Entire System / Boot Sector Encryption

[yeehi]

Hello!

Is there a good "How To" on encrypting an entire installation, including the boot sector?

[kevdog]

You need to install from the alternate CD and choose the LUKS encryption method. I wish I could recall all the details, however its is extremely easy and self explanatory.

I'm not sure if it encrypts the boot sector however. Hopefully someone else will be able to chime in on this.

[yeehi]

http://releases.ubuntu.com/8.04/

On the webpage above, I couldn't see MD5sum or SHA information for the Ubuntu alternative iso file.

Where is this information published, so that I can check the integrity of the file?

[Patsoe]

You need to install from the alternate CD and choose the LUKS encryption method. I wish I could recall all the details, however its is extremely easy and self explanatory.

I'm not sure if it encrypts the boot sector however. Hopefully someone else will be able to chime in on this.

No that will not encrypt the boot sector. It actually also requires an unencrypted /boot partition.

If you want to have even the MBR encrypted, you probably need hardware encryption tools.

[twisted_steel]

http://releases.ubuntu.com/8.04/

On the webpage above, I couldn't see MD5sum or SHA information for the Ubuntu alternative iso file.

Where is this information published, so that I can check the integrity of the file?

There is a MD5SUMS file on the page you listed that lists ubuntu-8.04-alternate-i386.iso and ubuntu-8.04-alternate-amd64.iso with their respective hashes. There is also a GPG signature file for the MD5SUMS.

[kevdog]

dm-crypt/LUKS DOES NOT encrypt the boot sector. In fact something needs to be unencrypted unless its integrated with the bios.

[yeehi]

There is a MD5SUMS file on the page you listed that lists ubuntu-8.04-alternate-i386.iso and ubuntu-8.04-alternate-amd64.iso with their respective hashes. There is also a GPG signature file for the MD5SUMS.

The page is meant to have links to md5sums but I only get the following error message when I follow the links:

ERROR
Service Unavailable

The requested service is unavailable.

Please try again later.

I did find the hashes here, though

https://help.ubuntu.com/community/UbuntuHashes

[sunbird]

There is this how-to, but as previous posters have said, luks does not encrypt /boot.

[Chayak]

Like it has been said, the boot partition is not encrypted but there's no reason you can't stick your /boot partition on a usb thumb drive if your computer can boot from usb.

[kevdog]

Do you actually have a working setup that can boot from usb? Id love to try this, however something tells me there is going to be some editing of some grub files and fstab files. I'd like to try if you have a How-To.