Buffalo NAS-Central Forums

Welcome to the Linkstation Wiki community
It is currently Thu Apr 24, 2014 4:52 am

All times are UTC [ DST ]




Post new topic Reply to topic  [ 18 posts ]  Go to page 1, 2  Next
Author Message
PostPosted: Sat Aug 12, 2006 8:12 am 
Offline
Newbie

Joined: Fri Jul 21, 2006 6:51 am
Posts: 26
Location: Austria, Vienna
Hi,

i am actually in the process of securing my media related files at home against unwanted access... (with my downloading notebook already done)

my plan is the follwing, hdhglan, 2 hdd's on the internal ide-bus (will be done this weekend), one hdd on usb (to come up to one 1tb, just to have it :D ... and everything should be encrypted; i read already about encfs, but before i start i have some questions.

1) i would like to have one logical volume with all 3 harddisks, is it possible to connect to volumes also if there is already some data on it? or can i just create a big volume (with lvm i suppose) when everything is empty? (i would prefer jbod, no raid level)

2) can i add a third hard disk later on to the lvm?

3) when encrypting this big volume, can i do this with data on it, or does the volume need to be empty

4) same question like 2, but if it is an encrypted volume

5) i would like no to work with passwords for the encryption, but to put the key file on a usb stick which is connected to the hdhglan, and it should only mount the volume if the usb stick is present... a usb stick is hidden quite fast...

i really would appreciate some help, the last years i fully became a user, but now since one month i am back, i installed linux, compiled kernel, installed free-link, ... but still no deep knowledge available, i am just able to read how-tos Confused


Top
 Profile  
 
PostPosted: Sat Aug 12, 2006 10:15 am 
Offline
Site Admin
User avatar

Joined: Sun Jul 17, 2005 4:34 pm
Posts: 5330
Location: Cologne, Germany
That's an ambitious project for a newbie. I suggest you ask these questions on a dedicated Debian list, for example on "debian-user-german@lists.debian.org". Careful with the HDDs, you might overheat the LS.

_________________
HG · Debian squeeze
Linux Kernel 2.6/PPC (and more!) for Linkstation/KuroBox/HG/HS/Terastation from http://hvkls.dyndns.org


Top
 Profile  
 
PostPosted: Sat Aug 12, 2006 1:33 pm 
Offline
Moderator
User avatar

Joined: Thu Apr 06, 2006 1:33 pm
Posts: 1082
Location: United States of America
As andre says that's pretty ambitious.


1.
I would dispense with the idea of using a USB drive in your "RAID" it would slow your whole setup down and be kind of dangerous from a data standpoint. the two drives you manage to put into your box as a slave and master drive will participate in a RAID ok.
regardless of how you do this you'd be creating a pseudo RAID with LVM

http://www.tldp.org/HOWTO/LVM-HOWTO/recipethreescsi.html

or a software RAID using RAIDTOOLS or MDADM

http://www.tldp.org/HOWTO/Software-RAID-HOWTO-5.html

I'd ask on a debian forum like Andre suggests, as I've never done this before, one Kuro user seems to have done it on the Kuro Forum (I think you'd need an external enclosure and power supply though)

http://www.kurobox.com/forums/viewtopic.php?t=659&highlight=dual+drives


BTW 2-750 GB Seagate PATA Drives would end up giving you a 1.5TB package if you so desired.

2.
Careful with trying to add devices to a software RAID, stick with the two internal drives. and just mount your other drive somewhere inside a directory that belongs to the RAIDED drive. you can use [i]df[/i]
to monitor the space on your devices rather easily.

3,4.
There are quite a few ways to encrypt data onto a drive, if you encrypt the whole block device. like with Loopaes or Truecrypt you can't add space to it. If you individually encrypt each file and store it on the block device (like with ENCFS) then you can make the device as big as you want so long as you manage to get the files back onto the resultant block device

http://www.linux.com/article.pl?sid=06/03/13/1656228
http://en.wikipedia.org/wiki/Disk_encryption_software

5. Careful with this idea, you loose the key you loose your data, gone kaput, non-recoverable period. (With ENCFS since I am familiar with this you could come up with a script to look for your USB drive, copy the key file over to the directory where your encrypted data lies.... THEN you can mount the encrypted device. When you leave and unmount the encrypted device you could just delete the key, or to be real anal use a tool like wipe or bcwipe to do a multipass wipe of the keyfile you copied over.

If you can't come up with this script on your own then you may be better off not trying until you gain a little bit more comfort and experience with writing some shell scripts, and with linux, you can always make this your "last" project in the quest to do this.

=======
=======
My advice to you would be to stick with RAIDing your two "internal" drives together first with RAIDTOOLS or MDADM (I think that's how the terastation does it anyways). Once you do that you can use a myriad of options to place an encrypted volume there personally I think the ENCFS and Truecrypt options are easiest

A terastation user has already used Truecrypt
http://www.terastation.org/wiki/Encryption%2C_NTFS_Support%2C_and_Windows_Share_Management

And of course I use ENCFS
http://buffalo.nas-central.org/index.php?title=Encrypted_Filespace_with_EncFS

-KP

_________________
-Ramuk

LinkStation HG *250 Uboot - Foonas-EM - Freelink
Kuro HG *750 Uboot - Foonas-EM - Debian Squeeze
Kuro HD *60 Uboot - Foonas-EM - Debian Squeeze (For Sale)
KuroPro *2TB Debian Lenny Armel- Kernel 2.6.26
KuroPro *1TB Debian Lenny Armel- Kernel 2.6.25.6


Top
 Profile  
 
PostPosted: Sun Aug 13, 2006 8:32 am 
Offline
Newbie

Joined: Fri Jul 21, 2006 6:51 am
Posts: 26
Location: Austria, Vienna
Hi,

thanks your help and your links - i know that it is ambitious, unfortunately (my target is not to get a linux specialist, but just to implement my security concept).

.) i am not happy at all to have to connect the harddisk via usb, but unfortunately there is no 2nd channel available on the linkstation (otherwise i would make a raid5 with 4 harddisks). i am going to use a second psu for the harddisks, that is clear. (btw. 2*750gb is really expensive, 320gb offer the best cost/gb ratio at the moment)

so i think i will start with creating the lvm with the two internal drives, and then encrypt it (i prefer truecrypt; as - as far as i understood - then the whole disk is encrypted including the directory tables, and not just the file) - hopefully i did not destroy my linkstation when unsolding the cable yesterday....

let's see if i can manage it :D will keep you postet

kind regards
christian


Top
 Profile  
 
PostPosted: Sun Aug 13, 2006 9:50 am 
Offline
Site Admin
User avatar

Joined: Sun Jul 17, 2005 4:34 pm
Posts: 5330
Location: Cologne, Germany
Fifilein wrote:
my target is not to get a linux specialist, but just to implement my security concept


That's where commercial support comes into the Open Source picture I guess.

_________________
HG · Debian squeeze
Linux Kernel 2.6/PPC (and more!) for Linkstation/KuroBox/HG/HS/Terastation from http://hvkls.dyndns.org


Top
 Profile  
 
PostPosted: Sun Aug 13, 2006 10:47 am 
Offline
Moderator
User avatar

Joined: Thu Apr 06, 2006 1:33 pm
Posts: 1082
Location: United States of America
Fifilein wrote:
as - as far as i understood - then the whole disk is encrypted including the directory tables, and not just the file) - hopefully i did not destroy my linkstation when unsolding the cable yesterday....


Good luck, make sure to take plenty of pictures and upload them to the wiki along with instructions on how to add two drives if you are successful. Truecrypt is a good option, I think the newset version 4.2 offers the option the create the volumes ON Linux. but you'll have to compile it from source.

-KP

_________________
-Ramuk

LinkStation HG *250 Uboot - Foonas-EM - Freelink
Kuro HG *750 Uboot - Foonas-EM - Debian Squeeze
Kuro HD *60 Uboot - Foonas-EM - Debian Squeeze (For Sale)
KuroPro *2TB Debian Lenny Armel- Kernel 2.6.26
KuroPro *1TB Debian Lenny Armel- Kernel 2.6.25.6


Top
 Profile  
 
PostPosted: Sun Aug 20, 2006 6:50 pm 
Offline
Newbie

Joined: Fri Jul 21, 2006 6:51 am
Posts: 26
Location: Austria, Vienna
Hi,

well, i did it... :D :D :D
my hglan is in the process of copying from the old harddrive to a cryptsetup/lvm volume, afterwards i am going to add the old harddisk to the lvm and extend the partition voila..

the temp run was successfull (with smaller partitions and files), so this will be my production system. some stuff is missing, it does not mount the volume automatically and such stuff, but those are minor issues, and just adding some commands into the starting script.

how i did it
Emtpy 320gb into hd-hdlan (for testing and developing purposes)


Recover a non working "bricked" Linkstation
http://buffalo.nas-central.org/index.php?title=Articles/GeneralRescueGuide
with Firmware
http://buffalo.nas-central.org/download/freelink/freelink_powerpc-hdhglan-1.11.zip

Freelink - Convert the LinkStation into a Full-fledged Debian Linux Server
http://buffalo.nas-central.org/index.php?title=Freelink_-_Convert_the_LinkStation_into_a_Full-fledged_Debian_Linux _Server
Attention: I changed the apt sources to debian/testing and worked with aptitude

Upgrade to the 2.6-kernel (ppc only) with webinstaller
http://buffalo.nas-central.org/index.php?title=Upgrade_to_the_2.6-kernel_%28ppc_only%29

CryptoDateiHowto, Working with Point 3 (i did not get luks working)
https://systemausfall.org/wikis/howto/CryptoDateiHowto
replaced $cryptodatei by /dev/hdx (so it crypts the whole filesystem, not a file on a filesystem)
"cryptsetup -c aes-cbc-essiv:sha256 -d /mnt/usb/nas.key -s 256 create crypthda3 /dev/hda3"
whereby /mnt/usb/nas.key created with dd if=/dev/random of=/mnt/usb/nas.key bs=32 count=1

Linux auf dem Samsung X20 Laptop mit LVM2 und Verschlüsselung (taking here the Part after cryptsetup, just the lvm part)
http://tuxmobil.de/samsung_x20_linux_lvm_encryption.html/

well, thats the actual status, now it is copying from /dev/hdb3 (former 400gb) to /dev/nas_storage/nas_volume, tomorrow i will resize:
http://www.selflinux.org/selflinux/html/lvm01.html#d67e331

it is now just mount the lvm if the cryptsetup devices is started and key is present, then you need to restart the lvm and it automatically intialises the lvm-devices.

thanks for that huge amount of help with the links you sent me!!!

kind regards
christian


Top
 Profile  
 
PostPosted: Sun Aug 20, 2006 7:51 pm 
Offline
Site Admin
User avatar

Joined: Mon Jul 11, 2005 7:19 am
Posts: 7702
Location: Austria, Vienna
not bad.

i even think that soldering the cable was not needed...someone of the yahoo group added 2 hdd ports with a "extension-Cable"....on one side male (for connecting to the cable thats already there) and two connectors female (for the harddisks).

_________________
LS1 (2.6 kernel, foonas svn1062, 750 GB, UBoot 1.2) & LS Pro (FreeLink/jtymod/GenLink, changes all the time)
Thx to all donators!


Top
 Profile  
 
PostPosted: Sun Aug 20, 2006 8:41 pm 
Offline
Moderator
User avatar

Joined: Thu Apr 06, 2006 1:33 pm
Posts: 1082
Location: United States of America
Dude!

you used DM Crypt!!!!

please write this up for the Wiki if you can. it seems pretty much written up already but in german on the link you gave :( sorry no spreken :( Embarassed

post pictures in the the Wiki of what you did from a hardware standpoint too!!!!

Great work!
-KP



OH and one other thing can you use Bonnie+++ to do some speed comparisions like I did with my ENCFS solution

_________________
-Ramuk

LinkStation HG *250 Uboot - Foonas-EM - Freelink
Kuro HG *750 Uboot - Foonas-EM - Debian Squeeze
Kuro HD *60 Uboot - Foonas-EM - Debian Squeeze (For Sale)
KuroPro *2TB Debian Lenny Armel- Kernel 2.6.26
KuroPro *1TB Debian Lenny Armel- Kernel 2.6.25.6


Top
 Profile  
 
PostPosted: Mon Aug 21, 2006 6:53 am 
Offline
Newbie

Joined: Fri Jul 21, 2006 6:51 am
Posts: 26
Location: Austria, Vienna
hi ramuk

as soon as its finished i will put it in the wiki.

i also noticed, the advantage of my solution is you can add/remove hdd on-the-fly. if you add the 2nd harddrive you don't need to copy your original data somwhere where else (make system on new hdd, create cryptsetup/lvm on this hdd, copy old hdd to lvm-volume on new hdd, make old hdd part of lvm and resize file system -> one big volume)

i will make a benchmark, but i can tell you right now i have tremendous performance problem, i need to debug today evening. it just handled to copy 150gb over 12hours from old hdd/unencrypte to new/lvm/dm-crypt ... i don't want to calculate the average throughput :(

can i use the bonnie+++ benchmark on a partition with existing data?

kr
fif


Top
 Profile  
 
PostPosted: Mon Aug 21, 2006 7:59 am 
Offline
Site Admin
User avatar

Joined: Mon Jul 11, 2005 7:19 am
Posts: 7702
Location: Austria, Vienna
Fifilein wrote:
it just handled to copy 150gb over 12hours from old hdd/unencrypte to new/lvm/dm-crypt


3.555555556 MB/sek ... just to annoy you.

just4info - do not expect too much performance over samba, even if it is a hglan.

use this sheets for comparison:
http://www.tomsnetworking.com/2006/08/17/buffalo_linkstation_pro_review/page5.html

_________________
LS1 (2.6 kernel, foonas svn1062, 750 GB, UBoot 1.2) & LS Pro (FreeLink/jtymod/GenLink, changes all the time)
Thx to all donators!


Top
 Profile  
 
PostPosted: Mon Aug 21, 2006 8:53 am 
Offline
Newbie

Joined: Fri Jul 21, 2006 6:51 am
Posts: 26
Location: Austria, Vienna
Hi
mindbender wrote:


outsch, why is the hg-lan so slow? i was wondering already when i copied some stuff onto it, i will test the performance with encrypted filesystem and without ... and 3,5mb encrypted i could live with, i did not had more before :)

btw 2 questions (maybe i start an new threat)
1) i wanted to use xfs (don't know why, just big files on it - guess which - and i read that xfs is better for bigger files then ext3), there is no mkfs.xfs included, how do i get it, is xfs compiled into the kernel?
2) do i really need the swap partition, can't i just turn it off?

well, hopefully the data is copied when i come home, otherwise i can't do anything ...

kr
fif


Top
 Profile  
 
PostPosted: Mon Aug 21, 2006 9:35 am 
Offline
Moderator
User avatar

Joined: Thu Apr 06, 2006 1:33 pm
Posts: 1082
Location: United States of America
Fifilein wrote:
outsch, why is the hg-lan so slow? i was wondering already when i copied some stuff onto it, i will test the performance with encrypted filesystem and without ... and 3,5mb encrypted i could live with, i did not had more


Mindbender is right the transfer rates out or into the LS are never better than a 100mpbs ethernet connection could EASILY manage. ( so I'm not sure what the point of the gigabit ethernet)

However you are doing things right now INSIDE the linkstation. Your speed problem is in the processor ENCRYPTING files as you copy them over. You will no doubt find samba being your transfer rate ceiling when you try to put files onto the encrypted partition from outside the LS or read them from the LS.

Please let me know if you end up being able to place a big file onto the encrypted partition from OUTSIDE the LS with samba without a problem (big file means 300mb-1000gb)

_________________
-Ramuk

LinkStation HG *250 Uboot - Foonas-EM - Freelink
Kuro HG *750 Uboot - Foonas-EM - Debian Squeeze
Kuro HD *60 Uboot - Foonas-EM - Debian Squeeze (For Sale)
KuroPro *2TB Debian Lenny Armel- Kernel 2.6.26
KuroPro *1TB Debian Lenny Armel- Kernel 2.6.25.6


Top
 Profile  
 
PostPosted: Mon Aug 21, 2006 10:44 am 
Offline
Newbie

Joined: Fri Jul 21, 2006 6:51 am
Posts: 26
Location: Austria, Vienna
Hi,

ramuk wrote:
However you are doing things right now INSIDE the linkstation. Your speed problem is in the processor ENCRYPTING files as you copy them over. You will no doubt find samba being your transfer rate ceiling when you try to put files onto the encrypted partition from outside the LS or read them from the LS.


yes, actual at the moment everything is just working inside the hglan (having my computer still running the terminal because i was to stupid not to open "cp" via an extra shell). 3,5Mbyte seems a plausible limitation for the cpu, taking those benchmarks as basis and downscaling it from 2ghz to 266mhz
http://www.saout.de/tikiwiki/tiki-index.php?page=UserPageChonhulio

i am already very interessted in the benchmarks, especially maximal transfer rate from normal hdd and from encrypted device (here i should see the maximum throughput based on the cpu-limit).

what i don't expect to increase throughput from outside onto the hglan, my actual input is an unencrypted /dev/hdx, transfered via dma so i don't think it has a higher cpu utilisation then an input from the lan-interface.

ramuk wrote:
Please let me know if you end up being able to place a big file onto the encrypted partition from OUTSIDE the LS with samba without a problem (big file means 300mb-1000gb)

this makes me nervous, why shouldn't it work? my whole nas is filled with files 350mb to 700mb

btw. this table is very hard to read and i could also not import it into excel, can you put it onto the page as csv file please?
http://buffalo.nas-central.org/index.php?title=Articles/AddAnEncryptedFilespaceWithEncFS#Bonnie.2B.2B_I.2FO_Speeds

kind regards (until later)
christian

btw. any idea about xfs? then i would need to copy the files again :(


Top
 Profile  
 
PostPosted: Mon Aug 21, 2006 11:38 am 
Offline
Moderator
User avatar

Joined: Thu Apr 06, 2006 1:33 pm
Posts: 1082
Location: United States of America
Fifilein wrote:
btw. this table is very hard to read and i could also not import it into excel, can you put it onto the page as csv file please?
http://buffalo.nas-central.org/index.php?title=Articles/AddAnEncryptedFilespaceWithEncFS#Bonnie.2B.2B_I.2FO_Speeds


Sorry i generated this a LONG time ago and formatted it that way to get it into the Old Wiki. :)
I took out the ````` characters
but as far as comma delimiting it, you're on your own.

Dunno about XFS, XFS scares me a bit with regards to safety of data. although it may be a bit faster. I think the primary limitation is the processor. and Samba
-KP

_________________
-Ramuk

LinkStation HG *250 Uboot - Foonas-EM - Freelink
Kuro HG *750 Uboot - Foonas-EM - Debian Squeeze
Kuro HD *60 Uboot - Foonas-EM - Debian Squeeze (For Sale)
KuroPro *2TB Debian Lenny Armel- Kernel 2.6.26
KuroPro *1TB Debian Lenny Armel- Kernel 2.6.25.6


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 18 posts ]  Go to page 1, 2  Next

All times are UTC [ DST ]


Who is online

Users browsing this forum: No registered users and 3 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:

Protected by Anti-Spam ACP
Protected by Anti-Spam ACP Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group