:55:53","modified_gmt":"2008-07-17T19:55:53","slug":"encrypted-network-filesystems","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2006\/07\/29\/encrypted-network-filesystems\/","title":{"rendered":"encrypted network filesystems"},"content":{"rendered":"

I run a machine in a colo across the country from me, and I wanted to have some backups closer to the machine. So I signed up for a NAS login with my provider. Since I didn’t want to leave all my files sitting on their disks in the clear, I built up an encrypted volume over the network. It’s not fast, but it works.<\/p>\n

Here were the setup steps:<\/p>\n

    \n
  1. mkdir -p \/mnt\/nas-raw \/mnt\/backups<\/li>\n
  2. smbmount \/\/backup.server.at.my.isp\/mount.source.path \/mnt\/nas-raw -o username=myaccount,password=mypassword<\/li>\n
  3. modprobe loop && sleep 2<\/li>\n
  4. dd if=\/dev\/zero of=\/mnt\/nas-raw\/volume bs=32k<\/li>\n
  5. losetup \/dev\/loop0 \/mnt\/nas-raw\/volume<\/li>\n
  6. cryptsetup create crypt-backups \/dev\/loop0 –cipher=aes-cbc-essiv:sha256<\/li>\n
  7. Type volume pass-phrase<\/em><\/li>\n
  8. mkfs.ext3 \/dev\/mapper\/crypt-backups<\/li>\n
  9. mount \/dev\/mapper\/crypt-backups \/mnt\/backups<\/li>\n<\/ol>\n

    To unmount it:<\/p>\n

      \n
    1. umount \/mnt\/backups<\/li>\n
    2. cryptsetup remove crypt-backups<\/li>\n
    3. losetup -d \/dev\/loop0<\/li>\n
    4. umount \/mnt\/nas-raw<\/li>\n<\/ol>\n

      And then to remount it later:<\/p>\n

        \n
      1. smbmount \/\/backup.server.at.my.isp\/mount.source.path \/mnt\/nas-raw -o username=myaccount,password=mypassword<\/li>\n
      2. modprobe loop && sleep 2<\/li>\n
      3. losetup \/dev\/loop0 \/mnt\/nas-raw\/volume<\/li>\n
      4. cryptsetup create crypt-backups \/dev\/loop0 –cipher=aes-cbc–essiv:sha256<\/li>\n
      5. Type volume pass-phrase<\/em><\/li>\n
      6. mount \/dev\/mapper\/crypt-backups \/mnt\/backups<\/li>\n<\/ol>\n

        By scripting the “remount” steps, I can actually echo the volume password into an ssh connection:<\/p>\n

        \necho ‘my volume pass-phrase here’ | ~\/bin\/do-crypto-mount
        \nssh root@colo.machine.isp “\/etc\/dirvish\/dirvish-cronjob && df -h \/mnt\/backups”
        \n~\/bin\/do-crypto-umount\n<\/p><\/blockquote>\n

        Very handy!<\/p>\n

        Update:<\/strong> I added the --cipher<\/code> option to include the essiv type, which should be used.<\/p>\n

        © 2006 – 2008, Kees Cook<\/a>. This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 License<\/a>.
        \"CC<\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"

        I run a machine in a colo across the country from me, and I wanted to have some backups closer to the machine. So I signed up for a NAS login with my provider. Since I didn’t want to leave all my files sitting on their disks in the clear, I built up an encrypted […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7,6],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/86"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=86"}],"version-history":[{"count":0,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/86\/revisions"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=86"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=86"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=86"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}