From owner-freebsd-security  Thu Jul 20  3:48:12 2000
Delivered-To: freebsd-security@freebsd.org
Received: from dlt.follo.net (elde.org [195.204.143.185])
	by hub.freebsd.org (Postfix) with ESMTP
	id EE02737C195; Thu, 20 Jul 2000 03:48:07 -0700 (PDT)
	(envelope-from terje@elde.net)
Received: by dlt.follo.net (Postfix, from userid 1002)
	id F04A55EF3D; Thu, 20 Jul 2000 12:48:05 +0200 (CEST)
Date: Thu, 20 Jul 2000 12:48:05 +0200
From: Terje Elde <terje@elde.net>
To: Robert Watson <rwatson@FreeBSD.ORG>
Cc: Sheldon Hearn <sheldonh@uunet.co.za>,
	=?iso-8859-1?Q?Joachim_Str=F6mbergson?= <watchman@ludd.luth.se>,
	Greg Lewis <glewis@trc.adelaide.edu.au>, freebsd-security@FreeBSD.ORG
Subject: Re: Status of FreeBSD security work? Audit, regression and crypto swap?
Message-ID: <20000720124805.D70017@dlt.follo.net>
References: <Pine.BSF.4.21.0007181838570.28415-100000@achilles.silby.com> <Pine.NEB.3.96L.1000719165025.73365A-100000@fledge.watson.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.4i
In-Reply-To: <Pine.NEB.3.96L.1000719165025.73365A-100000@fledge.watson.org>; from rwatson@FreeBSD.ORG on Wed, Jul 19, 2000 at 04:55:34PM -0400
X-Mailer: Mutt http://www.mutt.org/
X-Editor: Vim http://www.vim.org/
X-IRC: ircii!epic4-2000 - prevail[1214]
X-Goal: Exterminate All Rational Thought
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

> Personally, my big fear is my notebook computer.  I can encrypt data on it
> using command line tools, but I'd much rather see a device layer that I
> can use to protect both swap and sensitive partitions.  Swap could use a
> randomized key, and mounting of data partitions could rely on a
> user-provided key for the device layer.  A crypto-fs might be more fun,
> but if we have the facility to layer device access, we might as well use
> that for a quicky solution.  It's easy for someone to walk off with
> personal computing devices -- in the office, at home, at the airport, ...

For a "ugly hack, but up and running today" kinda solution, you could always
do what I do... Use cfs (yes, the software tcfs is based on is running under
freebsd, and is available in the ports collection) for your file systems, then
swap to a file, on one of the encrypted file systems.

It's not a pretty sight, but it does the job.

Terje


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message