Secure Boot

prodonice · 10-28-2008, 07:57 AM

I'm using DMcrypt to secure the hard drive, but the boot sector can't be encrypted, as this will not let me boot. What is the most secure way to boot into RedHat? I don't want anyone to be able to use single-user to bypass any security settings. My goal is to use open source so data on a system that is not accessible by unauthorized folks, even if they are physically at the machine or remove the hard drive.

Thanks!

win32sux · 10-28-2008, 12:35 PM

Quote:

Originally Posted by prodonice

I'm using DMcrypt to secure the hard drive, but the boot sector can't be encrypted, as this will not let me boot. What is the most secure way to boot into RedHat? I don't want anyone to be able to use single-user to bypass any security settings. My goal is to use open source so data on a system that is not accessible by unauthorized folks, even if they are physically at the machine or remove the hard drive.

Separate the boot process from the hard disk (boot from removable media instead).

It's the only way you can have your entire hard disk encrypted (unless you have some fancy BIOS).

You can get an idea of what this involves by reading this article.

TB0ne · 10-28-2008, 01:16 PM

Quote:

Originally Posted by prodonice

I'm using DMcrypt to secure the hard drive, but the boot sector can't be encrypted, as this will not let me boot. What is the most secure way to boot into RedHat? I don't want anyone to be able to use single-user to bypass any security settings. My goal is to use open source so data on a system that is not accessible by unauthorized folks, even if they are physically at the machine or remove the hard drive.

Thanks!

Take a look at TrueCrypt (http://www.truecrypt.org). It lets you encrypt the entire disk, including boot. Very solid, and great encryption and speed.

win32sux · 10-28-2008, 01:45 PM

Quote:

Originally Posted by TB0ne

Take a look at TrueCrypt (http://www.truecrypt.org). It lets you encrypt the entire disk, including boot. Very solid, and great encryption and speed.

If you use TrueCrypt and boot from the hard drive itself, the TrueCrypt boot loader isn't encrypted, and it can be tampered with and used to steal the key from you. Regardless of which encryption solution you use, you're still gonna need to boot from separate media if you really want your whole drive to be encrypted. With whole disk encryption, you really shouldn't even have a /boot at all on the hard drive (or a boot loader, for that matter).

prodonice · 10-29-2008, 01:11 PM

Thanks for the feedback! I'm also going to try a 3rd party hard drive that has full encryption via an embedded chip. I haven't been able to find a way to really lock down a system from someone who has physical access to it... This is quite a challenge.

TB0ne · 10-29-2008, 01:36 PM

Quote:

Originally Posted by prodonice

Thanks for the feedback! I'm also going to try a 3rd party hard drive that has full encryption via an embedded chip. I haven't been able to find a way to really lock down a system from someone who has physical access to it... This is quite a challenge.

Indeed it is. Even with proprietary software like Pointsec, an administrator (with the right codes/phone #'s), can gain access to a resource. The best you can hope for is to lessen the risk...thin-client machines worked well for alot of our needs here, and we can provide Linux/Windows desktops, without USB/optical devices everywhere. A 'real' computer is more difficult. We've used a combination of stuff here, with good success, but it's never perfect.

Good luck.