From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mike Gerwitz Subject: Re: Encrypted root partition Date: Wed, 18 Jan 2017 23:08:22 -0500 Message-ID: <87d1fjd749.fsf@gnu.org> References: <87vavd3k1t.fsf@gnu.org> <87a8cp4bqk.fsf@gmail.com> <877f7swllv.fsf@gnu.org> <87pojkitaf.fsf@gmail.com> <87eg00k372.fsf@gmail.com> Mime-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:47623) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cU42G-0001To-58 for guix-devel@gnu.org; Wed, 18 Jan 2017 23:09:17 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cU42F-0005xp-5b for guix-devel@gnu.org; Wed, 18 Jan 2017 23:09:16 -0500 List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Chris Marusich Cc: guix-devel@gnu.org --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Wed, Jan 18, 2017 at 03:38:57 -0800, Chris Marusich wrote: > As a bonus, I realized that one could use this feature to encrypt swap, > also. You can encrypt your swap area by using a swap file in the root > file system. Specifically, if you do something like this... Using an ephemeral key for swap (that is: a temporary key that is randomly generated and never stored) is preferred: when you unmount it, the data won't be recoverable. Mounting a normal swapfile, on the other hand, writes swapped memory to disk, which opens a host of potential security and forensic issues. Of course, so does traditional swap. :) I'm not familiar enough with Guix (yet!) to know how to set it up, but I also haven't done any research. Arch has a good summary: https://wiki.archlinux.org/index.php/Dm-crypt/Swap_encryption =2D-=20 Mike Gerwitz Free Software Hacker+Activist | GNU Maintainer & Volunteer GPG: D6E9 B930 028A 6C38 F43B 2388 FEF6 3574 5E6F 6D05 Old: 2217 5B02 E626 BC98 D7C0 C2E5 F22B B815 8EE3 0EAB https://mikegerwitz.com --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCgAGBQJYgDu3AAoJEIyRe39dxRuiBOIP/Rpv4vG/9iAzDtiJLvvrEQeI qKI0OlzYHTLQaWmkH507Z4KY7Oj5XUZK0ymhFODBc0Ahc8sSeeQAMR566YmQ2bst 3yZQNM90qwNlnWMP3EwFAbGAlbxNoyKOqTgN9YkzTopG5yesxUKw7F7zDXnxpN93 9Z2zCTP26/82p1FH77Io4033ZTERIVznATjc+DuOHKRD0ZIWbOVkDqYffz8fvDLD CxEYkfyxuuXQgwi3MQBzB8yYU6++0bovpE+ZAjbhHvOrV87d+tpOTerlX8kI/bcq XJ2PQi9x8YLM0IDgmgmUSiFcBLZrmYTfQm0mP3U/959/1kCFzeDBVNGYJIM7yhz6 WSWRtAUSJD8+ajg+0zT94ZnE7oPvt24AavsiwXGVaCpmGr31xKs2I8xrai84U1Sb gMwZe5Q3/tqu+L39luiqTpgjmBgOxDaDVC0RhvhsB/Soizbpu2+GtimIuO5Nov8l DLGu+uSUBFOw0FoyFO4J1UgZ+bn+0r1leAEgB+4sUvOR3z1MYviaFtWooSA6K/Sl +Cyh/NPF0hTyOZ5y85TT4ZEnc9WGoA/CqAHplf0cotG5R3s2u2JpbJ/YqX5ifUas IzHrPh/OnWw/rGGv3JOA1EWs/tzu017lQ7oE2TlOL9dNc6e3ptqwCB5CeiHVZcWO DrmRzMg2O3p9QCaBgvpW =3pVx -----END PGP SIGNATURE----- --=-=-=--