Re: PLiSS cryptofilesystem with SuSE 9.1?

From: Dr. Robert Meier (worsel_at_c112927lin.svinfra.compuware.com)
Date: 08/04/04 

Date: 4 Aug 2004 09:39:38 -0400

In article <1987402.Xcbnlxp4Ds@psypam.com>, Stefan Weinzierl wrote:
> For purpose of saving confidential data, especially passwords, I
> developed a specific system of encrypted partitions and containers.
> (Personal Linux Security-System; PLiSS)

I currently use emacs+crypt++ for small files, like my passwords
wallet.

If emacs is "sticky" (not swapped to disk), then AFAIK, the cleartext
is limited to memory.

For large files used by scripts, I wrapper gpg(1) around their use.
 
> Of course, I unterstand some of the entrys, but for some other I ask you for
> your help. So, but now simply one after the other:
>
>        *OLD*                                   *NEW*           
>
> user_xattr                     user_xattr
>
> *REMARK:* I don't know, what that shall mean. Simply copied. Surely not so
> important.

Allow extended user attributes (e.g. namespace, mime_type, md5sum, ...)
if supported by filesystem. IIRC, this is required by acl. See attr(5)
for details.

>        *OLD*                                   *NEW*           
>
> loop                     loop=/dev/loop0
>
>
> *REMARK:* Apparently SuSE is now binding the particular cryptofilesystems
> statically to a specific loop-device, instead of dynamicly like before.
> ... Was that statical binding of loop-devices already possible in
> former times, or is that a new feature?

AFAIK, this has been available for several years. See mount(8) for details.

>        *ALT*                                   *NEW*           
>
>                     phash=sha512 

I suspect this is the choice of hash (posix hash = SHA-1) (512???) used
for the extended user attributes above.

>        *ALT*                                   *NEW*            
>
>                     itercountk=100 

I suspect this is the count of mounts (or accesses) between hash testing
above.

>        *ALT*                                   *NEW*            
>
> noauto,user                    
>
> *REMARK:* Wonderful! How careful! The people of SuSE are apparently of the
> opinion that only root should mount a cryptofilesystem, and impose their
> point of view on everybody, who don't shares their convictions.

Actually, SuSE's default is deliberately conservative. If you don't
like their default, change it on your system.

Personally, I praise SuSE for their efforts to set their default
configuration to conservative safe settings. The user is free to
open access the user selects on their system as they learn the
risks and benefits. I've found the documentation that appears
in the sysadmin's mail upon installation, to be very useful in
openning up access in this regard.

Hopefully helpful, 

-- 
Dr. Robert J. Meier
Quantcast