4

There's a bazillion hard disk encryption HOWTOs, but somehow I can't find one that actually does what I want. Which is:

I have a home NAS running Ubuntu, which is being accessed by a Linux and a Win XP client. (Hopefully MacOS X soon...) I want to setup encryption for home dirs on the NAS so that:

  • It does not interfere with the boot process (since the NAS it tucked away in a cupboard),
  • the home dirs should be accessible as a regular file system on the client(s) (e.g. via SMB),
  • it is easy to use by 'normal' people, (so it does not require SSH-ing to the NAS, mount the encrypted partition on command line, then connecting via SMB, and finally umount the partition after being done. I can't explain that to my mom, or in fact to anyone.)
  • does not store the encryption key the NAS itself,
  • encrypts file meta-data and content (i.e. safe against the 'RIAA' attack, where an intruder should not be able to identify which songs are in your MP3 collection).

What I hoped to do was use Samba + PAM. The idea was that on connecting to the SMB server, I'd have to enter the password on the client, which sends it to the server for authentication, which would use the password to mount the encrpytion partition, and would unmount it again when the session was closed. Turns out that doesn't really work, because SMB does not transmit the password in the plain and hence I can't configure PAM to use the incoming password to mount the encrypted patition.

So... anything I'm overlooking? Is there any way in which I can use the password entered on the client (e.g. on SMB connect) to initiate mounting the encrypted dir on the server?

2 Answers 2

2

Seems like there could be a simpler solution.

I also owns a NAS (DNS-323 in my case).

Suggested solution is to install TrueCrypt and to setup (according to this tutorial) it to open crypted volume when a keyfile (located on a USB key) is present.

This way, the crypted volume is mounted at boot, only if keyfile is present.

Obviously, your solution to have volume mounted at SMB connection appears as optimal, but I personnally don't SMB often to my volume. I prefer to connect through SCP, SSH, UPnP. using the aforementionned solution, datas are still secured by the USB key, and each and any protocol can be used to access it.

1
  • 2
    I don't feel right about this recommendation, the whole point of encrypting a drive is to prevent physical access to the data. If the key is present in the computer and no password is used for boot, then what is the point of encrypting the box? Yanking the key if the police knocks on the door? What if they come in when no one is home?
    – t.mikael.d
    May 28, 2012 at 16:14
0

Look, IMHO, the best (and easiest way) to make Samba work with LDAP, PAM and user authentication is by using a Ubuntu derivative called Zentyal (www.zentyal.org). I don't remember if it has the option of crypto the home folders, buut the truecrypt option sounds pretty nice.

So, try to use the tutorial above on using TrueCrypt and use Zentyal for the rest.

Plus, you can use it as a gateway to access the internet and VPN is really easy to setup trough it.

Legal disclaimer: I am in no way affiliated with Zentyal, just a very satisfied user.

You must log in to answer this question.