diff options
Diffstat (limited to 'de/using-d-i/modules')
| -rw-r--r-- | de/using-d-i/modules/mdcfg.xml | 7 | ||||
| -rw-r--r-- | de/using-d-i/modules/partman-crypto.xml | 363 |
2 files changed, 368 insertions, 2 deletions
diff --git a/de/using-d-i/modules/mdcfg.xml b/de/using-d-i/modules/mdcfg.xml index 1cfc95e2a..6e327255c 100644 --- a/de/using-d-i/modules/mdcfg.xml +++ b/de/using-d-i/modules/mdcfg.xml @@ -1,5 +1,5 @@ <!-- retain these comments for translator revision tracking --> -<!-- original version: 33725 --> +<!-- original version: 38703 --> <sect3 id="mdcfg"> <title><quote>Multidisk Devices</quote> (Software-RAID) konfigurieren (mdcfg)</title> @@ -169,7 +169,10 @@ ausführen. </para></warning><para> Als nächstes wählen Sie <guimenuitem>Software-RAID konfigurieren</guimenuitem> -aus dem <command>partman</command>-Hauptmenü. Im ersten Bild von +aus dem <command>partman</command>-Hauptmenü. +(Das Menü erscheint nur, wenn Sie mindestens eine Partition für die +Nutzung als <guimenuitem>Physikalisches Volume für RAID</guimenuitem> +markiert haben.) Im ersten Bild von <command>mdcfg</command> wählen Sie einfach <guimenuitem>MD-Gerät erstellen</guimenuitem>. Ein Liste unterstützter Typen von MD-Laufwerken wird angezeigt, von denen diff --git a/de/using-d-i/modules/partman-crypto.xml b/de/using-d-i/modules/partman-crypto.xml new file mode 100644 index 000000000..08fbbe1ec --- /dev/null +++ b/de/using-d-i/modules/partman-crypto.xml @@ -0,0 +1,363 @@ +<!-- retain these comments for translator revision tracking --> +<!-- original version: 38703 untranslated --> + + <sect3 id="partman-crypto"> + <title>Configuring Encrypted Volumes</title> +<para> + +&d-i; allows you to set up encrypted partitions. Every file you write +to such a partition is immediately saved to the device in encrypted +form. Access to the encrypted data is granted only after entering +the <firstterm>passphrase</firstterm> used when the encrypted +partition was originally created. This feature is useful to protect +sensitive data in case your laptop or hard drive gets stolen. The +thief might get physical access to the hard drive, but without knowing +the right passphrase, the data on the hard drive will look like random +characters. + +</para><para> + +The two most important partitions to encrypt are: the home partition, +where your private data resides, and the swap partition, where +sensitive data might be stored temporarily during operation. Of +course, nothing prevents you from encrypting any other partitions that might +be of interest. For example <filename>/var</filename> where database +servers, mail servers or print servers store their data, or +<filename>/tmp</filename> which is used by various programs to store +potentially interesting temporary files. Some people may even want to +encrypt their whole system. The only exception is +the <filename>/boot</filename> partition which must remain +unencrypted, because currently there is no way to load the kernel from +an encrypted partition. + +</para><note><para> + +Please note that the performance of encrypted partitions will be +less than that of unencrypted ones because the data needs to be +decrypted or encrypted for every read or write. The performance impact +depends on your CPU speed, chosen cipher and a key length. + +</para></note><para> + +To use encryption, you have to create a new partition by selecting +some free space in the main partitioning menu. Another option is to +choose an existing partition (e.g. a regular partition, an LVM logical +volume or a RAID volume). In the <guimenu>Partition setting</guimenu> +menu, you need to select <guimenuitem>physical volume for +encryption</guimenuitem> at the <menuchoice> <guimenu>Use +as:</guimenu> </menuchoice> option. The menu will then change to +include several cryptographic options for the partition. + +</para><para> + +&d-i; supports several encryption methods. The default method +is <firstterm>dm-crypt</firstterm> (included in newer Linux kernels, +able to host LVM physical volumes), the other +is <firstterm>loop-AES</firstterm> (older, maintained separately from +the Linux kernel tree). Unless you have compelling reasons to do +otherwise, it is recommended to use the default. + +<!-- TODO: link to the "Debian block device encryption guide" + once Max writes it :-) --> + +</para><para> + +First, let's have a look at available options available when you +select <userinput>Device-mapper (dm-crypt)</userinput> as the +encryption method. As always: when in doubt, use the defaults, because +they have been carefully chosen with security in mind. + +<variablelist> + +<varlistentry> +<term>Encryption: <userinput>aes</userinput></term> + +<listitem><para> + +This option lets you select the encryption algorithm +(<firstterm>cipher</firstterm>) which will be used to encrypt the data +on the partition. &d-i; currently supports the following block +ciphers: <firstterm>aes</firstterm>, <firstterm>blowfish</firstterm>, +<firstterm>serpent</firstterm>, and <firstterm>twofish</firstterm>. +It is beyond the scope of this document to discuss the qualities of +these different algorithms, however, it might help your decision to +know that in 2000, <emphasis>AES</emphasis> was chosen by the American +National Institute of Standards and Technology as the standard +encryption algorithm for protecting sensitive information in the 21st +century. + +</para></listitem> +</varlistentry> + +<varlistentry> +<term>Key size: <userinput>256</userinput></term> + +<listitem><para> + +Here you can specify the length of the encryption key. With a larger +key size, the strength of the encryption is generally improved. On the +other hand, increasing the length of the key usually has a negative +impact on performance. Available key sizes vary depending on the +cipher. + +</para></listitem> +</varlistentry> + +<varlistentry> +<term>IV algorithm: <userinput>cbc-essiv:sha256</userinput></term> + +<listitem><para> + +The <firstterm>Initialization Vector</firstterm> or +<firstterm>IV</firstterm> algorithm is used in cryptography to ensure +that applying the cipher on the same <firstterm>clear text</firstterm> +data with the same key always produces a unique +<firstterm>cipher text</firstterm>. The idea is to prevent the +attacker from deducing information from repeated patterns in the encrypted +data. + +</para><para> + +From the provided alternatives, the default +<userinput>cbc-essiv:sha256</userinput> is currently the least +vulnerable to known attacks. Use the other alternatives only when you +need to ensure compatibility with some previously installed system +that is not able to use newer algorithms. + +</para></listitem> +</varlistentry> + +<varlistentry> +<term>Encryption key: <userinput>Passphrase</userinput></term> + +<listitem><para> + +Here you can choose the type of the encryption key for this partition. + + <variablelist> + <varlistentry> + <term>Passphrase</term> + <listitem><para> + +The encryption key will be computed<footnote> +<para> + +Using a passphrase as the key currently means that the partition will +be set up using <ulink url="&url-luks;">LUKS</ulink>. + +</para></footnote> on the basis of a passphrase which you will be able +to enter later in the process. + + </para></listitem> + </varlistentry> + + <varlistentry> + <term>Random key</term> + <listitem><para> + +A new encryption key will be generated from random data each time you +try to bring up the encrypted partition. In other words: on every +shutdown the content of the partition will be lost as the key is +deleted from memory. (Of course, you could try to guess the key with a +brute force attack, but unless there is an unknown weakness in the +cipher algorithm, it is not achievable in our lifetime.) + + </para><para> + +Random keys are useful for swap partitions because you do not need to +bother yourself with remembering the passphrase or wiping sensitive +information from the swap partition before shutting down your +computer. However, it also means that you +will <emphasis>not</emphasis> be able to use +the <quote>suspend-to-disk</quote> functionality offered by newer +Linux kernels as it will be impossible (during a subsequent boot) to +recover the suspended data written to the swap partition. + + </para></listitem> + </varlistentry> + </variablelist> + +</para></listitem> +</varlistentry> + +<varlistentry> +<term>Erase data: <userinput>yes</userinput></term> + +<listitem><para> + +Determines whether the content of this partition should be overwritten +with random data before setting up the encryption. This is recommended +because it might otherwise be possible for an attacker to discern +which parts of the partition are in use and which are not. In +addition, this will make it harder to recover any leftover data from +previous installations<footnote><para> + +It is believed that the guys from three-letter agencies can restore +the data even after several rewrites of the magnetooptical media, +though. + +</para></footnote>. + +</para></listitem> +</varlistentry> + +</variablelist> + +</para><para> + +If you select <menuchoice> <guimenu>Encryption method:</guimenu> +<guimenuitem>Loopback (loop-AES)</guimenuitem> </menuchoice>, the menu +changes to provide the following options: + + +<variablelist> +<varlistentry> +<term>Encryption: <userinput>AES256</userinput></term> + +<listitem><para> + +For loop-AES, unlike dm-crypt, the options for cipher and key size are +combined, so you can select both at the same time. Please see the +above sections on ciphers and key sizes for further information. + +</para></listitem> +</varlistentry> + +<varlistentry> +<term>Encryption key: <userinput>Keyfile (GnuPG)</userinput></term> + +<listitem><para> + +Here you can select the type of the encryption key for this partition. + + <variablelist> + <varlistentry> + <term>Keyfile (GnuPG)</term> + <listitem><para> + +The encryption key will be generated from random data during the +installation. Moreover this key will be encrypted +with <application>GnuPG</application>, so to use it, you will need to +enter the proper passphrase (you will be asked to provide one later in +the process). + + </para></listitem> + </varlistentry> + + <varlistentry> + <term>Random key</term> + <listitem><para> + +Please see the the section on random keys above. + + </para></listitem> + </varlistentry> + </variablelist> + +</para></listitem> +</varlistentry> + +<varlistentry> +<term>Erase data: <userinput>yes</userinput></term> + +<listitem><para> + +Please see the the section on erasing data above. + +</para></listitem> +</varlistentry> + +</variablelist> + +</para><note><para> + +Please note that the <emphasis>graphical</emphasis> version of the +installer still has some limitations when compared to the textual +one. For cryptography it means you can set up only volumes using +<emphasis>passphrases</emphasis> as the encryption keys. + +</para></note><para> + + +After you have selected the desired parameters for your encrypted +partitions, return back to the main partitioning menu. There should +now be a new menu item called <guimenu>Configure encrypted +volumes</guimenu>. After you select it, you will be asked to confirm +the deletion of data on partitions marked to be erased and possibly +other actions such as writing a new partition table. For large +partitions this might take some time. + +</para><para> + +Next you will be asked to enter a passphrase for partitions configured +to use one. Good passphrases should be longer than 8 characters, +should be a mixture of letters, numbers and other characters and +should not contain common dictionary words or information easily +associable with you (such as birthdates, hobbies, pet names, names of +family members or relatives, etc.). + +</para><warning><para> + +Before you input any passphrases, you should have made sure that your +keyboard is configured correctly and generates the expected +characters. If you are unsure, you can switch to the second virtual +console and type some text at the prompt. This ensures that you won't be +surprised later, e.g. by trying to input a passphrase using a qwerty +keyboard layout when you used an azerty layout during the installation. +This situation can have several causes. Maybe you switched to another +keyboard layout during the installation, or the selected keyboard layout +might not have been set up yet when entering the passphrase for the +root file system. + +</para></warning><para> + +If you selected to use methods other than a passphrase to create +encryption keys, they will be generated now. Because the kernel may +not have gathered a sufficient amount of entropy at this early stage +of the installation, the process may take a long time. You can help +speed up the process by generating entropy: e.g. by pressing random +keys, or by switching to the shell on the second virtual console and +generating some network and disk traffic (downloading some files, +feeding big files into <filename>/dev/null</filename>, etc.). + +<!-- TODO: Mention hardware random generators when we will support + them --> + +This will be repeated for each partition to be encrypted. + +</para><para> + +After returning to the main partitioning menu, you will see all +encrypted volumes as additional partitions which can be configured in +the same way as ordinary partitions. The following example shows two +different volumes. The first one is encrypted via dm-crypt, the second +one via loop-AES. + +<informalexample><screen> +Encrypted volume (<replaceable>crypt0</replaceable>) - 115.1 GB Linux device-mapper + #1 115.1 GB F ext3 + +Loopback (<replaceable>loop0</replaceable>) - 515.2 MB AES256 keyfile + #1 515.2 MB F ext3 +</screen></informalexample> + +Now is the time to assign mount points to the volumes and optionally +change the file system types if the defaults do not suit you. + +</para><para> + +One thing to note here are the identifiers in parentheses +(<replaceable>crypt0</replaceable> +and <replaceable>loop0</replaceable> in this case) and the mount +points you assigned to each encrypted volume. You will need this +information later when booting the new system. The differences between +ordinary boot process and boot process with encryption involved will +be covered later in <xref linkend="mount-encrypted-volumes"/>. + +</para><para> + +Once you are satisfied with the partitioning scheme, continue with the +installation. + +</para> + </sect3> |