free
/
freedombone
关注 1
点赞 0
派生 0
代码 工单 0 合并请求 0 版本发布 0 百科 动态
浏览代码

Note about encrypting usb drives

Bob Mottram 10 年前
父节点
2668887b22
当前提交
59ba8d3c1b
共有 4 个文件被更改，包括 56 次插入 和 45 次删除
合并视图 显示文件统计
  1. 4
    2
      doc/EN/backups.org
  2. 2
    2
      doc/EN/installation.org
  3. 47
    38
      website/EN/backups.html
  4. 3
    3
      website/EN/installation.html

+ 4
- 2
doc/EN/backups.org 查看文件

18 
 #+END_CENTER
 18 
 #+END_CENTER
19
19
20 
 * Backup to USB
 20 
 * Backup to USB
21 
+First and foremost - *encrypt your USB drives*! Even if you think you have "/nothing to hide/" if you accidentally lose a USB thumb drive (it's easy to lose small objects) and it's not encrypted then potentially someone might be able to obtain enough information about you to commit identity fraud, take out loans, open bank accounts, etc. Use LUKS encryption. In Ubuntu you can do this using the /Disk Utility/ application. Some instructions [[https://help.ubuntu.com/community/EncryptedFilesystemsOnRemovableStorage][can be found here]].
22 
+
21 
 Insert a USB thumb drive into the front socket of the Beaglebone Black.
 23 
 Insert a USB thumb drive into the front socket of the Beaglebone Black.
22
24
23 
 Log into the system and become the root user, then run the /backup/ command.
 25 
 Log into the system and become the root user, then run the /backup/ command.
28 
 backup
 30 
 backup
29 
 #+END_SRC
 31 
 #+END_SRC
30
32
31 
-If this is the first time that you've made a backup then you will be prompted for your GPG key password.
33 
+Type in the password for the USB drive, then if this is the first time that you've made a backup then you will be prompted for your GPG key passphrase.
32
34
33 
 When the backup ends remove the USB drive and keep it somewhere safe. Even if it gets lost or falls into the wrong hands the content is encrypted and so is unlikely to become a source of leaks.
 35 
 When the backup ends remove the USB drive and keep it somewhere safe. Even if it gets lost or falls into the wrong hands the content is encrypted and so is unlikely to become a source of leaks.
34 
 * Restore from USB
 36 
 * Restore from USB
42 
 restore
 44 
 restore
43 
 #+END_SRC
 45 
 #+END_SRC
44
46
45 
-You will be prompted to enter your GPG key password, then when the restore is complete you can remove the USB drive.
47 
+Enter the password for the USB drive, then you will be prompted to enter your GPG key passphrase. When the restore is complete you can remove the USB drive.
46 
 * Distributed backups
 48 
 * Distributed backups
47 
 Distributed backups are a better way of ensuring the persistence of your data, such that even if your system gets stolen or destroyed then the data will still be recoverable from your friends. Since the backups are encrypted your friends (or anyone else with access to their systems) won't be able to read your backed up content even if their systems are subsequently compromised.
 49 
 Distributed backups are a better way of ensuring the persistence of your data, such that even if your system gets stolen or destroyed then the data will still be recoverable from your friends. Since the backups are encrypted your friends (or anyone else with access to their systems) won't be able to read your backed up content even if their systems are subsequently compromised.
48
50

+ 2
- 2
doc/EN/installation.org 查看文件

181 
 * Keydrives
 181 
 * Keydrives
182 
 After installing for the first time it's a good idea to create some keydrives. These will store your gpg key so that if all else fails you will still be able to restore from backup. There are two ways to do this:
 182 
 After installing for the first time it's a good idea to create some keydrives. These will store your gpg key so that if all else fails you will still be able to restore from backup. There are two ways to do this:
183 
 ** Master Keydrive
 183 
 ** Master Keydrive
184 
-This is the traditional security model in which you carry your full keyring on an encrypted USB drive. To make a master keydrive first format a USB drive as a LUKS encrypted drive. In Ubuntu this can be done from the "Discs" application. Then plug it into the Freedombone system, then from your local machine run:
184 
+This is the traditional security model in which you carry your full keyring on an encrypted USB drive. To make a master keydrive first format a USB drive as a LUKS encrypted drive. In Ubuntu this can be [[https://help.ubuntu.com/community/EncryptedFilesystemsOnRemovableStorage][done from the /Disk Utility/ application]]. Then plug it into the Freedombone system, then from your local machine run:
185
185
186 
 #+BEGIN_SRC bash
 186 
 #+BEGIN_SRC bash
187 
 ssh myusername@mydomainname -p 2222
 187 
 ssh myusername@mydomainname -p 2222
193
193
194 
 If you are on a Beaglebone Black then use /sda/ rather than /sdb/ for the drive parameter.
 194 
 If you are on a Beaglebone Black then use /sda/ rather than /sdb/ for the drive parameter.
195 
 ** Fragment keydrives
 195 
 ** Fragment keydrives
196 
-This breaks your GPG key into a number of fragments and randomly selects one to add to the USB drive. First format a USB drive as a LUKS encrypted drive. In Ubuntu this can be done from the "Discs" application. Plug it into the Freedombone system then from your local machine run the following commands:
196 
+This breaks your GPG key into a number of fragments and randomly selects one to add to the USB drive. First format a USB drive as a LUKS encrypted drive. In Ubuntu this [[https://help.ubuntu.com/community/EncryptedFilesystemsOnRemovableStorage][can be done from the /Disk Utility/ application]]. Plug it into the Freedombone system then from your local machine run the following commands:
197
197
198 
 #+BEGIN_SRC bash
 198 
 #+BEGIN_SRC bash
199 
 ssh myusername@mydomainname -p 2222
 199 
 ssh myusername@mydomainname -p 2222

+ 47
- 38
website/EN/backups.html 查看文件

4 
 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
 4 
 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
5 
 <head>
 5 
 <head>
6 
 <title></title>
 6 
 <title></title>
7 
-<!-- 2015-04-10 Fri 13:50 -->
7 
+<!-- 2015-07-05 Sun 20:29 -->
8 
 <meta  http-equiv="Content-Type" content="text/html;charset=utf-8" />
 8 
 <meta  http-equiv="Content-Type" content="text/html;charset=utf-8" />
9 
 <meta  name="generator" content="Org-mode" />
 9 
 <meta  name="generator" content="Org-mode" />
10 
 <meta  name="author" content="Bob Mottram" />
 10 
 <meta  name="author" content="Bob Mottram" />
11 
 <meta  name="description" content="Turn the Beaglebone Black into a personal communications server"
 11 
 <meta  name="description" content="Turn the Beaglebone Black into a personal communications server"
12 
  />
 12 
  />
13 
 <meta  name="keywords" content="freedombox, debian, beaglebone, red matrix, email, web server, home server, internet, censorship, surveillance, social network, irc, jabber" />
 13 
 <meta  name="keywords" content="freedombox, debian, beaglebone, red matrix, email, web server, home server, internet, censorship, surveillance, social network, irc, jabber" />
14 
+<meta  name="viewport" content="width=device-width, initial-scale=1" />
14 
 <style type="text/css">
 15 
 <style type="text/css">
15 
  <!--/*--><![CDATA[/*><!--*/
 16 
  <!--/*--><![CDATA[/*><!--*/
16 
-  .title  { text-align: center; }
17 
+  .title  { text-align: center;
18 
+             margin-bottom: .2em; }
19 
+  .subtitle { text-align: center;
20 
+              font-size: medium;
21 
+              font-weight: bold;
22 
+              margin-top:0; }
17 
   .todo   { font-family: monospace; color: red; }
 23 
   .todo   { font-family: monospace; color: red; }
18 
   .done   { font-family: monospace; color: green; }
 24 
   .done   { font-family: monospace; color: green; }
19 
   .priority { font-family: monospace; color: orange; }
 25 
   .priority { font-family: monospace; color: orange; }
21 
             padding: 2px; font-size: 80%; font-weight: normal; }
 27 
             padding: 2px; font-size: 80%; font-weight: normal; }
22 
   .timestamp { color: #bebebe; }
 28 
   .timestamp { color: #bebebe; }
23 
   .timestamp-kwd { color: #5f9ea0; }
 29 
   .timestamp-kwd { color: #5f9ea0; }
24 
-  .right  { margin-left: auto; margin-right: 0px;  text-align: right; }
25 
-  .left   { margin-left: 0px;  margin-right: auto; text-align: left; }
26 
-  .center { margin-left: auto; margin-right: auto; text-align: center; }
30 
+  .org-right  { margin-left: auto; margin-right: 0px;  text-align: right; }
31 
+  .org-left   { margin-left: 0px;  margin-right: auto; text-align: left; }
32 
+  .org-center { margin-left: auto; margin-right: auto; text-align: center; }
27 
   .underline { text-decoration: underline; }
 33 
   .underline { text-decoration: underline; }
28 
   #postamble p, #preamble p { font-size: 90%; margin: .2em; }
 34 
   #postamble p, #preamble p { font-size: 90%; margin: .2em; }
29 
   p.verse { margin-left: 3%; }
 35 
   p.verse { margin-left: 3%; }
62 
   caption.t-above { caption-side: top; }
 68 
   caption.t-above { caption-side: top; }
63 
   caption.t-bottom { caption-side: bottom; }
 69 
   caption.t-bottom { caption-side: bottom; }
64 
   td, th { vertical-align:top;  }
 70 
   td, th { vertical-align:top;  }
65 
-  th.right  { text-align: center;  }
66 
-  th.left   { text-align: center;   }
67 
-  th.center { text-align: center; }
68 
-  td.right  { text-align: right;  }
69 
-  td.left   { text-align: left;   }
70 
-  td.center { text-align: center; }
71 
+  th.org-right  { text-align: center;  }
72 
+  th.org-left   { text-align: center;   }
73 
+  th.org-center { text-align: center; }
74 
+  td.org-right  { text-align: right;  }
75 
+  td.org-left   { text-align: left;   }
76 
+  td.org-center { text-align: center; }
71 
   dt { font-weight: bold; }
 77 
   dt { font-weight: bold; }
72 
   .footpara:nth-child(2) { display: inline; }
 78 
   .footpara:nth-child(2) { display: inline; }
73 
   .footpara { display: block; }
 79 
   .footpara { display: block; }
148 
 <a name="top" id="top"></a>
 154 
 <a name="top" id="top"></a>
149 
 </div>
 155 
 </div>
150 
 <div id="content">
 156 
 <div id="content">
151 
-<h1 class="title"></h1>
152 
 <div class="center">
 157 
 <div class="center">
153
158
154 
 <div class="figure">
 159 
 <div class="figure">
162
167
163
168
164 
 <colgroup>
 169 
 <colgroup>
165 
-<col  class="left" />
170 
+<col  class="org-left" />
166 
 </colgroup>
 171 
 </colgroup>
167 
 <tbody>
 172 
 <tbody>
168 
 <tr>
 173 
 <tr>
169 
-<td class="left"><a href="index.html">Home</a></td>
174 
+<td class="org-left"><a href="index.html">Home</a></td>
170 
 </tr>
 175 
 </tr>
171
176
172 
 <tr>
 177 
 <tr>
173 
-<td class="left"><a href="#unnumbered-1">Backup to USB</a></td>
178 
+<td class="org-left"><a href="#orgheadline1">Backup to USB</a></td>
174 
 </tr>
 179 
 </tr>
175
180
176 
 <tr>
 181 
 <tr>
177 
-<td class="left"><a href="#unnumbered-2">Restore from USB</a></td>
182 
+<td class="org-left"><a href="#orgheadline2">Restore from USB</a></td>
178 
 </tr>
 183 
 </tr>
179
184
180 
 <tr>
 185 
 <tr>
181 
-<td class="left"><a href="#unnumbered-3">Distributed backups</a></td>
186 
+<td class="org-left"><a href="#orgheadline3">Distributed backups</a></td>
182 
 </tr>
 187 
 </tr>
183
188
184 
 <tr>
 189 
 <tr>
185 
-<td class="left"><a href="#unnumbered-4">Restore from a friend</a></td>
190 
+<td class="org-left"><a href="#orgheadline4">Restore from a friend</a></td>
186 
 </tr>
 191 
 </tr>
187 
 </tbody>
 192 
 </tbody>
188 
 </table>
 193 
 </table>
189 
 </div>
 194 
 </div>
190
195
191 
-<div id="outline-container-unnumbered-1" class="outline-2">
192 
-<h2 id="unnumbered-1">Backup to USB</h2>
193 
-<div class="outline-text-2" id="text-unnumbered-1">
196 
+<div id="outline-container-orgheadline1" class="outline-2">
197 
+<h2 id="orgheadline1">Backup to USB</h2>
198 
+<div class="outline-text-2" id="text-orgheadline1">
199 
+<p>
200 
+First and foremost - <b>encrypt your USB drives</b>! Even if you think you have "<i>nothing to hide</i>" if you accidentally lose a USB thumb drive (it's easy to lose small objects) and it's not encrypted then potentially someone might be able to obtain enough information about you to commit identity fraud, take out loans, open bank accounts, etc. Use LUKS encryption. In Ubuntu you can do this using the <i>Disk Utility</i> application. Some instructions <a href="https://help.ubuntu.com/community/EncryptedFilesystemsOnRemovableStorage">can be found here</a>.
201 
+</p>
202 
+
194 
 <p>
 203 
 <p>
195 
 Insert a USB thumb drive into the front socket of the Beaglebone Black.
 204 
 Insert a USB thumb drive into the front socket of the Beaglebone Black.
196 
 </p>
 205 
 </p>
208 
 </div>
 217 
 </div>
209
218
210 
 <p>
 219 
 <p>
211 
-If this is the first time that you've made a backup then you will be prompted for your GPG key password.
220 
+Type in the password for the USB drive, then if this is the first time that you've made a backup then you will be prompted for your GPG key passphrase.
212 
 </p>
 221 
 </p>
213
222
214 
 <p>
 223 
 <p>
216 
 </p>
 225 
 </p>
217 
 </div>
 226 
 </div>
218 
 </div>
 227 
 </div>
219 
-<div id="outline-container-unnumbered-2" class="outline-2">
220 
-<h2 id="unnumbered-2">Restore from USB</h2>
221 
-<div class="outline-text-2" id="text-unnumbered-2">
228 
+<div id="outline-container-orgheadline2" class="outline-2">
229 
+<h2 id="orgheadline2">Restore from USB</h2>
230 
+<div class="outline-text-2" id="text-orgheadline2">
222 
 <p>
 231 
 <p>
223 
 Insert the USB thumb drive containing your backup into the front socket of the Beaglebone Black.
 232 
 Insert the USB thumb drive containing your backup into the front socket of the Beaglebone Black.
224 
 </p>
 233 
 </p>
236 
 </div>
 245 
 </div>
237
246
238 
 <p>
 247 
 <p>
239 
-You will be prompted to enter your GPG key password, then when the restore is complete you can remove the USB drive.
248 
+Enter the password for the USB drive, then you will be prompted to enter your GPG key passphrase. When the restore is complete you can remove the USB drive.
240 
 </p>
 249 
 </p>
241 
 </div>
 250 
 </div>
242 
 </div>
 251 
 </div>
243 
-<div id="outline-container-unnumbered-3" class="outline-2">
244 
-<h2 id="unnumbered-3">Distributed backups</h2>
245 
-<div class="outline-text-2" id="text-unnumbered-3">
252 
+<div id="outline-container-orgheadline3" class="outline-2">
253 
+<h2 id="orgheadline3">Distributed backups</h2>
254 
+<div class="outline-text-2" id="text-orgheadline3">
246 
 <p>
 255 
 <p>
247 
 Distributed backups are a better way of ensuring the persistence of your data, such that even if your system gets stolen or destroyed then the data will still be recoverable from your friends. Since the backups are encrypted your friends (or anyone else with access to their systems) won't be able to read your backed up content even if their systems are subsequently compromised.
 256 
 Distributed backups are a better way of ensuring the persistence of your data, such that even if your system gets stolen or destroyed then the data will still be recoverable from your friends. Since the backups are encrypted your friends (or anyone else with access to their systems) won't be able to read your backed up content even if their systems are subsequently compromised.
248 
 </p>
 257 
 </p>
288 
 </p>
 297 
 </p>
289 
 </div>
 298 
 </div>
290 
 </div>
 299 
 </div>
291 
-<div id="outline-container-unnumbered-4" class="outline-2">
292 
-<h2 id="unnumbered-4">Restore from a friend</h2>
293 
-<div class="outline-text-2" id="text-unnumbered-4">
294 
-</div><div id="outline-container-unnumbered-5" class="outline-3">
295 
-<h3 id="unnumbered-5">With a completely new Freedombone installation</h3>
296 
-<div class="outline-text-3" id="text-unnumbered-5">
300 
+<div id="outline-container-orgheadline4" class="outline-2">
301 
+<h2 id="orgheadline4">Restore from a friend</h2>
302 
+<div class="outline-text-2" id="text-orgheadline4">
303 
+</div><div id="outline-container-orgheadline5" class="outline-3">
304 
+<h3 id="orgheadline5">With a completely new Freedombone installation</h3>
305 
+<div class="outline-text-3" id="text-orgheadline5">
297 
 <p>
 306 
 <p>
298 
 This is the ultimate disaster recovery scenario in which you are beginning completely from scratch with new hardware and a new Freedombone installation (configured with the same username and domain names). It is assumed that the old hardware was destroyed, but that you have the backup key stored within a password manager on a USB thumb drive.
 307 
 This is the ultimate disaster recovery scenario in which you are beginning completely from scratch with new hardware and a new Freedombone installation (configured with the same username and domain names). It is assumed that the old hardware was destroyed, but that you have the backup key stored within a password manager on a USB thumb drive.
299 
 </p>
 308 
 </p>
345 
 </div>
 354 
 </div>
346 
 </div>
 355 
 </div>
347 
 </div>
 356 
 </div>
348 
-<div id="outline-container-unnumbered-6" class="outline-3">
349 
-<h3 id="unnumbered-6">On an existing Freedombone installation</h3>
350 
-<div class="outline-text-3" id="text-unnumbered-6">
357 
+<div id="outline-container-orgheadline6" class="outline-3">
358 
+<h3 id="orgheadline6">On an existing Freedombone installation</h3>
359 
+<div class="outline-text-3" id="text-orgheadline6">
351 
 <p>
 360 
 <p>
352 
 This is for more common situations in which maybe some data became corrupted and you want to restore it.
 361 
 This is for more common situations in which maybe some data became corrupted and you want to restore it.
353 
 </p>
 362 
 </p>

+ 3
- 3
website/EN/installation.html 查看文件

4 
 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
 4 
 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
5 
 <head>
 5 
 <head>
6 
 <title></title>
 6 
 <title></title>
7 
-<!-- 2015-07-05 Sun 19:54 -->
7 
+<!-- 2015-07-05 Sun 20:31 -->
8 
 <meta  http-equiv="Content-Type" content="text/html;charset=utf-8" />
 8 
 <meta  http-equiv="Content-Type" content="text/html;charset=utf-8" />
9 
 <meta  name="generator" content="Org-mode" />
 9 
 <meta  name="generator" content="Org-mode" />
10 
 <meta  name="author" content="Bob Mottram" />
 10 
 <meta  name="author" content="Bob Mottram" />
563 
 <h3 id="orgheadline12">Master Keydrive</h3>
 563 
 <h3 id="orgheadline12">Master Keydrive</h3>
564 
 <div class="outline-text-3" id="text-orgheadline12">
 564 
 <div class="outline-text-3" id="text-orgheadline12">
565 
 <p>
 565 
 <p>
566 
-This is the traditional security model in which you carry your full keyring on an encrypted USB drive. To make a master keydrive first format a USB drive as a LUKS encrypted drive. In Ubuntu this can be done from the "Discs" application. Then plug it into the Freedombone system, then from your local machine run:
566 
+This is the traditional security model in which you carry your full keyring on an encrypted USB drive. To make a master keydrive first format a USB drive as a LUKS encrypted drive. In Ubuntu this can be <a href="https://help.ubuntu.com/community/EncryptedFilesystemsOnRemovableStorage">done from the <i>Disk Utility</i> application</a>. Then plug it into the Freedombone system, then from your local machine run:
567 
 </p>
 567 
 </p>
568
568
569 
 <div class="org-src-container">
 569 
 <div class="org-src-container">
585 
 <h3 id="orgheadline13">Fragment keydrives</h3>
 585 
 <h3 id="orgheadline13">Fragment keydrives</h3>
586 
 <div class="outline-text-3" id="text-orgheadline13">
 586 
 <div class="outline-text-3" id="text-orgheadline13">
587 
 <p>
 587 
 <p>
588 
-This breaks your GPG key into a number of fragments and randomly selects one to add to the USB drive. First format a USB drive as a LUKS encrypted drive. In Ubuntu this can be done from the "Discs" application. Plug it into the Freedombone system then from your local machine run the following commands:
588 
+This breaks your GPG key into a number of fragments and randomly selects one to add to the USB drive. First format a USB drive as a LUKS encrypted drive. In Ubuntu this <a href="https://help.ubuntu.com/community/EncryptedFilesystemsOnRemovableStorage">can be done from the <i>Disk Utility</i> application</a>. Plug it into the Freedombone system then from your local machine run the following commands:
589 
 </p>
 589 
 </p>
590
590
591 
 <div class="org-src-container">
 591 
 <div class="org-src-container">