Christian Meseberg [28.01.2013 18:11]:

Hallo zusammen,

ich habe jetzt nach einer notwen digen Neuinstallation von OS 12.2 auf unverschlüsseltes Rottverzeichnis umgestellt. Da ich das gesamte Homeverzeichnis mit mehreren Useren in einer verschlüssleten Partitition habe, muss m.E. die Entschlüsselung jetzt vor dem Login erfolgen. Entschlüsselung mittels pam-mount geht nicht, oder?

Könnte gehen... In der manpage zu pam_mount steht ===schnipp=== Encrypted disks pam_mount supports a few types of crypto. The most common are encfs, dm-crypt and dm-crypt+LUKS. ===schnapp=== Weiter in einer alten pam_mount.xml: ===schnipp=== <!-- Linux encrypted home directory examples, using dm_crypt: crypt mounts require a kernel with CONFIG_BLK_DEV_DM and CONFIG_DM_CRYPT enabled as well as all the used ciphers (e.g. CONFIG_CRYPTO_AES_586, CONFIG_CRYPTO_TWOFISH, etc.). crypt mounts must be in the global config file /etc/security/pam_mount.conf.xml. Linux encrypted home directory examples, using dm_crypt: <volume fstype="crypt" path="/dev/sda2" mountpoint="/home/user" options="cipher=aes" fskeycipher="aes-256-ecb" fskeypath="/home/user.key" /> cryptoloop mounts require a kernel with CONFIG_BLK_DEV_CRYPTOLOOP enabled. cryptoloop mounts must be in the global config /etc/security/pam_mount.conf.xml. Linux encrypted home directory examples, using cryptoloop: <volume path="/dev/hda123" mountpoint="/home/user" options="loop,encryption=aes" /> <volume path="/home/user.img" mountpoint="/home/user" options="loop,user,exec,encryption=aes,keybits=256" /> <volume path="/home/user.img" /> <volume path="/home/user.img" fskeycipher="aes-256-ecb" fskeypath="/home/user4.key" /> The last two examples (^^) need a line like the following in /etc/fstab: /home/user4.img /home/user4 xfs user,loop,encryption=aes,keybits=256,noauto 0 0 OpenBSD encrypted home directory example (see also lclmount above): <volume path="/home/user.img" mountpoint="/home/user" options="svnd0" /> Volatile tmpfs mount with restricted size (thanks to Mike Hommey for this example): <volume user="test" fstype="tmpfs" path="none" mountpoint="/home/test" options="size=10M,uid=test,gid=users,mode=0700" /> See http://www.tldp.org/HOWTO/Loopback-Encrypted-Filesystem-HOWTO.html to learn how to create a encrypted loopback filesystem. If the volume's password is different than the user's login password, the following technique may be used (see also README): {...} are placeholders, insert the proper value there! 1. Create a file containing the volume's password (FS key). If you are using pam_mount to mount an loopback encrypted volume, this password should be generated with /dev/urandom. Simple example: echo {volume password} | openssl enc -aes-256-ecb >/home/user.key Encrypt this file using the user's login password as the key. Verbose loopback encrypted volume example: a. dd if=/dev/urandom of=/home/user.img bs=1M count={image size in MB} b. dd if=/dev/urandom bs=1c count={keysize/8} | \ openssl enc -{fs key cipher} >/home/user.key Encrypt this file using the user's login password as the key. c. modprobe -q cryptoloop d. openssl enc -d -{fs key cipher} -in /home/user.key | \ losetup -e aes -k {keysize} -p0 /dev/loop0 /home/user.img e. mkfs -t ext2 /dev/loop0 f. losetup -d /dev/loop0 3. In pam_mount.conf.xml: a. Set the fs key cipher variable to the cipher used (ie: aes-256-ecb). b. Set the fs key path variable to the key's path (ie: /home/user.key) 4. If a user changes his login password, regenerate the efsk that was created in step 1b. A script named passwdehd is provided to do this. If FSKEYCIPHER is empty, then the user's login password is also the volume's password. --> ===schnapp=== HTH Werner -- -- Um die Liste abzubestellen, schicken Sie eine Mail an: opensuse-de+unsubscribe@opensuse.org Um den Listen Administrator zu erreichen, schicken Sie eine Mail an: opensuse-de+owner@opensuse.org