Booting a GELI encrypted hard disk
Pawel Jakub Dawidek
pjd at FreeBSD.org
Mon Oct 22 12:54:25 PDT 2007
On Wed, Oct 10, 2007 at 07:53:49PM +0200, Roland Smith wrote:
> On Wed, Oct 10, 2007 at 09:04:34AM -0400, Steve Bertrand wrote:
> > Hi all,
> >
> > I am voraciously attempting to get a FreeBSD system to boot from a GELI
> > encrypted hard disk, but am having problems.
>
> You don't need to encrypt the whole harddisk. You can encrypt separate
> slices. There is no need to encrypt stuff like / or /usr; what is there
> that needs to be kept secret?
Maybe not encryption, but integrity protection is very important for
laptops. GELI supports integrity protection for a while now. If you
don't protect integrity of your entire laptop disk, it is trivial to
trojan userland utilities and/or kernel and steal your password. If
someone needs your data, he can dump encrypted partition, trojan your
system and once you connect to the internet and attach your encrypted
partition, the trojan will send the password to the attacker. Many
people often leave their laptops in hotels rooms, for example.
--
Pawel Jakub Dawidek http://www.wheel.pl
pjd at FreeBSD.org http://www.FreeBSD.org
FreeBSD committer Am I Evil? Yes, I Am!
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20071022/5c4b0774/attachment.pgp
More information about the freebsd-questions
mailing list