Date: Thu, 20 Jul 2000 12:48:05 +0200 From: Terje Elde <terje@elde.net> To: Robert Watson <rwatson@FreeBSD.ORG> Cc: Sheldon Hearn <sheldonh@uunet.co.za>, =?iso-8859-1?Q?Joachim_Str=F6mbergson?= <watchman@ludd.luth.se>, Greg Lewis <glewis@trc.adelaide.edu.au>, freebsd-security@FreeBSD.ORG Subject: Re: Status of FreeBSD security work? Audit, regression and crypto swap? Message-ID: <20000720124805.D70017@dlt.follo.net> In-Reply-To: <Pine.NEB.3.96L.1000719165025.73365A-100000@fledge.watson.org>; from rwatson@FreeBSD.ORG on Wed, Jul 19, 2000 at 04:55:34PM -0400 References: <Pine.BSF.4.21.0007181838570.28415-100000@achilles.silby.com> <Pine.NEB.3.96L.1000719165025.73365A-100000@fledge.watson.org>
next in thread | previous in thread | raw e-mail | index | archive | help
> Personally, my big fear is my notebook computer. I can encrypt data on it > using command line tools, but I'd much rather see a device layer that I > can use to protect both swap and sensitive partitions. Swap could use a > randomized key, and mounting of data partitions could rely on a > user-provided key for the device layer. A crypto-fs might be more fun, > but if we have the facility to layer device access, we might as well use > that for a quicky solution. It's easy for someone to walk off with > personal computing devices -- in the office, at home, at the airport, ... For a "ugly hack, but up and running today" kinda solution, you could always do what I do... Use cfs (yes, the software tcfs is based on is running under freebsd, and is available in the ports collection) for your file systems, then swap to a file, on one of the encrypted file systems. It's not a pretty sight, but it does the job. Terje To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20000720124805.D70017>