roots/wiki
1
0
Fork 0
mirror of https://github.com/PhyllomeOS/wiki.git synced 2024-11-06 04:01:11 +00:00
Code Issues Packages Projects Releases Wiki Activity
a3bcedb643
wiki/gofurther/encrypt.md

416 lines
11 KiB
Markdown
Raw Blame History

---
title: Encrypt the directory that contains virtual disk images
description:
published: true
date: 2022-01-31T13:20:57.143Z
tags:
editor: markdown
dateCreated: 2022-01-31T12:30:06.985Z
---
# Encrypt virtual disk images
> *Integration of filesystem-level encryption in Phyllome OS is a work-in-progress.*
{.is-warning}
> *Go to [the security page](https://wiki.phyllo.me/e/en/phyllomeos/security) to learn more about Phyllome OS security*
{.is-info}
## Introduction
This guide will show you how to compile [^1] and configure `fscrypt` to encrypt virtual disk images. It will also show you how to configure [PAM](http://www.linux-pam.org/) to work alongside `fscrypt`
[^1]: *As of now, `fscrypt` does not ship as an RPM package*
> *[`fscrypt`](https://github.com/google/fscrypt) provides filesystem-level encryption and its library [is part](https://www.kernel.org/doc/html/v4.18/filesystems/fscrypt.html) of the Linux kernel. It is widely used by Android-based devices, but only compatible with a handful of filesystems*
{.is-info}
## Installation
### Building from source
* Install dependencies to compile `fscrypt`:
```
sudo dnf install -y git golang pam-devel m4 authselect
```
* Fetch the source code:
```
go get -d github.com/google/fscrypt/...
```
* Move to the installation folder:
```
cd ~/go/pkg/mod/github.com/google/fscrypt\@v0.3.1/
```
> If a new version is released, for instance `v0.3.2`, update the above path accordingly
{.is-info}
* *Run `make install`*
```
sudo make install
```
```
fatal: not a git repository (or any of the parent directories): .git
install -d /usr/local/bin
install bin/fscrypt /usr/local/bin
install -d /usr/local/lib/security
install bin/pam_fscrypt.so /usr/local/lib/security
m4 --define=PAM_INSTALL_PATH=/usr/local/lib/security/pam_fscrypt.so < pam_fscrypt/config > bin/config
install -d /usr/local/share/pam-configs
install bin/config /usr/local/share/pam-configs/fscrypt
install -Dm644 cmd/fscrypt/fscrypt_bash_completion /usr/local/share/bash-completion/completions/fscrypt
```
> *The error message seems innocuous*
{.is-info}
* Move `pam_fscrypt.so` to `/usr/lib64/security/`, where it belongs:
```
sudo mv /usr/local/lib/security/pam_fscrypt.so /usr/lib64/security/pam_fscrypt.so
```
### Setup
* Identify the `root` partition (`/`) using the command line utility `lsblk`:
```
lsblk
```
```
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
zram0 251:0 0 7.8G 0 disk [SWAP]
nvme0n1 252:0 0 50G 0 disk
├─nvme0n1p1 252:1 0 128M 0 part /boot/efi
├─nvme0n1p2 252:2 0 384M 0 part /boot
└─nvme0n1p3 252:3 0 49.5G 0 part /
```
In this case, it is `nvme0n1p3` but valid value may be `sda3` or `vda3` or `system-root` for LVM-based systems
* Activate `tune2fs` by providing the absolute path to the root partition:
```
sudo tune2fs -O encrypt /dev/nvme0n1p3
tune2fs 1.45.6 (20-Mar-2020)
```
* Verify proper activation:
```
sudo zgrep -h ENCRYPTION /boot/config-$(uname -r) | sort | uniq
CONFIG_BLK_INLINE_ENCRYPTION=y
CONFIG_BLK_INLINE_ENCRYPTION_FALLBACK=y
CONFIG_FS_ENCRYPTION_ALGS=y
CONFIG_FS_ENCRYPTION_INLINE_CRYPT=y
CONFIG_FS_ENCRYPTION=y
```
* setup `fscrypt`:
```
sudo fscrypt setup
```
```
Defaulting to policy_version 2 because kernel supports it.
Customizing passphrase hashing difficulty for this system...
Created global config file at "/etc/fscrypt.conf".
Metadata directories created at "/.fscrypt".
```
* Verify fscrypt status:
```
fscrypt status
```
```
filesystems supporting encryption: 1
filesystems with fscrypt metadata: 1
MOUNTPOINT DEVICE FILESYSTEM ENCRYPTION FSCRYPT
/ /dev/nvme0n1p3 ext4 supported Yes
/boot /dev/nvme0n1p2 ext4 not enabled No
```
### PAM configuration
* Select the minimal profile with `authselect`:
```
sudo authselect select minimal --force
```
* Activate the `ecryptfs` feature:
```
sudo authselect enable-feature with-ecryptfs
```
* Create a new profile based on the minimal profile and call it *phyllome*:
```
sudo authselect create-profile phyllome --base-on=minimal
```
```
New profile was created at /etc/authselect/custom/phyllome
```
* Select the newly create profile:
```
sudo authselect select custom/phyllome --force
```
```
Backup stored at /var/lib/authselect/backups/2021-07-15-20-08-13.4Czqor
Profile "custom/phyllome" was selected.
The following nsswitch maps are overwritten by the profile:
- aliases
- automount
- ethers
- group
- hosts
- initgroups
- netgroup
- networks
- passwd
- protocols
- publickey
- rpc
- services
- shadow
```
* Modify the content of the *system-auth* file:
```
sudo nano /etc/authselect/custom/phyllome/system-auth
```
```
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth required pam_faillock.so preauth silent >
auth sufficient pam_unix.so {if not "without-nullok">
auth required pam_faillock.so authfail >
auth required pam_deny.so
auth optional pam_fscrypt.so
account required pam_access.so >
account required pam_faillock.so >
account required pam_unix.so
password requisite pam_pwquality.so
password sufficient pam_unix.so yescrypt shadow {if not >
password required pam_deny.so
password optional pam_fscrypt.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session optional pam_fscrypt.so
-session optional pam_systemd.so
session optional pam_oddjob_mkhomedir.so >
session [success=1 default=ignore] pam_succeed_if.so service in crond q>
session required pam_unix.so
```
> *According to [fscrypt documentation](https://github.com/google/fscrypt#enabling-the-pam-module-on-other-linux-distros): "The Auth and Session functionality of `pam_fscrypt.so` are used to automatically unlock directories when logging in as a user, and lock them when logging out [and] [t]he Password functionality [...] is used to automatically rewrap a user's login protector when their unix passphrase changes."*
{.is-info}
* Copy the content of *system-auth* file to the *password-auth* file.
> *Unsure which file is the canonic one*
{.is-info}
`sudo cp system-auth password-auth`
* Modify the *postlogin* file as well to match the following content
```
auth optional pam_fscrypt.so debug
password optional pam_fscrypt.so debug
session optional pam_umask.so silent
session [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet
session [default=1] pam_lastlog.so nowtmp {if "with-silent-lastlog":silent>
session optional pam_lastlog.so silent noupdate showfailed
```
* Create the fscrypt file under the `/etc/pam.d/` directory and add the following line to it to allow PAM to be able to check the UNIX passphrase:
```
sudo nano /etc/pam.d/fscrypt
```
```
auth required pam_unix.so
```
* Finally, apply changes to phyllome profile:
```
sudo authselect apply-changes
```
```
Changes were successfully applied.
```
### Tame SELinux
> *This is a work in progress. New policices will have to be designed for SELinux to work nicely with `fscrypt`.*
{.is-warning}
* Create a directory to store user-created SELinux policies and move there:
```
sudo mkdir /opt/selinux && cd /opt/selinux/
```
* Allow `systemd` to access 1000.count file:
```
sudo ausearch -c '(systemd)' --raw | audit2allow -M my-systemd
```
```
sudo semodule -X 300 -i my-systemd.pp
```
### Test
* Create a directory called `secret` in your home directory:
```
mkdir ~/secret
```
* Encrypt the directory using your login passphrase:
```
fscrypt encrypt ~/secret --source=pam_passphrase
```
```
IMPORTANT: Before continuing, ensure you have properly set up your system for
login protectors. See
https://github.com/google/fscrypt#setting-up-for-login-protectors
Enter login passphrase for test:
"/home/groot/secret" is now encrypted, unlocked, and ready for use.
```
* Add a file to this directory:
```
touch ~/secret/recipe-for-pancakes-by-john-locke
```
* Reboot and make sure the file can be red after login:
```
cat ~/secret/recipe-for-pancakes-by-john-locke
```
```
Pancakes
* Take sweet cream 3/4 + pint.
* Flower a quarter of a pound.
* Eggs 7 leave out of 4 of the whites.
* Beat the Eggs very well.
* Then put in the flower, beat it a quarter of an hower.
* Then put in six spoonfulls of the Cream, beat it a litle Take new sweet butter half a pound. * Melt it to oyle, & take off the skum, power in all the clear by degrees beating it all the time.
* Then put in the rest of your cream. beat it well.
* Half a grated nutmeg & litle orangeflower water. Frie it without butter.
This is the right way
```
> *If a message like `key unavailable` appears, have a look a the [troubleshooting section](/gofurther/encrypt#troubleshooting) bellow*.
{.is-info}
## Encrypt virtual disks
* Encrypt default directory containing virtual disks for the current user:
```
fscrypt encrypt ~/.local/share/libvirt/images --source=pam_passphrase
```
> *`fscrypt` does **not** support in-place encryption. Only previously empty directories can be encrypted. If you wish to encrypt a directory which already contains files, move these files outside of the directory, encrypt it, and put the files back in*
{.is-warning}
* Ok, that's it, finally. All virtual disks created will benefit from this layer of encryption.
## Resources
### Troubleshooting
* You can use the following command to check for entries related to fscrypt in your log
```
journalctl -b | grep fscrypt
```
* If directories encrypted with `fscrypt` won't unlock, you could try to set SELinux in permissive mode and check error messages using the `setroubleshoot` software:
```
sudo nano /etc/selinux/config
```
```
SELINUX=permissive
```
Then reboot.
### Paths
* Where *authselect* stores its default and vendor-specific configs:
```
/usr/share/authselect/
```
* Where PAM modules are stored:
```
/usr/lib64/security/
```
* Where *authselect* stores the current profile
```
/etc/authselect
```
* Documentation on developing PAM modules
```
/usr/share/doc/pam-devel
```
* Default directories fscrypt:
```
/usr/local/share/pam-configs/fscrypt
/etc/fscrypt.conf
~/.fscrypt
```
### External Resources
* `fscrypt` [official repo](https://github.com/google/fscrypt)
* [PAM and Fedora](https://docs.fedoraproject.org/en-US/Fedora/17/html/Security_Guide/sect-Security_Guide-Pluggable_Authenticati1542858)
* [fscrypt](https://wiki.archlinux.org/title/Fscrypt) and Archlinux
---
*[**Go to parent page**](/gofurther/)*
Reference in New Issue View Git Blame Copy Permalink