Attachment 592226 Details for Bug 832531 – Patch removing dd and adding scrub as a solution.

[patch] Patch removing dd and adding scrub as a solution.

LUKSDiskEncryption.xml.patch (text/plain), 2.50 KB, created by eric on 2012-06-15 20:32:07 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: eric

Created: 2012-06-15 20:32:07 UTC

Size: 2.50 KB

patch

obsolete

>--- LUKSDiskEncryption.xml.old	2012-06-15 15:59:59.144944846 -0400
>+++ LUKSDiskEncryption.xml	2012-06-15 16:28:03.790881106 -0400
>@@ -51,6 +51,12 @@
> 	Following this procedure will remove all data on the partition that you are encrypting.  You WILL lose all your information!  Make sure you backup your data to an external source before beginning this procedure!
> 	</para>
>       </warning>
>+      <note>
>+       <title>Note</title>
>+       <para>
>+       This procedure uses <package>scrub</package> to destory the existing data on the partition and provide a random base for LUKS to use.  This random base is important to prevent certain attacks against the cryptography.  <package>Scrub</package> is not installed by default and you will have to install it before use.  Alternatively you may use another random number generator to accomplish the same thing.
>+       </para>
>+      </note>
>       <para>
> 	If you are running a version of Fedora prior to Fedora 9 and want to encrypt a partition, or you want to encrypt a partition after the installation of the current version of Fedora, the following directions are for you.  The below example demonstrates encrypting your /home partition but any partition can be used.
>       </para>
>@@ -67,30 +73,24 @@
> 	</para>
>       </listitem>
>       <listitem>
>-	<para>
>-	  unmount your existing /home: <code> umount /home</code>
>-	</para>
>+        <para>
>+          Fill your partition with random data: <code>scrub -p random /home</code>  
>+        </para>
>       </listitem>
>       <listitem>
> 	<para>
>-	  if it fails use <code>fuser</code> to find and kill processes hogging /home: <code>fuser -mvk /home</code>
>+	  unmount your existing /home: <code> umount /home</code>
> 	</para>
>       </listitem>
>       <listitem>
> 	<para>
>-	  verify /home is not mounted any longer: <code>cat /proc/mounts | grep home</code>
>+	  if it fails use <code>fuser</code> to find and kill processes hogging /home: <code>fuser -mvk /home</code>
> 	</para>
>       </listitem>
>       <listitem>
>-	<para>
>-	  Fill your partition with random data: <code>dd if=/dev/urandom of=/dev/VG00/LV_home</code>  This process takes many hours to complete.
>-	</para>
>-	<important>
>-	  <title>Important</title>
>-	  <para>
>-	    The process, however, is imperative in order to have good protection against break-in attempts.  Just let it run overnight.
>-	  </para>
>-	</important>
>+        <para>
>+          verify /home is not mounted any longer: <code>cat /proc/mounts | grep home</code>
>+        </para>
>       </listitem>
>       <listitem>
> 	<para>

Actions: View | Diff

Attachments on bug 832531: 592185 | 592223 | 592226