List readers –
Some time ago, approximately April 2009, I encrypted a Fedora 10 system which I later upgraded to Fedora 11, with no problem. My problem is that I didn’t document how I did it at the time, as I was just playing with disk encryption on a sandbox machine and never thought I would need to do it in production. Recently my place of employment, thanks in part to new HIPAA regulations due to data theft, is requiring ALL laptops to be encrypted – one problem, I don’t remember how I did it without loosing any data. The only thing I can remember is that it was a pretty simple task that I performed without moving data from one partition to another, or re-installing the OS. Googling such a process, has led me to read many pages and documentation out there, but to no avail. I can NOT find anywhere anything documenting encrypting a live filesytem without data loss. Has anyone here done this? I could have sworn that the original work I did was based on an email or discussion on this list, but I cant find anything. Yes yes yes I know – ALWAYS put it in the wiki ☺
I have looked at a number of solutions like truecrypt etc, but nothing seems like it will work without eating data. Though I have heard that cryptsetup will do this.
Any advice or assistance would be GREATLY appreciated.
Michael
===================================
P Please consider the environment before printing this e-mail
Cleveland Clinic is ranked one of the top hospitals in America by U.S. News & World Report (2008). Visit us online at http://www.clevelandclinic.org for a complete listing of our services, staff and locations.
Confidentiality Note: This message is intended for use only by the individual or entity to which it is addressed and may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please contact the sender immediately and destroy the material in its entirety, whether electronic or hard copy. Thank you.
Weiner, Michael on 09/18/2009 12:03 PM wrote:
Recently my place of employment, thanks in part to new HIPAA regulations due to data theft, is requiring ALL laptops to be encrypted
Do you have a link to this new regulation? I also work with HIPAA. I have not heard of this requirement yet.
Thanks, Michael
On Fri, Sep 18, 2009 at 13:03:50 -0400, "Weiner, Michael" weinerm@ccf.org wrote:
List readers –
Some time ago, approximately April 2009, I encrypted a Fedora 10 system which I later upgraded to Fedora 11, with no problem. My problem is that I didn’t document how I did it at the time, as I was just playing with disk encryption on a sandbox machine and never thought I would need to do it in production. Recently my place of employment, thanks in part to new HIPAA regulations due to data theft, is requiring ALL laptops to be encrypted – one problem, I don’t remember how I did it without loosing any data. The only thing I can remember is that it was a pretty simple task that I performed without moving data from one partition to another, or re-installing the OS. Googling such a process, has led me to read many pages and documentation out there, but to no avail. I can NOT find anywhere anything documenting encrypting a live filesytem without data loss. Has anyone here done this? I could have sworn that the original work I did was based on an email or discussion on this l ist, but I cant find anything. Yes yes yes I know – ALWAYS put it in the wiki ☺
I have looked at a number of solutions like truecrypt etc, but nothing seems like it will work without eating data. Though I have heard that cryptsetup will do this.
Any advice or assistance would be GREATLY appreciated.
If you are going to be doing a fresh install it's pretty easy. Do a custom file system layout when running anaconda and check the encryption box for the partitions you want encrypted. You can encrypt all partitions except the one /boot is on (usually its own partition).
It all works pretty neat.
Weiner, Michael on 09/18/2009 12:03 PM wrote:
Has anyone here done this?
You can only use a FUSE-like encryption method on a live system. If you want to use dm-crypt/LUKS you have to reformat.
eCryptFS is one such option. You create a "Private" directory in your home and anything stored in there is encrypted.
On Fri, Sep 18, 2009 at 1:17 PM, Michael Cronenworth mike@cchtml.comwrote:
Weiner, Michael on 09/18/2009 12:03 PM wrote:
Recently my place of employment, thanks in part to new HIPAA regulations
due to data theft, is requiring ALL laptops to be encrypted
Do you have a link to this new regulation? I also work with HIPAA. I have not heard of this requirement yet.
Michael -
Unfortunately our IT department just made that blanket statement in an email a few weeks ago. Stating that in order to maintain compliance with HIPAA requirements we were going to be instituting encryption on all clinic laptops to protect the data in case of theft. No specific regulation or register cited, which would be a help. On the windows side, its as easy as deploying a product like Sophos' SafeGuard Easy or truecrypt. On Mac, its as easy as using FileVault, but on linux, with a live system, i am stuck looking for a solution. Now i did this on a live F10 box, but for the life of me i cant remember how. The box has cryptsetup installed, the correct ciphers, dm-*, all the stuff thats required. I hate getting OLD, LOL.
If i find out anything specific on the regulation, i will forward it along.
Thanks :) Michael
Weiner, Michael schrieb:
Some time ago, approximately April 2009, I encrypted a Fedora 10 system which I later upgraded to Fedora 11, with no problem. My problem is that I didn’t document how I did it at the time, as I was just playing with disk encryption on a sandbox machine and never thought I would need to do it in production. Recently my place of employment, thanks in part to new HIPAA regulations due to data theft, is requiring ALL laptops to be encrypted – one problem, I don’t remember how I did it without loosing any data. The only thing I can remember is that it was a pretty simple task that I performed without moving data from one partition to another, or re-installing the OS. Googling such a process, has led me to read many pages and documentation out there, but to no avail. I can NOT find anywhere anything documenting encrypting a live filesytem without data loss. Has anyone here done this? I could have sworn that the original work I did was based on an email or discussion on this
l
ist, but I cant find anything. Yes yes yes I know – ALWAYS put it in the wiki ☺
Somewhere on the cryptsetup page there was a hint how to reencrypt a partition withhout reformatting. Basically you use dd to read from the plain device and write to the same device through the encryption layer.
Something like this: # cryptsetup create encrypted /dev/sdx1 # dd if=/dev/sdx1 of=/dev/mapper/encrypted bs=10M
I would not try it without a full backup and all fingers crossed...
On Fri, Sep 18, 2009 at 12:19:46PM -0500, Michael Cronenworth wrote:
Weiner, Michael on 09/18/2009 12:03 PM wrote:
Has anyone here done this?
You can only use a FUSE-like encryption method on a live system. If you want to use dm-crypt/LUKS you have to reformat.
eCryptFS is one such option. You create a "Private" directory in your home and anything stored in there is encrypted.
Get a backup disk, one that can be locked up, make a backup in a way that you understand and can verify and then reinstall the laptop fully encrypted. Then move the data from the backup onto the now encrypted laptop.
There is a move afoot that if the laptop/ disk is full and well encrypted then the organization might be exempt from reporting in a public way the loss of a disk or laptop. Also with a "well encrypted" policy some related liability issues might look better to those that have to insure the company.
Once the laptop is fully tested make an encrypted backup. If you have a super special certified safe in your office you may be able to keep the backup in it and skip the encrypted backup but I would not, backup disks have legs.
In the context of a move to encryption the company does need a key repository policy. They can make the decision that nothing on a laptop is important, the policy should map to backup strategies but that is another policy tangle.
A private directory or FUSE-like method does not "guarantee" that you did not leave a copy of the sensitive data on another part of the system, so encrypt the full disk. It does however make sense if you have "personal" data on the laptop. An encrypted virtual file system for family photos, personal mp3's whatever gives you a way to draw a line at some time in the future when the laptop reverts to to the company. You may not be in a position to get it back but "they" are not in a position to look and leer at photos of your wife and family, health insurance claims or electronic pay stubs (think some random IT numnuts or contractor).
If this involves converting multiple laptops look at something faster than USB or multiple backup boxes.
-
Adalbert Prokop -
Bruno Wolff III -
Michael Cronenworth -
Michael Weiner -
Nifty Fedora Mitch -
Weiner, Michael