[lkml]   [2004]   [Feb]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: 2.6.3-mm1
    Am Do, den 19.02.2004 schrieb Brandon Low um 01:33:

    > > To set up a device basically:
    > >
    > > echo 0 `blockdev --getsize /dev/bla` crypt <cipher> <key> 0 /dev/bla 0 |
    > > dmsetup create <newname>
    > >
    > > is enough. And it's just temporary, because no special tool has been
    > > written yet. dmsetup is the most low-level dm tool, mostly for
    > > developers. I've written a shell script named cryptsetup for the
    > > meantime, it asks for a passphrase and does all the magic you need.
    > >
    > > "cryptsetup create test /dev/hda5" will ask for a passphrase and set up
    > > /dev/mapper/test. Voila. "cryptsetup remove test" removes it and
    > > "cryptsetup status test" shows some status information.
    > >
    > What I can't figure out yet is how to do that easily for a loopback...
    > use losetup first, and then cryptsetup? I guess that's ok, just more
    > steps than I would prefer.

    Yes. Block->File and Block->Crypto->Block are two different things and
    should be separated out. But it would be an easy one to make cryptsetup
    also call losetup if your specified backend happens to be a file. Like
    mount -o loop does. The only thing I'm not sure about: How would it know
    when to remove the loop device on "cryptsetup remove" and when now.
    mount stores it in the mtab.

    I've got some free time, I think I'm going to rewrite cryptsetup as a
    small C program today.

    > I was under the mistaken impression that I would need lvmtools as well
    > in order to use dmcrypt... cool.

    Yes, there's some FUD going around...

    > > There are some plans to write a unified plugin based key management
    > > tool. You might want to have your key stored on a USB stick. Or
    > > encrypted in the first sector of your device and you want to unlock it
    > > using a password (so you can change your password without needing to
    > > reencrypt your data). This would be much more flexible than most of the
    > > crap floating around.
    > That sounds very cool, saw mention of putting it in the first part of
    > the device elsethread.

    Yes, for example.

    > Ok ok, I'll quit panicking... this just makes it hard to decide which to
    > use now as I'm preparing to deploy soon... If I use cryptoloop, it is
    > now guaranteed to be obsolete soon, but if I use dmcrypt, it is more
    > work right now, but more forward looking...
    > Can you point me to some useful readings related to dmcrypt,
    > devicemapper for loopback, etc.? Thanks!

    For dm-crypt I've set up a small page:

    For device-mapper and loopback there's nothing. The loop device provides
    block devices, device-mapper can use them. Nothing special here.

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 14:01    [W:0.024 / U:4.596 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site