On Sunday 04 January 2009 15:28:13 Mail Lists wrote:
On 01/04/2009 09:03 AM, Anne Wilson wrote:
> Hmm - Is there no reasonably safe way of doing this? There seems to be
> some risk with everything. I've not lost a usb stick yet, but one can
> never guarantee that one won't.
The general recomendation for any laptop (with anything sufficiently
private) is to encrypt the disk. My preference is to (luks) encrypt
/home and swap
I have luks encryption on /home on the netbook - which is what I'm really
thinking about.
and then bind mount /tmp and /var/tmp out of /home/tmp
/home/var/tmp.
I don't understand that bit, I'm afraid.
You could encrypt root as well and then skip the bind
mounts.
I didn't think it worth while to encrypt root. Root login is disabled, and
/home is luks encrypted. How can they get in?
Many (if not most) businesses these days require laptops all be
encrypted - certainly mine does. (See some posts by mike.cloaked on
encryption in F10)
It takes a government department to lose laptops with unencrypted confidential
information :-)
Avoid any fuse type encryptions - nice toys to test things but
they
are very slow. Using encryption (encfs is the default in Luks) does not
impact my daily activities at all speed wise, tho' backup/restores may
be a little slower. Witrh encrypted swap you likely cannot hibernate tho
suspend may be an option - I usually just shutdown and reboot.
Again, I assumed that it was not possible for an intruder to get as far as
swap. If I'm wrong, how can that be encrypted after an install?
In addition, as Tom mentioned, you likely use a passphrase to
protect
your ssh private key (and like most of us probably use ssh-agent so you
dont need to keep typing it).
Yes, I only use ssh with passphrase, and I do use ssh-agent.
Anne