Basic Set Up Encrypted Swap on LMDE 2

Encrypted swap is essential if your usage sometimes require extra bit of memory on the legacy or solid state harddrive which happens to be fully encrypted.

In this post, i will briefly go through the steps in setting up encrypted swap partition on Debian GNU/Linux OS (Linux Mint variant) with a sysV init system.

To begin, let's save any changes to your work and check if the swap partition is in use using command 'free -m'  and deactivate the existing non-encrypted swap partition using command 'sudo swapoff -a'.

Next step is to initialise the (yet to be encrypted) swap partition as a LUKS formatted partition using 'sudo luksFormat /dev/sdaX' for a legacy harddrive where sd is the prefix for a sata interface connected harddrive, a is the English letter name convention for the first harddrive detected as such, and X is the Indian numerical name convention for partition to be used as swap. We will need to enter a password or passphrase for the setting up. It is advisable to choose a unique password that is different from the root or user password on your Debian system.

Now, we can create the conventional Linux swap area on the Luks formatted partition using 'sudo mkswap /dev/mapper/encryptedswap'. We then open the LUKS formatted drive '/dev/sdaX' and mapped it to '/dev/mapper/encryptedswap' using 'sudo  cryptsetup  open  --type  luks  /dev/sdaX  encryptedswap'.

We are finalising the change by editing the ('crypttab' and ('fstab' admin folder (/etc/crypttab and /etc/fstab) :

Under /etc/crypttab
# <target name> <source device>         <key file>      <options>
cswap /dev/sdaX /dev/urandom swap,luks

Note: you can also use the /dev/disk/by-id/wwn-.....-partX name convention as the source device.

Under /etc/fstab (comment out  or delete the existing swap partition)
# /dev/sdaX
/dev/mapper/cswap       none   swap    sw      0       0
Next we run update the initramfs so that the configuration at the admin folder should load at boot using ' sudo update-initramfs -u '

We then run 'swapon -s' to activate the 'encryptedswap' and check the status of the 'encryptedswap' using 'sudo cryptsetup status encryptedswap'. The status should read as '/dev/mapper/encryptedswap is active and is in use. ' and further information is listed as type, cipher, keysize (usually 256 bits) , device, offset, size and mode (usually read/write) .

We can further run ' free -m' and ' lsblk -la ' to verify the status. 'encryptedswap' with type crypt mountpoint [SWAP] should be listed below ' /dev/sdaX ' under lsblk command.


Follow my blog with Bloglovin

Hardening Edgerouter ER-X by SSH

Generating RSA keys on client device (e.g. Ubuntu 16.04 LTS):

ssh-keygen -t rsa

which will store key in $HOME directory. Then, prompt for passphrase will appear, but we will keep it empty. The ssh key pair is generated where id_rsa.pub is the public key (we can share with the public) and id_rsa is the private key (we shall keep it secret as long as we can)

Copying public SSH key from client to router (server):

scp ~/.ssh/id_rsa.pub username@router.current.ip.address:/home/username/.ssh

For e.g. the username is edgemax and the router ip address is 192.168.1.1, the command would be:

scp ~/.ssh/id_rsa.pub edgemax@192.168.1.1:/home/edgemax

Alternatively, we use ssh-copy-id to copy the key to ~/.ssh/authorized_keys :

 sudo ssh-copy-id -i .ssh/nvy_rsa.pub navoyjw@192.168.0.1

Setting ownership to username (better) if the owner of the files are not under you (check ownership or username using "ls -la /home/username/" ) as you do not need to access files as a root user [a prime security concern among GNU/Linux administrator or user]:

chown -R edgemax /home/edgemax

Setting the permission of folder in $HOME directory:

chmod 755 /home/edgemax [same as: chmod go-w /home/edgemax]
chmod 700 /home/edgemax/.ssh
chmod 600 /home/edgemax/.ssh/authorized_keys

chown edgemax: /home/edgemax/.ssh/authorized_keys

Editing the ssh_config file at path /etc/ssh/ssh_config by editing the line IdentityFile with the corresponding ssh key type (RSA in this example). Since we are using default name in this example, we keep the path and only remove the '#' character in front :

IdentityFile ~/.ssh/id_rsa

SSH in to the router using password and do the final step to activate SSH login and operate in configuration mode (edgemax@router_name:~$ configure):

loadkey /home/edgemax/.ssh/id_rsa.pub 

or,

 loadkey /home/edgemax/.ssh/authorized_keys #using ssh-copy-id 

After loadkey command, we commit and save and exit twice to extit ssh. Now we should be able to ssh into edgerouter securely.

Follow my blog with Bloglovin