January 2011 - Grml - lists.mur.at

Grml User Survey 2011: Help us make Grml better
by Michael Prokop 31 Jan '11

31 Jan '11

Hi! As a result of our Grml developer meeting (see meeting minutes at http://grml.org/reports/devmeeting_2010/ for details) we created a user survey to get more information about our users and their needs. Please take part in our survey and help us to improve and enhance Grml: http://grml.org/survey2011 And please don't forget to spread the word about it! P.S: Have a look at the old but still interesting results of our last user survey in 2007: http://wiki.grml.org/doku.php?id=survey07 regards, -mika-

1 1

disk partition encryption roadmap
by T o n g 27 Jan '11

27 Jan '11

Hi, I'm thinking to do the disk partition encryptions now. However "Hard drive encryption sounds like an intimating concept, mostly because it is. The thought of taking your precious files, then using a mathematical formula to convert them into random noise before scattering them back across your disk is a hard sell. " [1] 1. http://www.maximumpc.com/article/howtos/ how_to_encrypt_your_entire_hard_drive_for_free_using_true_crypt So I need some demystify of the whole disk/partition encryption thing. The official "Disk Encryption HOWTO" from tldp.org [2] is only dated as 2004-11-17, so I would assume it is *way* outdated. In terms of security, I tend to turn to people that I trust for help. Having tldp.org failed on me, I need your help, people from the grml community, instead of some random blogs found on the interent. 2. http://www.tldp.org/HOWTO/html_single/Disk-Encryption-HOWTO/ Linux Encryption HOWTO http://encryptionhowto.sourceforge.net/Encryption-HOWTO.html v0.2.2, 04 October 2000 Here are my questions, - First very noob question, I don't want whole disk encryption, just want to encrypt some selected already partitioned partitions. If someone mount the encrypted partitions, will it shows up as empty or, there are some hints that the partition have been encrypted? - The Ubuntu [3] and CentOS [4] seems to endorse dm-crypt, instead of cryptsetup-luks that grml-crypt uses. So I need a bit of explanation why it is better than others. 3. http://www.humboldt.edu/its/security-encryption-linuxubuntu 4. http://beginlinux.com/blog/2009/04/centos-53-encrypted-block-devices/ - In terms of encryption used, TrueCrypt supports the following encryption algorithms: AES, Serpent, Twofish, AES-Twofish, AES-Twofish- Serpent, Serpent-AES, Serpent-Twofish-AES, Twofish-Serpent; And these hash algorithms: RIPEMD-160, SHA-512 & Whirlpool [5] 5. http://www.informit.com/articles/article.aspx?p=1276279 So I need a bit of explanation why the chosen algorithm is better than others. - Is your choice as cross-platform as TrueCrypt? - Since I need to encrypt more than one selected partitions, is there any alternative to typing in passphrase for each one of them when mounting them? - how passphrase are cached? Do I have to repeately typing in passphrase each time I do the mount? I also heard of passphrase-less disk encryptions. Hmm... I don't want to go there so maybe I can skip that. BTW, I just need a mini how-to about disk encryption, it does not need to be in-depth or comprehensive but rather short and to the point, to allow anyone with a minimum of linux disk encryption knowledge to create encrypted memory sticks, USB disks, or partitions in minutes. Thanks a lot. -- Tong (remove underscore(s) to reply) http://xpt.sourceforge.net/techdocs/ http://xpt.sourceforge.net/tools/

4 6

grml-crypt on grml.org please
by T o n g 26 Jan '11

26 Jan '11

Hi mika, I found that the grml-crypt man page is not on the grml.org (yet), as oppose to other grml helpful tools, eg, grml-live, grml2usb/hd, grml- debootstrap, etc. If it's on, then it'll be easier for me to refer people to it, after saying "Linux disk encryption in 4 commands with grml-crypt". :-) thanks -- Tong (remove underscore(s) to reply) http://xpt.sourceforge.net/techdocs/ http://xpt.sourceforge.net/tools/

1 0

grml custom installation on 1GB USB device ?
by Sven Crouse 19 Jan '11

19 Jan '11

Hi grml. My computer has a no-award bios which suffers from problems booting USB-HDD devices. As I can tell I'm limited to a single 1GB partition although iso images installed via dd do boot. Currently I have a usb device which boots kernel with an initramfs ( embedded ) that activates raid ( metadata=1.2 ) and lvm on mirrored sata drives that contain root partition. I would like to replace this initramfs that contains little sysadmin functionality with grml and see a few options of how to realize: 1-grml persistency, but I think my bios constrains will make it difficult to do iso leaving ~300MB enough for home-rw, live-rw, and GRMLCFG ? 2-customizing an existing grml iso image to include a default grub entry that mounts root=/dev/md0 with a fallback to grml ? Other ways or suggestions ? Sven

1 0

EXT3-fs: barriers not enabled
by Sven Crouse 18 Jan '11

18 Jan '11

Hi GRML. I appreciate your system, have been using since 2008. Recently learned about persistency which I plan to use to replace custom initramfs for booting & maintenance of RAID1/LVM2 systems containing root partitions. I just finished migrating Gentoo from single partition to mirrored ( RAID1 ) and LVM2 volumes. In the process, I learned/realized that the Ext3 filesystems contained within raid/volume group are not enabling write barriers despite being told by fstab to do so. This is 2.6.36 kernel with lvm2 version 2.02.73. I thought to try to grml 2010.12 as well, but problem remains. My question: is there any magic "Start" besides mdadm-raid, lvm that should be necessary ? We can otherwise mount partitions without incident. Does somebody have ext3 barriers enabled by default such that I know it should be realized with 2010.12 ? Appreciatively, Sven

2 1

Is nss-ldap missing from grml 2010.04 ?
by jonty 04 Jan '11

04 Jan '11

Hi All, I have been using grml for the last couple of months. I am building a network of about 20 machines, all running grml, and I want them to share a single set of login names and passwords. So I decided to configure OpenLDAP as a service on one machine and configure the other machines to find login+password from this service. I am following the instructions set out at: http://wiki.debian.org/LDAP/NSS http://www.debian-administration.org/article/585/OpenLDAP_installation_on_D… They suggest I use libnss-ldap. But this package seems to be missing from my copy of grml 2010.04. I have also checked the package list for 2010.12 and that does not contain libnss-ldap. This seems a strange omission from grml. It contains slapd to run the service and several clients such as freeradius-ldap, libnet-ldap-perl, postfix-ldap, and smbldap-tools. So why not libnss-ldap? I could install libnss-ldap on each client machine. But then I have to repeat those same steps on 20 machines, which makes it 20 times more likely I will make a mistake somewhere. I tried "apt-get install libnss-ldap" on a test machine. This started updating libc-bin and installing locales, which seemed a good way of breaking the distro. Can anyone suggest a better approach? Should I remaster the CD? Is there some gmrl magic I am missing? Is there a different tool for login+password that is not ldap? Thanks Jonty

6 8