29

The Raspberry is all well and nice and can run pretty quick. But how can I protect my SD card from offline data attacks. SSH can be protected with a good password or a SSH key but if somebody gets hold of the card I would like it to be encrypted in the most part.

For example all my source php files or any other source code is stored on the SD card and can be easily mounted into another linux system. But i want to prevent this by encryption the entire SD card somehow.

Any suggestions?

Improve this question
9
  • 1
    Which OS are you using, or would you like an answer for each OS to help you decide between them?
    – Mark Booth
    Aug 14, 2012 at 16:33
  • 2
    The guide suggest to use AES- Possibly the default is changed now but do not use AES- It is easily cracked.
    – Piotr Kula
    Aug 14, 2012 at 18:13
  • 1
    You've need to leave /boot decrypted and input a password to mount the root filesystem I suspect.
    – Alex Chamberlain
    Aug 15, 2012 at 8:26
  • 1
    LOL - So much for DRM hahaha :-) I think some more complex system will be needed to create one time use keys from an internet sercive possibly? BUt that means you need to boot the kernel- make a key getter script and possibly mount an encrypted partition based on that somehow. You know like WoW DRM- No net, no play.
    – Piotr Kula
    Aug 15, 2012 at 14:32
  • 1
    Then you could just netboot it. Unless they steal your bootserver, they can't do offline attack :)
    – XTL
    Aug 22, 2012 at 7:14

2 Answers 2

Reset to default
14

You could encrypt the whole disk, pv, or volume using LUKS/dm-crypt if your distribution supports it. It's also possible to encrypt files or directories on the disk while leaving the filesystem mountable (but scrambled).

Either way, you'll run into an issue: Before using the clear data, someone has to input the key. If the key is stored on the card, nothing prevents an attacker reading the key from a stolen card. If it's input by a person, that person needs to manually enter the key after every boot.

Improve this answer
4
  • 2
    Can they decrypt data using the key in offline mode?(i suspect the answer is yes) Is there any way to lock a Kernel to a MAC address, CPUID or some something HW specific?
    – WillyWonka
    Aug 15, 2012 at 8:01
  • 1
    Normally, yes. It doesn't matter if it's your program decrypting or theirs if they have the key. You might be able to use a HW id to generate the key. That won't help if the attacker has access to the whole board but might save you if someone just took or cloned the card.
    – XTL
    Aug 15, 2012 at 8:48
  • Yea I am not worried about them booting it. They still cannot get Shell access (unless there is a Linux work around to get root???) Most likley they will try and take the SD card and get the source files to see all the secret things on another computer or something :)
    – WillyWonka
    Aug 15, 2012 at 13:23
  • 2
    If physical access is available, everybody can easily get shell access. You could search for single-user mode. Here is an Example for the Pi. The boot partition is not encrypted!
    – macrojames
    Aug 16, 2012 at 11:29
8

how about this for a start

sudo apt-get install ecryptfs-utils
sudo apt-get install lsof
sudo ecryptfs-migrate-home -u pi

There will be a bit more to it but thats the main part - it will only cover your home folder. If you want to do more then its something like:

https://www.howtoforge.com/how-to-encrypt-directories-partitions-with-ecryptfs-on-debian-squeeze

Improve this answer
2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.