Ceci est une ancienne révision du document !
Titre : Add enkryption
Titre : enkryptez vos données
When you installed Ubuntu, perhaps you didn’t opt for encryption; or, you added a user without encryption – but now, you have changed your mind and want encryption. In other words, you (or another user on the computer) wants, but does not have, encryption. How do you add encryption after the event? Fortunately, this is quite easy. There are three main steps: • Make an encrypted copy of your folder. • Remove the original unencrypted folder. • Encrypt your swap area. (You need this last step only the very first time you encrypt, whether it was during installation or following this how-to.) I have tested this on Ubuntu Precise 12.04 (fully updated).
Quand vous avez installé Ubuntu, vous n'avez peut-être pas choisi de chiffrer vos données, ou alors vous avez ajouté un utilisateur sans chiffrage; mais maintenant vous avez changé d'avis et voulez chiffrer. Autrement dit, vous (ou un autre utilisateur de l'ordinateur) voulez mais n'avez pas de cryptage.
Comment ajouter un cryptage après coup ?
Heureusement, c'est plutôt facile. Il y a trois étapes principales: • Faire une copie cryptée de votre dossier. • Retirer le dossier d'origine non cryptée. • Crypter votre espace de swap. (Cette dernière étape n'est utile que la toute première fois que vous chiffrez, que ce soit durant l'installation ou en suivant ce manuel.)
Je l'ai testée sur une Ubuntu Precise 12.04 (complètement à jour).
Prepare Due to an existing bug, you will not be able to log in if your wallpaper is in the home folder of the user to be encrypted. If the user has customized the wallpaper, please ensure that it is not stored within their home folder. This procedure is safe as it creates an encrypted copy of your home folder. That does mean, however, that you will have sufficient space on your disk. If you don’t have enough space, please back up your data, delete large files (e.g. movies), and restore them after encryption. (I normally recommend that you back up all your data anyway in case of accidental problems.) Using your favorite package manager, install ecryptfs-utils.
Préparation
En raison d'un bogue connu, vous ne serez pas en mesure de vous connecter si votre papier peint est dans le dossier personnel de l'utilisateur à chiffrer. Si l'utilisateur a personnalisé son fond d'écran, merci de vous assurer qu'il n'est pas stocké dans leur dossier personnel.
Cette procédure est sans danger car elle crée une copie chiffrée de votre dossier personnel. Cela implique cependant, que vous ayez suffisamment de place sur votre disque. Si vous n'avez pas assez d'espace, merci de sauvegarder vos données, de supprimer les gros fichiers (ex: films), et de les restaurer une fois le cryptage fait. (Normalement je vous recommande de sauvegarder toutes vos données de toutes façons, en cas d'accident.)
En utilisant votre gestionnaire de paquets favori, installez ecryptfs-utils.
Encrypt In this how-to, I’ve used my name paddy as the user. Please replace it with the user to be encrypted. Boot into Recovery Mode (when you boot, press and hold Shift until you get the Grub menu. The “recovery mode” is usually the second item from the top). At the Recovery Mode menu, select Drop to root shell prompt. Enter the following commands to fix existing bugs. mount –options remount,rw / mount –all
Cryptage
Dans ce tutoriel, j'ai utilisé mon nom paddy en tant qu'utilisateur. Merci de le remplacer par l'utilisateur à chiffrer.
Démarrez en Mode de Récupération [Recovery Mode] (lorsque vous démarrez, maintenez appuyée la touche Maj jusqu'à ce que vous obteniez le menu GRUB. Le « mode de récupération » est généralement le deuxième élément du haut).
Dans le menu du mode de récupération, choisissez Retour à l'invite de commande root [Drop to root shell prompt].
Entrez les commandes suivantes pour corriger les bugs existants.
mount –options remount,rw /
mount –all
to do
The following command prompts for your password and makes an encrypted copy of your folder. ecryptfs-migrate-home –user paddy When it has finished running, you will see some warnings. Ignore the warnings; but you do need to take a note of the temporary folder that it has created. It looks something like /home/paddy.ChPzzxqD, but the last eight characters will be random. You’ll need it when you Finalize or Revert below. Enter the following command to reboot (it may take several seconds to get going, so be patient). reboot now
Finalize Now, log in normally. Does everything work? If it did not work, skip to Revert below. If it did work, finish up as follows: Open a terminal and enter this command. Use the random-character folder that you noted in step 5 in Encrypt. sudo rm -R /home/paddy.ChPzzxqD Restore any data that you had deleted (if any) in Prepare above. Open a terminal and enter the following command. If you already had an encrypted user on your system, you can safely skip this step. sudo ecryptfs-setup-swap Reboot.
Revert If your encryption did not succeed, you’ll need to restore your previous setup. Repeat steps 1–3 from Encrypt above. Enter the following command using your random-character folder from step 5 in Encrypt. You should not see an error; if you do, ask for help. ls -l /home/paddy.ChPzzxqD Now revert with the following commands. cd /home rm -R paddy .ecryptfs/paddy mv paddy.ChPzzxqD paddy Reboot. I hope this helps you. If you have insurmountable problems, please post a query on my thread on Ubuntu Forums (http://ubuntuforums.org/showthread.php?t=1987630).
Hibernate with Encryption A number of people have wondered why Ubuntu has no Hibernate option any more, and how to restore it. The reason is encryption. If you have encryption, the swap space is also encrypted, but with a random key. When you hibernate, the data is stored to your swap space; when you resume, the random key is lost and so the system cannot read the swap space. To restore hibernation to Ubuntu if you do not have encryption is easy – just perform only steps 6 and 8 in Set up hibernation below. But if you do have encryption, you need to replace the random key for swap with a passphrase of your choosing. Note, however, that every user of the computer will need to know that passphrase in order to boot! I have tested this with Ubuntu 12.04 both natively and in Virtual Box. The latter has a problem with displaying the screen when resuming, but the native installation worked perfectly.
Prepare Enter the following command. sudo cryptsetup status cryptswap1 In the results, you’ll see a line indicating the device, which looks something like /dev/sda1 or /dev/sdb5. This is your swap device. Take a note of it, as you’ll need it later. I always recommend a full backup before changing your system.
Set Up Hibernation Enter the following commands. Ensure you replace /dev/sdXN with your swap device from Prepare above. Please take care to type them in the right order. sudo swapoff /dev/mapper/cryptswap1 sudo cryptsetup luksClose /dev/mapper/cryptswap1 sudo cryptsetup luksFormat –cipher aes-cbc-essiv:sha256 –verify-passphrase –key-size 256 /dev/sdXN
WARNING! ======== This will overwrite data on /dev/sda1 irrevocably. Are you sure? (Type uppercase yes): YES Enter LUKS passphrase: [type your new passphrase] Verify passphrase: [type your new passphrase again] sudo cryptsetup luksOpen /dev/sdXN cryptswap1 Enter passphrase for /dev/sda1: [type your new passphrase yet again] sudo mkswap /dev/mapper/cryptswap1 sudo swapon –all swapon -s
The last command should display a filename /dev/cryptswap1. Using your favorite editor (or you can press Alt-F2 and enter gksudo gedit), edit the file /etc/crypttab. Replace the existing cryptswap1 line as follows (remember to replace /dev/sdXN with your swap device). cryptswap1 /dev/sdXN none luks Now edit the file /usr/share/initramfs-tools/scripts/local-top/cryptroot. Search for the following line (which should be on line 288, but that could change over time): message “cryptsetup: unknown error setting up device mapping”
Skip to the next blank line (before FSTYPE='') and insert a new line (remember to replace /dev/sdXN): /sbin/cryptsetup luksOpen /dev/sdXN cryptswap1 Edit the file /etc/acpi/hibernate.sh. At the first blank line, insert the following line. DEVICE='/dev/mapper/cryptswap1' Edit the file /etc/initramfs-tools/conf.d/resume. Replace the existing line with: RESUME=/dev/mapper/cryptswap1
Edit the file /etc/polkit-1/localauthority/50-local.d/com.ubuntu.enable-hibernate.pkla. The file does not already exist, so you’ll be creating it. Add the following lines. [Re-enable hibernate by default] Identity=unix-user:* Action=org.freedesktop.upower.hibernate ResultActive=yes Finally, open a terminal and enter the following command. sudo update-initramfs -u -k all Reboot.
Using Hibernation When starting, your machine will prompt you for your new swap passphrase. Enter it, and you should continue to a normal login. If you forget the passphrase, enter anything. After three failed attempts, the machine will continue anyway, but with the swap disabled. Redo this how-to to reset your passphrase. Now, you will find Hibernate on your shutdown menu, and you can hibernate! If you wish to hibernate from the CLI (command line interface), use the command: sudo pm-hibernate