So far we have mentioned some tools to easily encrypt files. Keeping files encrypted is a good way to protect your data in case someone steals them.

However, if we’re talking about serious encryption, just encrypting files is not enough to keep your data protected. There is no use in having a secured document in your hard disk if the program you use to open it stores some of its contents in /tmp. And that’s not the only risk. Maybe your program keeps passwords always in memory and it does not store them on disk, but what happens if you run out of memory and all of your passwords go to the swap partition? If someone steals your hard disk, she could easily get them with a disk editor.

There are many ways to encrypt entire partitions in Linux, and there are many kinds of partitions that should be encrypted, but swap and /tmp are two important ones and arguably the easiest to set up. Both share a common feature: they store temporary data. Once the computer is turned off, all stored data is no longer important, so it can be discarded.

In this example we’ll use dm-crypt to set up these encrypted partitions. You need to enable CONFIG_DM_CRYPT in your kernel configuration and install the cryptsetup package (if you’re using Debian sarge, it’s highly recommended to install cryptsetup 1.0.x from backports.org).

Once installed, put this in your /etc/crypttab:

cswap    /dev/hda5      /dev/random    swap
ctmp     /dev/hda6      /dev/random    tmp

The first field is the name of the device that will be created (under /dev/mapper) to access the encrypted partition.

The second field is the real partition that will be encrypted.

The third field is the file where the key to encrypt the partition is stored. In this setup, that file is /dev/random so each time the machine boots partitions will be encrypted with a different key chosen randomly. So the data will not be recoverable if you turn off the PC. But that’s what we want, isn’t it? 😉

The fourth field list misc options for cryptsetup. Here, swap will run mkswap on the device and tmp will run mke2fs.

To mount these partitions, your /etc/fstab should contain these lines:

/dev/mapper/cswap    none    swap    sw         0   0
/dev/mapper/ctmp     /tmp    ext2    defaults   0   2

Last but not least, before using this system you should erase the contents of the partitions completely. The recommended way is to fill them with random data (but unmont them first!):

shred -v /dev/hdaX

Now each time you boot your machine you will have your partitions encrypted. That’s all folks!