Recent searches
Search options
Administered by:
#luks
SantaOS 
@MsDropbear42 Weeeeeeeeell, now i've made time to investigate what ails poor lil ol' ONT, & it seems pretty terminal [boom, tish]. The failure to finish booting occurred after i did a system update after not doing so for several months. OS was #SparkyLinux Testing / semi-rolling. Afaict, whatever caused the damage did a pretty good job:
- the #bootloader had vaporised
- the #LUKS #encryption seems to have been damaged [even booting from a Live usb stick couldn't unlock the drive, my LUKS pswd being rejected despite absolutely certainly being correct]; it accepts my LUKS password during boot, then says "Slot 0 opened", then... just sits there, evermore. Sigh.
I considered trying to repair the bootloader via a #chroot, but even if that succeeded i frankly had little appetite to then do battle with a sulky LUKS. This pc is a very old clunker, spinning rust HDDs only, merely 8 GB RAM, i7 though old model, & i'd repurposed it to be my lounge-room media pc several months ago without bothering to change anything about its extant OS... & tbh Sparky had been wearing a bit thin on me anyway for a coupla months in this role.
So i decided not to bother attempting repairs, & instead make a clean break with an alternative distro that i feel should be just about ideal for this use as a media pc, whose only function is to run a browser, & my VPN app, for my nightly movies & shows streaming. As such, i really just don't wanna be arsed with running updates on it often, & generally mollycoddling it like i do with my real pooter [#ArchLinux #KDE #Plasma]... i just want it to live happily in the darkness of my timber cabinet, asking little of me re upkeep, & just purring away.
Thus, it now has #LinuxMint #LMDE 6. Gotta hand it to ol' Clem & Co; they've done a really nice job with it.
RightToPrivacy & Tech Tips BusKill Tutorial: Self Destructing Laptop Storage
#buskill #encryption #crypto #storage #forensics #antiforensics #HDD #infosec #cybersecurity #datarecovery #luks #encrypted #harddrive #privacy #security #educational
Watch On #Peertube:
Why you should use full-disk encryption
If any of the arguments I make below apply to you, you should use full-disk encryption. I am pretty sure the first argument applies to everyone. The second argument applies at least to everyone in the EU and the US state of California. The third argument applies to everyone again.
You will fail to delete drives properly
Storage media get lost. Most people do not know how to properly delete hard disk content before selling them, or they forget it. In the case of flash drives, or SSDs, standard tools like shred don't work. hdparm may do the trick, but this is not well known. If you are lucky, the manufacturer of you SSH provides a Windows app that lets you delete it securely. Your server does not run on Windows of course.
The law demands it
#GDPR and similar data protection and privacy laws require you to store no #PII (personal data) permanently. You have to anonymize PII or delete it after a few weeks. IP addresses are PII. All servers store IP addresses by default. The GDPR also demands that you use state-of-the-art technology to protect sensitive data. Full disk encryption is the state of the art.
Law enforcement makes "mistakes"
I'm a board member of @Artikel5eV, an organisation that runs relays on the Tor network, including exit relays. Running Tor relays is perfectly legal in Germany. Nevertheless, law enforcement agencies have raided the homes of Artikel 5 e.V. board members twice. Illegally so, as a court confirmed recently. I won't run Tor relays in my home, but there is a good chance that my home will be raided one day unless all police officers and prosecutors decide to obey the law.
There is also a possibility that the rule of law might collapse in your country sooner or later. We are just witnessing it in the USA.
You already mentioned that ordinary thieves can also be a problem.
Encryption is available for free
So what is your case against disk encryption? It is obvious that it alone does not solve all IT security issues, but it is an important building block. #LUKS is reliable free and open-source software for HD encryption. If you are not using Linux, check out #VeraCrypt. The Raspberry Pi 5 comes with hardware acceleration for AES, so there no longer is a noticeable performance penalty for encryption.
@chpietsch I was wondering if enabling #LUKS on a running server has really a benefit. Of course if thieves enter your place, unplug the server and take it the disk is protected. But this scenario is not so usual. Most often the attacker get access to your live server. Once the server is booted and the disk is unlocked, all data on the encrypted volume is accessible to anyone with access to the system. This makes encryption ineffective against attackers who compromise a running server.
Lately I've been doing more #SelfHosting again due to the current situation. Of course, I'm paying particular attention to power consumption and noise. After good experiences with the #ARM64 architecture, even with power-hungry applications such as Mastodon, I'm now using the smartphone technology for my homeservers, too.
There are #SBCs with more open hardware, but the #RaspberryPi is widely available, well documented, powerful and inexpensive. And it is available with up to 16 GB of RAM.
Anyone operating a server on the Internet must install #security updates quickly. However, many people forget to restart running software so that the new version runs instead of the old one. The #needrestart tool helps with this on Debian-based Linux systems, which unfortunately is usually not pre-installed.
On my Raspberry Pi 4, needrestart always runs correctly (automatically after apt upgrade). On my Raspberry Pi 5, however, I first had to create a configuration file as described by the main developer here:
https://github.com/liske/needrestart/blob/master/README.raspberry.md
Previously, the tool always claimed that a reboot was necessary because it thought an outdated Linux kernel was running.
Next, I want to activate #LUKS hard drive encryption on both raspis. Unfortunately, this is not as easy under #Raspbian or #RaspberryPiOS as on other Debian systems. If you have managed this: Please let me know how you did it!
My experience with #FlashDrives recently has been mixed. I have no problem in encrypting them with #LUKS, using #cryptsetup or with formatting a partition with #Btrfs, for instance, using #gparted and doing other tinkering with #Gnome #disks. But the problem has been with the actual drives themselves. The cheaper ones seem to have quite a few bad sectors, etc. and so they’re not really reliable for medium term storage.
1/2
Apparently, you can just resize/grow your #LUKS #crypto partition, as well as the #btrfs filesystem, without rebooting!
Since i continue to #fail to add external storage to the #Steam #Flatpack, i might as well allocate the whole SSD.
The screenshot shows #gparted, automating all the steps. I'm running #KDEneon #Linux. #Gaming
Each time I needed to migrate my data to a new SSD with LVM and LUKS, I struggled a lot, until I figured this out properly. I have documented all necessary steps in this document:
https://gist.github.com/andrewshadura/58098ea35471f2067bf9e5a33aec0c35
Zum ersten Mal war der Verband Angiodysplasie Schweiz beim "Rare Disease Day" im Luzerner Kantonsspital vertreten – und es mit war eine total bereichernde Erfahrung! 
Ein riesiges Dankeschön an ProRaris für die grossartige Organisation dieser besonderen Veranstaltung.
https://angiodysplasie.ch/unser-erster-tag-der-seltenen-krankheiten-in-luzern/
I managed to create an #encrypted #Linux #Filesystem on a #USBStick. The reason I wanted this is that I want to back up some directories, which contain secure information and also #NTFS, the one that comes on most drives, doesn’t know how to handle #SymbolicLinks properly. I don’t need or want to share the stick with any non-Linux machines.
#TIL that whilst having a too-long-running #Linux machine with #LUKS #FDE already unlocked, but where I've /maybe/ forgotten the passphrase (so won't be able to boot it successfully), it's possible to check if I've remembered the passphrase correctly with:
# cryptsetup open --verbose --test-passphrase DEV
Enter passphrase for DEV:
Key slot 0 unlocked.
Command successful.
@agu 1,2kg is a pretty steep target, but feasible unless you want a 15" 4k monster with dedicaded GPU.
- As with toolfree-swappable storage, that is easy to solve too.
I'd recommend to use either #LUKS-encrypted #btrfs or #VeraCrypt-encrypted #ext4 for portable storage...
Mein Backup der wichtigsten Sachen habe ich immer dabei – auf einem USB-Stick am Schlüsselbund. Der ist natürlich verschlüsselt, damit im schlimmsten Fall die Daten nicht in falsche Hände geraten. Hier mal ein sehr einfacher Weg, einen Stick oder eine externe SSD/Festplatte unter #Linux zu verschlüsseln:
In one of your recent stream VODs, @tomlawrence, someone asked, whether they could run #ZFS on #LUKS - i can answer that; YES*, with an *asterisk.
I did this for quite some time, until i've decided that it's rather inconvenient to type in my password on every reboot. Now, i'm running LUKS on ZVOLs, in #Ubuntu / #qemu / #libvirt.
It's a small home server, and i need a few "privacy insensitive" VMs to auto-start after power-fail.
All one needs is a block dev, zpool create, done! 
…technically
I am kinda confused about choosing the #encryption system for use with #zfs should it be ZFS native encryption or shall I put ZFS on top of #LUKS. LUKS seems to be the more 'mature' option and the performance is hardly 10% lesser than native. Does anyone have experience with using ZFS native encryption?
Can you recommend a tutorial about how to install Ubuntu 24.04 with BTRFS and LUKS/TPM2 ?
Ich muss es mal wieder in aller Deutlichkeit sagen:
Ich 
#Linux
Im #Notebook meiner Frau war noch eine relativ kleine #SSD. Seit einem Jahr macht sie mega viele Fotos mit dem #Smartphone und bei der letzten Sicherung auf's Notebook waren nur noch 4 GB frei.
Ich habe das mit #LUKS vollverschlüsselte #Ubuntu kurzerhand mit Linux #Bordmitteln auf eine größere SSD umgezogen:
1. alte SSD mit dd auf neue SSD 1:1 geklont
2. neue SSD ins Notebook eingebaut und Ubuntu gestartet
3. im laufenden System unbenutzten Speicherplatz mit #gparted der verschlüsselten Root-Partition hinzugefügt.
4. im laufenden System das #LVM vergrößert
5. im laufenden System das Dateisystem vergrößert
Fertig.
Effektiver Arbeitsaufwand: 5 min
Man versuche das mal mit #BigTech #Microsoft #Windows. 
#OpenSource #FOSS #digitaleSelbstbestimmung #digitaleSouveränität #Terminal
It's fucking wild to me that Linux Desktop distros don't provide full disk encryption by default.