Re: ssh clarification needed

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sunday 04 January 2009 15:28:13 Mail Lists wrote:
> On 01/04/2009 09:03 AM, Anne Wilson wrote:
> > Hmm - Is there no reasonably safe way of doing this?  There seems to be
> > some risk with everything.   I've not lost a usb stick yet, but one can
> > never guarantee that one won't.
>
>   The general recomendation for any laptop (with anything sufficiently
> private) is to encrypt the disk. My preference is to (luks) encrypt
> /home and swap 

I have luks encryption on /home on the netbook - which is what I'm really 
thinking about.  

> and then bind mount /tmp and /var/tmp out of /home/tmp
> /home/var/tmp. 

I don't understand that bit, I'm afraid.

> You could encrypt root as well and then skip the bind
> mounts.
>
I didn't think it worth while to encrypt root.  Root login is disabled, and 
/home is luks encrypted.  How can they get in?

>   Many (if not most) businesses these days require laptops all be
> encrypted - certainly mine does. (See some posts by mike.cloaked on
> encryption in F10)
>
It takes a government department to lose laptops with unencrypted confidential 
information :-)

>   Avoid any fuse type encryptions - nice toys to test things but they
> are very slow. Using encryption (encfs is the default in Luks) does not
> impact my daily activities at all speed wise, tho' backup/restores may
> be a little slower. Witrh encrypted swap you likely cannot hibernate tho
> suspend may be an option - I usually just shutdown and reboot.
>
Again, I assumed that it was not possible for an intruder to get as far as 
swap.  If I'm wrong, how can that be encrypted after an install?

>   In addition, as Tom mentioned, you likely use a passphrase to protect
> your ssh private key (and like most of us probably use ssh-agent so you
> dont need to keep typing it).
>
Yes, I only use ssh with passphrase, and I do use ssh-agent.

Anne

Attachment: signature.asc
Description: This is a digitally signed message part.

-- 
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines

[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux