Re: [Xen-users] use of encrypted filesystem

["M.A. Williamson" <maw48@xxxxxxxxx>]

> Thanks for the response and detailed explanation.
No problem!

> I checked in the kernel and i have the dm-crypt compiled as a module. I can
> load the module using modprobe dm-crypt and it shows up in lsmod.
Cool.

> Now when i try to use losetup again, here is what i get
>
> losetup -e dm-crypt /dev/loop0 /dev/sda2
> Password:
> ioctl: LOOP_SET_STATUS: Invalid argument
That's ok - dm-crypt isn't a drop in replacement for crypto loop, so this 
command isn't needed. dm-crypt uses the device mapper framework.
This page seems to have some useful details on dm-crypt, although I'm not 
sure how current it is: http://www.saout.de/misc/dm-crypt/
Take a look at your distro packages, see if you can find something called 
"cryptsetup" and see if that does what you want. I've not used dm-crypt, so 
I don't know if there is any better tool for the job. Please exercise 
caution until you know it does what you want!
If you still have problems, please let us know and we can try to figure 
something else out...
Cheers,
Mark

> The error "Invalid argument"  is what is causing the problem and i can't
> seem to find why its doing so.
>
> Here is the list of modules loaded
>
> lsmod
>
> Module                  Size  Used by
> dm_crypt               14480  0
> des                    20992  0
> aes                    31808  0
> twofish                43136  0
> ipv6                  260096  14
> binfmt_misc            13708  1
> dm_mod                 53328  1 dm_crypt
> ide_generic             5504  0 [permanent]
> aacraid                58880  0
> ext3                  122256  1
> jbd                    58664  1 ext3
> raid1                  22400  0
> ide_disk               17280  0
> ata_piix               14852  0
> libata                 61720  1 ata_piix
> sd_mod                 19712  0
> scsi_mod              140816  3 aacraid,libata,sd_mod
>
> I am sure there would be some stupid mistake because of which this is not
> working.
>
> I will appreciate if you can help me sort this.
>
> On 28 Dec 2006 02:17:13 +0000, M.A. Williamson <maw48@xxxxxxxxx> wrote:
> > You should be able to use cryptoloop or dm-crypt. The latter 
> > device-mapper based solution is the recommended alternative these days. 
> > These both give you an encrypted block device on which to run your 
> > filesystem.
> > eCryptfs isn't available in the XenLinux we currently have. However, 
> > it's being merged into future releases of the mainline kernel, so it'll 
> > filter down to XenLinux at some stage. eCryptfs allows you to encrypt 
> > files on an individual basis, so is rather different to use than the 
> > above solutions - it may be more or less useful, depending on your 
> > objectives.
> > anyhow, we'll talk about cryptoloop and dm-crypt for now, since these are
> > the ones that are going to be most straightforward to use.
> >
> > >I also found about cryptoloop, however when i try to use it inside domU,
> > it
> > >gives me an error
> > >
> > >losetup -e cryptoloop /dev/loop0 /dev/sda2
> > >Password:
> > >ioctl: LOOP_SET_STATUS: Invalid argument
> > >
> > >I also tried various combinations
> > >
> > >losetup -e des /dev/loop0 /dev/sda2
> > >losetup -e aes128 /dev/loop0 /dev/sda2
> > >losetup -e aes-256 /dev/loop0 /dev/sda2
> > >
> > >However all the above result in the same error.
> > >
> > >How should i setup the encrypted fs ? Any help would be appreciated.
> >
> > You don't need to patch your XenLinux kernel if you want to use 
> > Cryptoloop or dm-crypt. However, you'll need to recompile it.
> > Reconfigure your kernel to include support for cryptoloop (you can find
> > this in make menuconfig under the menu: Device Drivers / Block devices /
> > Loopback device support / Cryptoloop support) or dm-crypt (you can find
> > this in make menuconfig under the menu: Device Drivers / Multi Device
> > Support (RAID and LVM) / Device Mapper Support / Crypt target support).
> >
> > You might as well enable both then you can play around with them. You may
> > find that once you've compiled support in, the howtos you were following
> > will Just Work(TM). You may need to install packages for your distro in
> > order to use dm-crypt.
> >
> > Note that cryptoloop does have known security vulnerabilities, which is
> > why
> > dm-crypt is now recommended.
> >
> > If you have any problems, follow up to this e-mail.
> >
> > Cheers,
> > Mark
_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users