How to Implement a Quick Encrypted /home Partition
by francisco roque

Table of Contents
Introduction
I have an old laptop that i carry around and needed an encrypted /home b/c i know i'll lose it sometime. Here are some easy steps for implementing such a system.
Necessary Equipment
A laptop running OpenBSD. Another, more secure system running OpenBSD.
For the purpose of this document, 'supay' is the hostname of the laptop, 'viracocha' is the name of the more secure system.
It is assumed that you know how to read manpages, compile kernels, patch files, and other simple unix tasks.
Instructions
Setting Up the Partition
1. Backup your /home partition. My drive is real small so i had to remotely back it up:
```
cd /
tar -zcvf - /home | ssh frisco@viracocha dd of=supay-home.tgz
```
2. In single user mode, or with all other users logged out (and logged in as root), unmount /home, newfs it, mount it under a different partition name and create a large empty file in it, almost the size of the partition:
```
umount /home
newfs /dev/rwd0g
mkdir /mnt/vnd
mount /dev/wd0g /mnt/vnd
#62mb file.  my /home was only 70m
dd of=/mnt/vnd/svnd0 bs=1048576 count=62
```
3. Associate an encrypted vnode device with that file, newfs that device, mount it as /home and restore those files.
```
vnconfig -ck svnd0 /mnt/vnd/svnd0
newfs /dev/rsvnd0c
mount /dev/svnd0c /home
ssh frisco@viracocha dd if=supay-home.tgz | tar -zxvf -
```
4. Either automount the partition at bootup (human interaction will be necessary to enter that password), or put the following lines in a script and run them at first login.
```
#!/bin/sh
vnconfig -k svnd0 /mnt/vnd/svnd0
mount /dev/svnd0c /home
```
Handling Problems/Backing Up
1. I don't mount it at boot time b/c often my battery drains, the laptop crashes and the partitions require some work to be cleaned. If this happens to you as well and you find that the partition is corrupt, these steps may restore your partition.
  First, configure the vnode (if not already done) and make sure you're using the right password, then use disklabel to reset c to 4.2BSD, finally fsck and mount the partition.
```
vnconfig -ck svnd0 /mnt/vnd/svnd0
disklabel -E /dev/svdn0c
#type 'm a', enter '4.2BSD' for partition type,
#type 'w' to write new label and 'q' to quit
fsck /dev/rsvnd0c
mount /dev/svnd0c /home
```
  If that doesn't work then recreate the fs and restore from backup.
2. Periodically copy the vnode file to a secure server so you have a good backup. You can use the above methods to verify the contents as well.
```
scp /mnt/vnd/svnd0 frisco@viracocha:svnd0-supay
#ssh over to viracocha and do the following
vnconfig -ck svnd0 ~frisco/svnd0-supay
disklabel -E /dev/svnd0c   
#type 'm a', enter '4.2BSD' for partition type, 
#type 'w' to write new label and 'q' to quit
fsck /dev/rsvnd0c
mkdir /mnt/supay-home
mount /dev/svnd0c /mnt/supay-home
#/mnt/supay-home is your laptop's /home directory
```
  If these steps don't work for you then you will want to make sure you backup all the files in the /home partition, not just the vnode file.
Benchmarks
Benchmarks comparing vnd to straight disk IO were run as part of a separate project, located here.
Conclusion
Your laptop now has an encrypted /home partition. If someone steals it and shuts down the laptop, they will not be able to recover files from that partition until they crack your password. If they steal your laptop and you have a shell open, of course they'll have the rights of that shell. Be sure to always run a locking screensaver (that doesn't crash) as well as take other precautions (like keeping patches up to date).
References
References from this doc and for more info.
Manpages:
vnconfig(8), newfs(8), disklabel(8), fsck(8), dd(1)
Other howto's and docs:
OpenBSD Encrypted Virtual Filesystem Mini-HOWTO more generic than this, go read it now.
deadly.org discussion about the above mini howto
Encrypted filesystems? another discussion on deadly.org, covers some security issues with such implemenations (don't lock yourself into a false sense of security).
Incan Gods and Goddesses - where i get the names for my machines from.
Author, Copyright, License
The author of this document is francisco roque, who can be found at
http://www.blackant.net/
This document is copyright francisco roque 2002.
This document is released under BSD style license and may be used in whole or part for anything so long as this section remains intact.
The author takes no responsibility for damages incurred by following the steps in this document, including but not limited to the loss of data or damage to hardware. Good Luck.