Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I currently have a fully encrypted Windows System, and I'm looking at switching to Ubuntu. Is encrypting my home directory (with ecryptfs) sufficient?

On windows this would be problematic due to software leaking out some possibly critical details, but on Linux I usually wouldn't have write permission to many places outside of my home directory anyways.. right?

The other issue is that I currently have a strong password (for "offline" attacks) for the system-level encryption, but a weak login password for the Windows user account, since I log on/off often (while leaving the PC running). This isn't an issue considering that windows limits how many failed logins you can try out per time interval. With ecryptfs however my login-password would also have to be strong since the ecryptfs password is derived from it. Is there perhaps a way to mount the home directory once after boot up, indepentently of my login password (and subsequently, does Linux/Ubuntu limit failed login/su attempts)?

share|improve this question

4 Answers 4

up vote 7 down vote accepted

Data from any running program might end up in swap, so your swap space needs to be encrypted as well. Unless you want to hibernate your system, the swap space can be encrypted with a random key that is generated at each boot. This is the case by default if you select full-disk encryption during installation but not if you merely later encrypt your home directory. If your swap space isn't encrypted already, set it up with `ecryptfs-setup-swap. If you want to have both swap space and hibernation, see Enable Hibernate With Encrypted Swap in the Ubuntu community documentation.

Many programs put temporary files in /tmp. The best way to handle this is to put /tmp on the memory-backed filesystem tmpfs instead of leaving it on a disk-backed filesystem. There's also a slight performance advantage. See this writeup for how to do this.

Beyond this, private data can end up in various places that aren't your private storage area. You have to decide based on what you consider to be confidential whether it's worth it encrypting these areas. Here are some notable places:

  • If receive mail locally (as opposed to fetching it from a POP or IMAP server), it arrives in /var/mail. If you send mail using the traditional unix method (sendmail), it transits via /var/spool/postfix (or whatever your MTA is). If you don't understand this paragraph, it doesn't apply to you.
  • If you set up recurring tasks, they are stored in /var/spool/cron.
  • When you print something, it transits in /var/spool/cups.
  • The system logs under /var/log might contain data you'd rather keep private, such as network errors from sites you've tried to connect to or from.
  • Your system configuration in /etc might have a few confidential things such as ISP or wifi passwords.

If you encrypt your home directory with ecryptfs, beware that it won't be mounted if you log in remotely with SSH while not logged in locally, so if you do that, your SSH public key file (~/.ssh/authorized_keys) needs to be present in both encrypted and cleartext form.

share|improve this answer
    
Yes, I seem to have forgotten about swap. Since it is part of the regular file system these days, would full system encryption take care of that? (Even when considering hibernation?) –  Dexter Aug 27 '13 at 20:40

It depends on what you intend to secure. If everything you want to keep safe resides in /home/, then you're golden. Otherwise, no.

For example, /var/spool/mail/ contains system email sent to your user. /var/spool/cron/ contains your crontabs. And if you're worried about a malicious actor with local access ("evil maid" scenario) messing with your security, then it is definitely not sufficient.

Homedir encryption is convenient and simple, and it allows you to protect your personal stuff from your big sister. But it's not whole-disk encryption, which is probably what you want if you're asking this question.

Failed login attempts are rate limited if done through PAM, but brute-force attacks against your encryption would be offline anyway, so your OS doesn't factor in.

share|improve this answer
    
So in other words no (to rate limiting)? I'm not really familiar with PAM and what it does, but it's not on by default and requires independent management of the users right? –  Dexter Aug 27 '13 at 20:29
    
PAM is the set of libraries by which Linux authentication happens. It's on by default, and it sleeps for a couple of seconds if you give it a bad password. But if someone wanted to brute force your password, they'd do it directly with their own code instead of using the system login mechanism. –  tylerl Aug 27 '13 at 20:42

That depends on what you want to keep secret. Does everything you care about sit in /home? Do you care about /etc? Do you care if people know what programs are installed? For most users /home/ is probably enough. It all depends on what information you want to protect though.

EDIT: /var is probably also a good place to look at as spools (mail and print) and logs live there.

share|improve this answer
    
Well that is kind of my question - should I care about /etc and other places? I probably don't really care about the installed programs (or should I?). What I care about are user-specific things (like what files I last edited, when, etc.) –  Dexter Aug 27 '13 at 20:28
1  
That depends on what you are trying to protect. /etc has all of the configuration for your software, the list of users, and the users' encrypted passwords. /var has all of the logs. /var/spool/mail has mail spools if your machine has a mail server, which most linux installs do by default, even if it is only used by the system for notifications to the root user. /var/spool/print is the print spool things you tried to print when the printer wasn't available can end up there. /tmp and /var/tmp can hold all kinds of temporary files. By far the easiest thing to do is full disk encryption. –  Rod MacPherson Aug 27 '13 at 20:42

Linux system is not really different from Windows in that respect. Besides your home directory, you (as a Linux user) have permission to write in a few other places, e.g. /tmp and /var/tmp. There is also the virtual memory, aka swap space, where excerpts of your precious data will be copied at hard-to-predict moments, straight from the "RAM" of your applications. Moreover, some parts of the OS also have higher privileges, and may write some of your "secrets" on your behalf in other places; a common example is /etc/shadow, which contains the users' hashed passwords.

It is safest, and simplest, to just encrypt everything.

As for your weak password, well, it is weak. There is no salvaging it. Even in the case of your Windows system: if the attacker can be in physical presence of the machine, then he can open the case and plug into it. Hotplug of PCI cards is not recommended for the health of the system, but it can be done (I have seen it done), and a PCI card can read and write RAM at will, regardless of what the operating system may think about it. This would allow the attacker to unlock the system and read all your data. Basically, if the envisioned attackers are motivated and competent, then the only defence is to always switch the machine off (not put it in sleep or hibernation mode) when you are not physically present.

share|improve this answer
    
The piece about PCI cards sounds scary. Tbh though, that's not really a scenario I'm prepared for anyways. If someone knows the system is encrypted and motivated enough, they'll be able to use some unpatched OS/application exploit, that I can't really do much about anyways. Most of my "security" hinges on 1. encryption being a surprise and 2. me being able to pull the power cord at some point in the process. I'm not sure anything better is really feasible without being either too expensive or too impractical. –  Dexter Aug 27 '13 at 20:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.