TrueCrypt

From Gentoo Linux Wiki

Filesystems TOC

Filesystem overview Journaling filesystems Ext4 Reiser4 Proprietary filesystems Mounting Windows Partitions NTFS-3G Virtual filesystems Initramfs Network filesystems NFS Mounting SFTP and FTP shares Samba GlusterFS OpenAFS with MIT Kerberos Encrypted filesystems TrueCrypt LVM2, DM-Crypt and RAID root DM-Crypt with LUKS AES-encrypted root partition using LVM2 Compressed filesystems Squashed Portage Tree (squashfs) Volume management LVM RAID Filesystems tricks Using Graphics Card Memory as Swap Automount Swap Early

This page will show you the steps to install TrueCrypt, an open-source cross-platform software allowing you to manage encrypted disks. The main features are its creation of virtual encrypted disks and the encryption of entire partitions. There are two different security levels available: The hidden volume (see the official website for details) and the normal volume.

[edit] Requirements

TrueCrypt needs a 2.6.5 kernel (or higher/compatible) with both device mapper and loop device enabled (TrueCrypt itself however warns when using kernel older than 2.6.24 due to the bug in older kernels possibly causing system freeze when writing to the encrypted volume). Make sure that the kernel is configured as follows:

Device Drivers ---> 
  [*] Multiple devices driver support (RAID and LVM) --->
    <*> Device mapper support
    <*>   Crypt target support
  [*] Block Devices --->
    <*> Loopback device support
File systems --->
  <*> FUSE (Filesystem in Userspace) support
[*] Cryptographic API --->
  <*> RIPEMD-160 digest algorithm 
  <*> SHA384 and SHA512 digest algorithms
  <*> Whirlpool digest algorithms
  <*> LRW support (EXPERIMENTAL)
  <*> XTS support (EXPERIMENTAL)
  <*> AES cipher algorithms
  <*> Serpent cipher algorithm
  <*> Twofish cipher algorithm

Next, recompile and reboot into the new kernel (or just install the new modules if you marked all as modules).

[edit] Install

Add app-crypt/truecrypt in /etc/portage/package.keywords

app-crypt/truecrypt

Type:

and follow instructions (depends on your configuration and package version).

Approximate instructions:

Download tar.gz source from http://www.truecrypt.org/downloads2.php, rename in truecrypt-6.3a.tar.gz and put the file in /usr/portage/distfiles/

Type:

[edit] Usage

[edit] Create a volume

Simply follow the TrueCrypt assistant:

Create a linux filesystem on your volume (ext2 used as an example):

[edit] NTFS volume

If you're on TrueCrypt >v6.0 and e.g. like to create an ntfs volume and are using ntfs-3g through FUSE, this sequence of commands will probably be more like this:

Note where truecrypt mounted the exterior volume, e.g.: /dev/loop0 on /mnt/mountpoint type fuseblk (rw,noatime,allow_other,default_permissions,blksize=4096)

For truecrypt 6a, when you want mount volume without filesystem, you must use

then only loop is created. Otherwise truecrypt ask you for "Enter mount directory" and later you get "Error: mount: you must specify the filesystem type"

You can also set the mount options, for example to set the ownership to a specific user/group

Unmount the volume (-d parameter without any other argument will dismount any mounted volume):

[edit] Mount volumes as a normal user

Truecrypt needs root privileges to work: this procedure will allow normal users to use it, also giving writing permissions to mounted volumes.

First of all, you must have sudo installed. If not, just type:

Now we have to create a new group called truecrypt and give it the necessary permissions. Any users that will belong to that group, will be able to use TrueCrypt.

Use the just opened editor to attach the following lines at the bottom of the configuration file:

# Users in the truecrypt group are allowed to run truecrypt as root.
%truecrypt ALL=(root) NOPASSWD:/usr/bin/truecrypt

Before adding our users to the truecrypt group we still have to do something in order to make mounted volumes writable from normal users. To do this just open the system-wide bashrc file:

And add this few lines to it:

alias tc='sudo truecrypt'
alias tcm='tc -M uid=$(id -u),gid=$(id -g)'

You can now add your users to the truecrypt group:

Use the tc alias to generically use truecrypt, (i.e. tc -d [volume] if you want to dismount a volume) and tcm to mount an encrypted volume.

If after doing the steps above you don't have access to the partition as a normal user then change the ownership of the folder in which the partition was mounted after being mounted. The steps above did not work for me and this was the only way I was able to access the partition as a normal user since the options passed through the -M option to the mount command weren't accepted.

[edit] Safely unmount and unmap volumes on shutdown

Add this line to /etc/conf.d/local.stop.

[edit] Mount volume via fstab

Create the following file in /sbin

#!/bin/sh
OPTIONS="`echo $* |  sed 's/-o */--fs-options=/g'`"
sudo truecrypt $OPTIONS

Then you can mount your truecrypt device via the following line in fstab

/dev/sdb3 mountpoint          truecrypt defaults,noauto,user        0       2

By adding

 Defaults env_keep=DISPLAY
 Defaults env_keep+=XAUTHORITY

below

 # Reset environment by default
 Defaults        env_reset

when running visudo you also get graphical feedback in truecrypt-5.1a

Here is an extended version of /sbin/mount.truecrypt:

#!/usr/bin/env sh

DEV="$1"
MNTPT="$2"
OPTIONS=""
TCOPTIONS=""

# skip device, mountpoint and '-o'
shift 3
IFS=','
for arg in $*; do
    if [ "${arg}" == "system" ]; then
        TCOPTIONS="${TCOPTIONS}-m=system "
    elif [[ "${arg}" == fs=* ]]; then
        FS=${arg#*=}
        TCOPTIONS="${TCOPTIONS}--filesystem=${FS} "
    else
        OPTIONS="${OPTIONS}${arg},"
    fi
done

sudo truecrypt ${DEV} ${MNTPT} ${TCOPTIONS% *} --fs-options="${OPTIONS%,*}"

Now you can mount system volumes and specify the filesystem type like this

/dev/hda2           /mnt/win            truecrypt       system,noauto,umask=000         0 0
/dev/hda7           /mnt/shared         truecrypt       fs=ntfs-3g,noauto,defaults      0 0

/dev/hda2 is an encrypted system partition (system option) and /dev/hda7 gets mounted as a ntfs-3g partition (fs option)

[edit] Troubleshooting

If the transfer speeds are low, try using the noatime option on mount:

If TrueCrypt gives you an error when mounting volume:

device-mapper: reload ioctl failed: Invalid argument 
Command failed

you need to add XTS and/or LRW support in the kernel. See Requirements.

If you are positive that you have XTS and/or LRW support in the kernel but still get the above error, it may be necessary to disable kernel cryptographic services when mounting altogether:

Of course you may add any other necessary option on the commmand line as well. Note that truecrypt will have decreased performance when using this option.

[edit] See also

• TrueCrypt home page
• SUDO Main Page
• HOWTO Truecrypt - Italian translation
• HOWTO Truecrypt in yarik-overlay