configurationIn this configuration, there is a separation between system and data.
1 - system encrypted with luks
2 - data encrypted in a truecrypt FAT32 partition,
- /tmp and /home are in a tmpfs. The user preferences are loaded at each startup from data partition,
- no swap,
The system will be installed and configured using an Ubuntu USB drive and the script infondLinux.
From an Ubuntu USB key (or CD):
- use gparted to create a unique partition,
- mount (let's assume the partition is /dev/sda1)
# mkdir /media/disk- wipe (launch and go to bed)
# mount /dev/sda1 /media/disk
# touch /media/disk/full
# dd if=/dev/urandom of=/media/disk/full
# rm /media/disk/full
install your system
1 - system encrypted with luks encryption
2 - data not encrypted (later encrypted with truecrypt FAT32 partition,
3 - an unsecured partition is kept for VMs, films... (performances reasons).
FAT32 is used in case you would like to access your data from Windows
.bash_history -> /dev/null
$ su -
# for user in $(ls /home); do rm /home/$user/.bash_history; ln -s /dev/null /home/$user/.bash_history; done
create TrueCrypt partitionuse the whole data partition as TrueCrypt volume
# wget http://infondlinux.googlecode.com/svn/trunk/infondlinux.sh
# sudo infondlinux.sh
save your preferences
Most of programs put your configuration preferences in home. You'll need to save your current home in the data partition each time you modify your preferences.
This configuration will be loaded at each boot. we'll deal with this loading later.
# for user in $(ls /home); do rm -r /home/$user; mkdir /home/$user; done
Reboot and configure as you like your gnome desktop and programs (firefox, xchat, chrome, wifi, seahorse, etc.)
close all windows, open your truecrypt partition and run (sudo)
# mkdir /media/truecrypt1/savehomeDon't forget, you'll need to save your preferences often if you don't want to reconfigurate your softs at each boot.
# cp -r /home/* /media/truecrypt1/savehome
let's become invisible
create tmpfsmodify /etc/fstab
$ su -
# echo "none /tmp tmpfs defaults,size=128M 0 0" >> /etc/fstab
# echo "none /home tmpfs defaults,size=512M,mode=1777 0 0" >> /etc/fstab
truecrypt prompt to load your /home at each gnome start
add (just under first comments) into /etc/gdm/Init/Default
(replace /dev/sda3 by your data partition) :
# mount truecrypt
truecrypt /dev/sda3 /media/truecrypt1
# load /home
cp -r /media/truecrypt1/savehome/* /home
# umount truecrypt
truecrypt -d /dev/sda3
for user in $(ls /home); do
chown -r $user:$user /home/$user