[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-users] use of encrypted filesystem



Thanks for the response and detailed explanation.

No problem!

I checked in the kernel and i have the dm-crypt compiled as a module. I can
load the module using modprobe dm-crypt and it shows up in lsmod.

Cool.

Now when i try to use losetup again, here is what i get

losetup -e dm-crypt /dev/loop0 /dev/sda2
Password:
ioctl: LOOP_SET_STATUS: Invalid argument

That's ok - dm-crypt isn't a drop in replacement for crypto loop, so this command isn't needed. dm-crypt uses the device mapper framework.

This page seems to have some useful details on dm-crypt, although I'm not sure how current it is: http://www.saout.de/misc/dm-crypt/

Take a look at your distro packages, see if you can find something called "cryptsetup" and see if that does what you want. I've not used dm-crypt, so I don't know if there is any better tool for the job. Please exercise caution until you know it does what you want!

If you still have problems, please let us know and we can try to figure something else out...

Cheers,
Mark

The error "Invalid argument"  is what is causing the problem and i can't
seem to find why its doing so.

Here is the list of modules loaded

lsmod

Module                  Size  Used by
dm_crypt               14480  0
des                    20992  0
aes                    31808  0
twofish                43136  0
ipv6                  260096  14
binfmt_misc            13708  1
dm_mod                 53328  1 dm_crypt
ide_generic             5504  0 [permanent]
aacraid                58880  0
ext3                  122256  1
jbd                    58664  1 ext3
raid1                  22400  0
ide_disk               17280  0
ata_piix               14852  0
libata                 61720  1 ata_piix
sd_mod                 19712  0
scsi_mod              140816  3 aacraid,libata,sd_mod

I am sure there would be some stupid mistake because of which this is not
working.

I will appreciate if you can help me sort this.

On 28 Dec 2006 02:17:13 +0000, M.A. Williamson <maw48@xxxxxxxxx> wrote:


You should be able to use cryptoloop or dm-crypt. The latter device-mapper based solution is the recommended alternative these days. These both give you an encrypted block device on which to run your filesystem.

eCryptfs isn't available in the XenLinux we currently have. However, it's being merged into future releases of the mainline kernel, so it'll filter down to XenLinux at some stage. eCryptfs allows you to encrypt files on an individual basis, so is rather different to use than the above solutions - it may be more or less useful, depending on your objectives.

anyhow, we'll talk about cryptoloop and dm-crypt for now, since these are
the ones that are going to be most straightforward to use.

>I also found about cryptoloop, however when i try to use it inside domU,
it
>gives me an error
>
>losetup -e cryptoloop /dev/loop0 /dev/sda2
>Password:
>ioctl: LOOP_SET_STATUS: Invalid argument
>
>I also tried various combinations
>
>losetup -e des /dev/loop0 /dev/sda2
>losetup -e aes128 /dev/loop0 /dev/sda2
>losetup -e aes-256 /dev/loop0 /dev/sda2
>
>However all the above result in the same error.
>
>How should i setup the encrypted fs ? Any help would be appreciated.

You don't need to patch your XenLinux kernel if you want to use Cryptoloop or dm-crypt. However, you'll need to recompile it.

Reconfigure your kernel to include support for cryptoloop (you can find
this in make menuconfig under the menu: Device Drivers / Block devices /
Loopback device support / Cryptoloop support) or dm-crypt (you can find
this in make menuconfig under the menu: Device Drivers / Multi Device
Support (RAID and LVM) / Device Mapper Support / Crypt target support).

You might as well enable both then you can play around with them. You may
find that once you've compiled support in, the howtos you were following
will Just Work(TM). You may need to install packages for your distro in
order to use dm-crypt.

Note that cryptoloop does have known security vulnerabilities, which is
why
dm-crypt is now recommended.

If you have any problems, follow up to this e-mail.

Cheers,
Mark






_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users


 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.