LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Debian
User Name
Password
Debian This forum is for the discussion of Debian Linux.

Notices


Reply
  Search this Thread
Old 11-10-2020, 12:50 PM   #1
TokTok
Member
 
Registered: Oct 2019
Posts: 230

Rep: Reputation: Disabled
A question about VeraCrypt install with 2 users on same PC.


Has anyone had any trouble installing VeraCrypt on deb 10.6 with 2 users on the same PC & does it function normally ? Will it have to be installed in both users accounts so at start up it will protect the system no matter what user log`s in first first ?
 
Old 11-10-2020, 01:40 PM   #2
sgosnell
Senior Member
 
Registered: Jan 2008
Location: Baja Oklahoma
Distribution: Debian Stable and Unstable
Posts: 1,943

Rep: Reputation: 542Reputation: 542Reputation: 542Reputation: 542Reputation: 542Reputation: 542
Veracrypt is installed globally. It mounts volumes that are available to all users. I don't know of a way to prevent that. What is possible, and easy, is for each user to have their own volume, with a password/passphrase only they know, and mount that when they log on and unmount it when they're finished. Ideally the volumes would be on USB drives that could be removed and kept by each user, but it's certainly possible to have multiple volumes on an internal drive. It's also possible to put the veracrypt binary on the drive along with the volume, and run it from there without actually installing it to the system. I carry a USB drive with my sensitive information on it, inside a veracrypt volume, with both Linux and Windows executables, just in case. I can use the drive on almost any computer anywhere if necessary, even if veracrypt is not installed, without fear of anyone being able to access the data even if they get possession of the drive, unless they take possession of the computer while it is mounted.
 
Old 11-10-2020, 05:18 PM   #3
TokTok
Member
 
Registered: Oct 2019
Posts: 230

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by sgosnell View Post
Veracrypt is installed globally. It mounts volumes that are available to all users. I don't know of a way to prevent that. What is possible, and easy, is for each user to have their own volume, with a password/passphrase only they know, and mount that when they log on and unmount it when they're finished. Ideally the volumes would be on USB drives that could be removed and kept by each user, but it's certainly possible to have multiple volumes on an internal drive. It's also possible to put the veracrypt binary on the drive along with the volume, and run it from there without actually installing it to the system. I carry a USB drive with my sensitive information on it, inside a veracrypt volume, with both Linux and Windows executables, just in case. I can use the drive on almost any computer anywhere if necessary, even if veracrypt is not installed, without fear of anyone being able to access the data even if they get possession of the drive, unless they take possession of the computer while it is mounted.
Actually i don`t want anyone messing around with anything when i`m not home, but in your opinion their should be no problem installing it on the PC with the default OS debian 10.6 & having it work with both users without any issues or having to be installed for both users / Correct ?
I forgot to mention that i have a bios boot password set but want the extra protection , this is should not be a problem either / Correct ?
 
Old 11-10-2020, 07:12 PM   #4
sgosnell
Senior Member
 
Registered: Jan 2008
Location: Baja Oklahoma
Distribution: Debian Stable and Unstable
Posts: 1,943

Rep: Reputation: 542Reputation: 542Reputation: 542Reputation: 542Reputation: 542Reputation: 542
It installs to /usr/bin, so every user can access and run it, just like any other package. A BIOS password does nothing other than prevent casual users from changing the BIOS settings. It has nothing to do with encrypting anything else, nor with preventing anyone from logging in. Veracrypt is designed to provide a secure place to keep sensitive files. It should not be used to encrypt your system. LUKS does that much better. But with Veracrypt, each encrypted volume - be it a file, a partition, or an entire drive - can have a different password. Thus all users can have their own encrypted volume, with their own password, which no one else can access without having their password. Veracrypt does not affect anything else. If I'm misunderstanding you, and you want to encrypt your drive, LUKS is the way to go. Be advised that no matter what you use to do the encryption, everything that is on the encrypted device is lost. When you encrypt a drive, all the data on it is wiped. If that's okay with you, use what you want and encrypt what you want. If you just want to encrypt individual files, you can do that without loss. The easiest way to do that is with gnupg, aka pgp or gpg. But if you want to encrypt a partition or a drive, it is wiped, thoroughly and irreversibly. If you're just trying to prevent non-professional visitors from accessing your data, use a strong password. If you're worried about someone who knows what they're doing getting the hard drive and going through it at their leisure, reinstall your OS and encrypt the system using LUKS. With that, no one can access anything on the drive without the password, which is separate from the user and root passwords. A longer passphrase is preferable to a password which could be beaten by brute force. You can use LUKS to encrypt the entire system, or just /home. Encrypting the entire system doesn't really make much sense, because the packages aren't exactly secrets, but it's easier, if you don't know what you're doing, to let the installer encrypt everything. Not a lot easier, but somewhat.

The best way to go depends on what your concerns are, and I'm very unsure of that.
 
Old 11-11-2020, 03:18 AM   #5
TokTok
Member
 
Registered: Oct 2019
Posts: 230

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by sgosnell View Post
It installs to /usr/bin, so every user can access and run it, just like any other package. A BIOS password does nothing other than prevent casual users from changing the BIOS settings. It has nothing to do with encrypting anything else, nor with preventing anyone from logging in. Veracrypt is designed to provide a secure place to keep sensitive files. It should not be used to encrypt your system. LUKS does that much better. But with Veracrypt, each encrypted volume - be it a file, a partition, or an entire drive - can have a different password. Thus all users can have their own encrypted volume, with their own password, which no one else can access without having their password. Veracrypt does not affect anything else. If I'm misunderstanding you, and you want to encrypt your drive, LUKS is the way to go. Be advised that no matter what you use to do the encryption, everything that is on the encrypted device is lost. When you encrypt a drive, all the data on it is wiped. If that's okay with you, use what you want and encrypt what you want. If you just want to encrypt individual files, you can do that without loss. The easiest way to do that is with gnupg, aka pgp or gpg. But if you want to encrypt a partition or a drive, it is wiped, thoroughly and irreversibly. If you're just trying to prevent non-professional visitors from accessing your data, use a strong password. If you're worried about someone who knows what they're doing getting the hard drive and going through it at their leisure, reinstall your OS and encrypt the system using LUKS. With that, no one can access anything on the drive without the password, which is separate from the user and root passwords. A longer passphrase is preferable to a password which could be beaten by brute force. You can use LUKS to encrypt the entire system, or just /home. Encrypting the entire system doesn't really make much sense, because the packages aren't exactly secrets, but it's easier, if you don't know what you're doing, to let the installer encrypt everything. Not a lot easier, but somewhat.

The best way to go depends on what your concerns are, and I'm very unsure of that.
User passwords are easy to bypass if the PC is on or off but when i leave the house i don`t want to have to turn it off all the time. I want to protect the system and certain impotent files with something readily available. I tried using the default encryption when installing the OS but had some problems a while back so i just don`t use it. So if i install VeraCrypt now with the OS- Desktop having packages and data files, text, audio-video, PDF`s etc. this will all be erased if i install VeraCrypt now / Correct ?
The basic thing i need is to prevent access when the PC is on when i`m not home without having to turn it off and when the screen saver is on. Files need to be protected but i would rather do it with something readily available and the same program " All in one solution".

Last edited by TokTok; 11-11-2020 at 03:20 AM.
 
Old 11-11-2020, 09:57 AM   #6
sgosnell
Senior Member
 
Registered: Jan 2008
Location: Baja Oklahoma
Distribution: Debian Stable and Unstable
Posts: 1,943

Rep: Reputation: 542Reputation: 542Reputation: 542Reputation: 542Reputation: 542Reputation: 542
You really, really need to study and read on how computer filesystems work. If my previous explanations didn't help, I see little hope in continuing. But one more time:

Veracrypt can make an encrypted container using available empty space, and any files you put in that container will be unavailable outside it until you mount the veracrypt volume. If you leave the volume mounted, the files are available just like any other files.

With an encrypted filesystem using LUKS, all files are available as long as the computer is on.

If you want to leave the computer running while you're away, there is no method I know of to prevent anyone with root or user password from accessing it. You can go into settings and have the session locked after a period of time, requiring a password to unlock it. That should be sufficient, if you use a reasonable password. If you don't trust that, then you absolutely should not leave the computer on when you leave. The only way to be sure that no one else can access the computer at all when you're gone is to encrypt the entire filesystem, which will wipe it and require a reinstallation, and turn it off every time you leave. But that still requires a password, and if anyone knows the password, they can access the computer.

All these methods are different, and address different risks. Security is never easy, and always requires work. You can use any or all of them depending on your level of paranoia. You show little knowledge of how encryption works on a PC, and you really need to learn more about it on your own.
 
Old 11-11-2020, 10:59 AM   #7
sgosnell
Senior Member
 
Registered: Jan 2008
Location: Baja Oklahoma
Distribution: Debian Stable and Unstable
Posts: 1,943

Rep: Reputation: 542Reputation: 542Reputation: 542Reputation: 542Reputation: 542Reputation: 542
I think you have two viable choices. First:
https://www.maketecheasier.com/encry...ions-dm-crypt/
This is harder to set up but easier to use. The upside is that the encrypted partition will show up in the file manager, and can easily be mounted. The file manager will ask for the password, and without that it cannot be mounted or accessed. The downside is that the encrypted partition shows up in the file manager, so it will be obvious to other users that it exists. They can't access it at all without the password/passphrase, but they will know that it exists.

Second: Veracrypt. It can use any empty space on the drive for an encrypted container. The downside is that you have to run veracrypt separately every time you want to access the files in the container, instead of just mounting a partition. The upside is that you can configure it so that there is no evidence that the container exists, even to computer security specialists. You need to read the veracrypt documentation closely. Other users can run Veracrypt, and create their own encrypted containers, but cannot mount yours without the passphrase. I use a phrase of several words for security, because any encryption is only as secure as the password/passphrase.

In either case, you must remember to unmount the encrypted volumes whenever you leave the computer. You don't need to turn it off, but you must unmount the encrypted volume. In neither of the cases above will you lose any data by creating them. Veracrypt can use any empty drive space, and if you shrink a current partition to create a new one, gparted will move any data as part of the shrinking process. Either of these solutions should solve your problem, and it's your choice as to which to use. READ THE DOCUMENTATION for whichever you use. Security is hard, and if you don't understand what you're doing and why, you may be disappointed. Passwords are not hard to bypass. All encryption relies on passwords. My understanding is that other users have access to the computer, so disk encryption won't work for you, and you just need to protect certain files. Either of the methods I describe will do that for you. But you absolutely must remember to unmount your encrypted volume when you leave the computer. I don't know of any other method.

Last edited by sgosnell; 11-11-2020 at 11:07 AM.
 
Old 11-12-2020, 06:05 AM   #8
TokTok
Member
 
Registered: Oct 2019
Posts: 230

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by sgosnell View Post
I think you have two viable choices. First:
https://www.maketecheasier.com/encry...ions-dm-crypt/
This is harder to set up but easier to use. The upside is that the encrypted partition will show up in the file manager, and can easily be mounted. The file manager will ask for the password, and without that it cannot be mounted or accessed. The downside is that the encrypted partition shows up in the file manager, so it will be obvious to other users that it exists. They can't access it at all without the password/passphrase, but they will know that it exists.

Second: Veracrypt. It can use any empty space on the drive for an encrypted container. The downside is that you have to run veracrypt separately every time you want to access the files in the container, instead of just mounting a partition. The upside is that you can configure it so that there is no evidence that the container exists, even to computer security specialists. You need to read the veracrypt documentation closely. Other users can run Veracrypt, and create their own encrypted containers, but cannot mount yours without the passphrase. I use a phrase of several words for security, because any encryption is only as secure as the password/passphrase.

In either case, you must remember to unmount the encrypted volumes whenever you leave the computer. You don't need to turn it off, but you must unmount the encrypted volume. In neither of the cases above will you lose any data by creating them. Veracrypt can use any empty drive space, and if you shrink a current partition to create a new one, gparted will move any data as part of the shrinking process. Either of these solutions should solve your problem, and it's your choice as to which to use. READ THE DOCUMENTATION for whichever you use. Security is hard, and if you don't understand what you're doing and why, you may be disappointed. Passwords are not hard to bypass. All encryption relies on passwords. My understanding is that other users have access to the computer, so disk encryption won't work for you, and you just need to protect certain files. Either of the methods I describe will do that for you. But you absolutely must remember to unmount your encrypted volume when you leave the computer. I don't know of any other method.
So the proper way to do it would be to install VeraCrypt on a new OS install before anything else,Corrct ?
Do you know of any program that will prevent moving, deleting, opening,editing of any document`s or files-folders or can VeraCrypt do this ?
I know their is terminal code to do some or all of this but i don`t want to have to go into terminal when i need access to anything, just a password.
 
Old 11-12-2020, 09:08 AM   #9
sgosnell
Senior Member
 
Registered: Jan 2008
Location: Baja Oklahoma
Distribution: Debian Stable and Unstable
Posts: 1,943

Rep: Reputation: 542Reputation: 542Reputation: 542Reputation: 542Reputation: 542Reputation: 542
No, Veracrypt is a package. It is not designed to encrypt the entire system. For that, use LUKS. I am still unsure of exactly what your goal is. If you have multiple users on the computer, then encryption of the filesystem will not solve your problem. If you just need to protect some sensitive files, then Veracrypt will do that. Linux is designed as a multi-user system. No user can access the files of any other user without that user's password, or the root password. If you don't want the other user to be able to access your files, don't give them your user password or the root password. Someone with access to the machine and enough time can boot it from a USB drive and access all the files, and the only way to prevent that is to encrypt the entire filesystem, and shut the computer down when you leave. If it's still on, the disk is unencrypted, because it has to be to run. Passwords work, as long as they aren't easily guessable. Don't use your birthday, your name, or the name of your pet. Place a strong password, and no one can see your files without extreme effort. Veracrypt will protect any files you place in its container, but if you leave that container mounted when you leave, they're like any other files.

Again, I'm still unsure of exactly what your problems and desires are. If you want to leave your computer running when you leave, put a strong password on both root and your user account. Set the power manager to lock the session after a short period of time when idle. Then no one without the password can log in to your session and see anything in your home directory. You cannot see anything in the other users' home directories either, without having their password or the root password. Root can see everything, and do everything. Be careful of giving anyone the root password. Root can change, move, or delete any file on the computer, and there is no way to prevent that. In a user's home, only the user or root can do anything. Other users, without the root password, cannot access anything outside their own home. That's the way Linux has always been. It is not Windows.
 
Old 11-12-2020, 09:42 AM   #10
TokTok
Member
 
Registered: Oct 2019
Posts: 230

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by sgosnell View Post
No, Veracrypt is a package. It is not designed to encrypt the entire system. For that, use LUKS. I am still unsure of exactly what your goal is. If you have multiple users on the computer, then encryption of the filesystem will not solve your problem. If you just need to protect some sensitive files, then Veracrypt will do that. Linux is designed as a multi-user system. No user can access the files of any other user without that user's password, or the root password. If you don't want the other user to be able to access your files, don't give them your user password or the root password. Someone with access to the machine and enough time can boot it from a USB drive and access all the files, and the only way to prevent that is to encrypt the entire filesystem, and shut the computer down when you leave. If it's still on, the disk is unencrypted, because it has to be to run. Passwords work, as long as they aren't easily guessable. Don't use your birthday, your name, or the name of your pet. Place a strong password, and no one can see your files without extreme effort. Veracrypt will protect any files you place in its container, but if you leave that container mounted when you leave, they're like any other files.

Again, I'm still unsure of exactly what your problems and desires are. If you want to leave your computer running when you leave, put a strong password on both root and your user account. Set the power manager to lock the session after a short period of time when idle. Then no one without the password can log in to your session and see anything in your home directory. You cannot see anything in the other users' home directories either, without having their password or the root password. Root can see everything, and do everything. Be careful of giving anyone the root password. Root can change, move, or delete any file on the computer, and there is no way to prevent that. In a user's home, only the user or root can do anything. Other users, without the root password, cannot access anything outside their own home. That's the way Linux has always been. It is not Windows.
Got it for the most part. I`m new to Linux, that's why i don't seem to know much but i`m learning as i go along, after using Windows for 25 years it will take some time to become adept with linux. Theirs more than one distro of linux and each has something different in some capacity, unlike Windows being all the same for the most part. Thank`s also for the help in understanding things better.
Ps.I forgot is it possible to convert the current file system to the lurks encrypted one by chance w/o reinstalling the whole OS ? It`s a stupid question to ask but i won`t know otherwise.
I have a follow up question. If i use a live disk "Debian" could i save any thing i download or any document etc. on a sd card ?

Last edited by TokTok; 11-12-2020 at 09:45 AM.
 
Old 11-12-2020, 11:16 AM   #11
sgosnell
Senior Member
 
Registered: Jan 2008
Location: Baja Oklahoma
Distribution: Debian Stable and Unstable
Posts: 1,943

Rep: Reputation: 542Reputation: 542Reputation: 542Reputation: 542Reputation: 542Reputation: 542
Encrypting the entire filesystem reformats it. All data will be lost, no way around that.

Linux is Linux, but different desktop environments are different. Gnome, Xfce, Mate, et al are the same on any distro. The only real differences between different distro are the package management system and the version of the packages. The underlying OS is identical. Some distros have newer kernels, and some different packages, but Linux is Linux, and it works the same way everywhere. As I said before, it was originally based on Unix, and designed from the start as a multi-user system, with safeguards built in for keeping users separate. It's very good at that.

You can save data while using a liveDVD, but not to the live drive unless you do some work. You can save to another drive or SD card just as you can from an installed version. A better way is to use Ventoy. That makes a bootable drive, and you can just copy as many .iso files to it as you want, and boot any from the boot menu. You can also install a persistent file, which allows any .iso that is booted to save files to it. https://www.ventoy.net/en/index.html
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
LXer: How to install VeraCrypt on Kali Linux LXer Syndicated Linux News 0 12-08-2018 11:31 AM
LXer: How To Install & Use VeraCrypt In Linux An Alternative To TrueCrypt LXer Syndicated Linux News 0 02-21-2016 01:33 PM
Veracrypt - mounting as removable medium Archlinux Lucjusz Linux - Software 0 10-21-2015 05:45 PM
LXer: FLOSS Weekly 340: VeraCrypt LXer Syndicated Linux News 0 06-11-2015 04:40 AM
prevent users to run the same script at the same time, on the same machine pvpnguyen Programming 2 09-05-2007 08:52 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Debian

All times are GMT -5. The time now is 03:20 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration