Tag Info

New answers tagged

0

Typically for folks using ZoL that want encryption, encryptfs isn't desireable because you lose both performance and fuctionality. ZFS works best when it is the filesystem, not when you layer others on top of it (again, you can, but it's suboptimal). This is what encryptfs does (layers an encrypted filesystem on top of ZFS), and exactly why you see so much ...


1

You use geli setkey. To change from an existing key + phrase to a new key + phrase, you need to specify both the old and the new pair, like so: $ geli setkey -v -k /boot/old.key -K /boot/new.key /dev/md9 Enter passphrase: oldphrase Enter new passphrase: newphrase Reenter new passphrase: newphrase Decrypted Master Key 0. Note, that the master key encrypted ...


3

The easiest way to do what you want it probably to make use of the Encrypted File Sharing option present for EFS-encrypted files. You can enable EFS file sharing in an encrypted file’s advanced properties, which you can access from the Advanced button on the General tab of a file’s properties. Before you can share an encrypted file, the file must ...


2

No, ZFS on Linux doesn't support native encryption. Another option is encryptfs, but at this juncture, you're not going to find a native solution.


0

No not really. Most encryption devices will slow down things like DB and fileserver backups to a crawl. Private line is reasonably secure and most people do not encrypt over it. The only people that can reliably intercept data over private line or cloudy line are ominous three letter government agencies. Everyone else gets in via your DMZ or tricks your ...


2

Freebsd has a kernel module, pefs, that can perform filesystem (directory) encryption. http://www.bsdnow.tv/tutorials/pefs has a tutorial on encrypting a user's home directory and tying that to PAM at login.


1

I had the same problem and finally solved The problem seems to be in update-initramfs that doesn't generate the initrd properly. "evms_activate not found" means that the /sbin/evms_activate file is not created inside the initrd file by update-initramfs So, my workaround consists in unpacking the not working initrd, and copy the evms_activate executable ...


4

Really, this is a non-issue. Copy the data on media of appropriate size, if ncessary encrypted, make a checksum, package it appropriately (depending on the media used, e.g. an optical disc doesn't need ESD shielding), ship it, decrypt and restore it, check with the checksum and you are done. If the checksum fails, rinse and repeat, with better packaging ...


8

Any network segment that you don't fully control can be considered as a public network, so if you would encrypt traffic over a regular public network, do it for your case as well. NB: With full control I mean that you have full and sole control over any network devices that are part of the connection, so a port on e.g. a router or switch you don't own ...


0

I simply use a bash script like this one-liner: #!/bin/bash ENCFS6_CONFIG="/home/<user>/.keys/encfs/key_data.xml" encfs -o nonempty --extpass='/home/<user>/.keys/encfs/key_data_pw' /run/media/<user>/data /home/<user>/DATA The use of ENCFS_CONFIG and extpass is well documented in the EncFS docs.


0

I've just done extensive testing on this, and the cipher suite that yielded the highest throughput was aes-128-ctr with umac64 MAC. On a 4-core 3.4GHz machine I saw almost 900MBytes/sec through localhost (to eliminate network bottlenecks for the sake of benchmarking) If you really need that much performance, you want the newest SSH, and possibly the ...


0

I was able to compile sshd/ssh with cipher 'none' with the help of this post: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=24559#58 It's a very old post, but you have to make 3 slight modifications to the source code file cipher.c. Then recompile the sshd/ssh code. @@ -175,7 +175,7 @@ for ((p = strsep(&cp, CIPHER_SEP)); p && *p != ...


0

$ htpasswd -c /tmp/my_hash user1 New password: Re-type new password: Adding password for user user1 $ cat /tmp/my_hash user1:$apr1$oj1ypcQz$4.6lFVtKz2nr8acsQ8hD30 Obviously, you just grab the 2nd field, and can delete the file once you're added it to shadow or for use with sudo (still most likely shadow).



Top 50 recent answers are included