DSM-G600, DNS-3xx and NSA-220 Hack Forum

pdoodle · 2007-07-05 07:29:21

I'm wondering if it's possible to use the dm-crypt and dm-mod modules with the DNS-323 and mount the drives as encrypted devices? Here are some thoughts and questions:

- You would have to create a small partition, at least a few MB to allow for fun_plugs and other such items
- As I understand things, the leftover space from the first partition is automatically designated JBOD and formatted
- If you installed fun_plug with telnet, you should theoretically be able to install the dm-crypt and dm-mod modules and copy the cryptsetup program

What I don't know is how you could unmount the second partition, get the modules loaded and create the partition. I think it might be possible, but would like to hear anyone's thoughts on this.

Thanks

rguerra · 2007-07-07 16:36:01

There also seems to be a compiled truecrypt kernel module for the DNS-323, however couldn't get it to work.

Truecrypt would be - great - to get working on the 323, and look forward to anyone's comments on how this could be done..

Thought I don't have time myself, might I recommend the notes @ http://www.howtoforge.com/truecrypt_data_encryption . Perhaps someone could go through the notes, and create a module for us to use on the 323.. ?

Last edited by rguerra (2007-07-07 16:43:44)

pdoodle · 2007-07-09 20:22:37

I'm not an experienced linux hacker / program compiler, but I'll do whatever I can to get this working.

If the kernel module already exists, all we would need to do is grab that and compile dmsetup and truecrypt command-line programs, right?

Of course, I don't know how to do that, so I'll have to find some help or instructions! :-D

fonz · 2007-07-09 23:30:06

Have a look here: http://dns323.kood.org/forum/t720-Compi … NS323.html
Also, it seems you need to compile and install quite a few packages:
libgpg-error-1.5
libgcrypt-1.2.4
popt-1.10.4
device-mapper-1.02.20
cryptsetup-1.0.5

But I think it's doable.

pdoodle · 2007-07-25 16:48:18

Just curious, has any more advanced DNS-323 user figure a was to do encrypted disk? Maybe with truecrypt? I don't know...

aahorn · 2007-07-25 23:42:08

Indeed, I am using TrueCrypt to create an encrypted drive image which is stored on the DNS-323 (Raid 1). I just run the TrueCrypt software from my workstation which is running WINXP-PRO to create the encrypted drive image stored on the DNS-323 and mount it. Works perfectly and solved all the problems I had previously with file names that that had special characters or multi lingual etc.

rguerra · 2007-07-25 23:49:27

aahorn wrote:
Indeed, I am using TrueCrypt to create an encrypted drive image which is stored on the DNS-323 (Raid 1). I just run the TrueCrypt software from my workstation which is running WINXP-PRO to create the encrypted drive image stored on the DNS-323 and mount it. Works perfectly and solved all the problems I had previously with file names that that had special characters or multi lingual etc.

It would be better if it was built-into the DNS323, as that way - it would be platform independent. Not all of us WIN you know..

pdoodle · 2007-07-26 16:54:26

aahorn wrote:
Indeed, I am using TrueCrypt to create an encrypted drive image which is stored on the DNS-323 (Raid 1). I just run the TrueCrypt software from my workstation which is running WINXP-PRO to create the encrypted drive image stored on the DNS-323 and mount it. Works perfectly and solved all the problems I had previously with file names that that had special characters or multi lingual etc.

Hello aahorn, could you say a bit more about how you are doing this? I'm very interested.

Do you create a large 100GB, or 250GB, or 500GB container file and then open that up with TrueCrypt? That would seem like it might not be efficient because to create an empty file of even 100GB filled with random data can take a very, very long time. I don't know of a way to just mount the device, but perhaps that is possible?

Thank you

pdoodle · 2007-07-26 16:55:52

rguerra wrote:
aahorn wrote:
Indeed, I am using TrueCrypt to create an encrypted drive image which is stored on the DNS-323 (Raid 1). I just run the TrueCrypt software from my workstation which is running WINXP-PRO to create the encrypted drive image stored on the DNS-323 and mount it. Works perfectly and solved all the problems I had previously with file names that that had special characters or multi lingual etc.
It would be better if it was built-into the DNS323, as that way - it would be platform independent. Not all of us WIN you know..

rguerra, i don't understand? You can use TrueCrypt both on Windows, Linux or whatever platform I believe. Isn't that platform independent?

Thank you

rguerra · 2007-07-26 17:05:03

i'd rather use a kernel module on the DNS 323, that way software does not need to be used on the client machine. One would just connect via samba, and then all the files would be - transparently - encrypted on the 323.

For me that's a better solution then running an application on the client PC. To make things worse, truecrypt doesn't work on a mac.

pdoodle · 2007-07-26 17:59:08

rguerra wrote:
i'd rather use a kernel module on the DNS 323, that way software does not need to be used on the client machine. One would just connect via samba, and then all the files would be - transparently - encrypted on the 323.

For me that's a better solution then running an application on the client PC. To make things worse, truecrypt doesn't work on a mac.

ok, thank you for explaining. Yes, I think your idea does sound like the best option.

Now I do not know a way to have the cryptsetup or cryptLUKS work on the DNS-323 directly, so I will hope that aahorn has a good temporary solution to use TrueCrypt that is not difficult and can be use for large hard drives.

I have experience with much usage of the cryptsetup and cryptLUKS but not with how to compile programs. If someone can help on this, I will do whatever I can. Does anyone know?

rguerra · 2007-07-26 18:05:05

Another solution would be to use the File System in Userspace (FUSE) kernel module. It has a a lot of plugins, including ones for encryption.

it likely would be easier to get FUSE working on the DNS 323 then truecrype.

FUSE Details - http://fuse.sourceforge.net/

FUSE File system plug-ins available - http://code.google.com/p/macfusion/wiki … oImplement

aahorn · 2007-07-30 07:14:55

I created a container file which is 100gb using TrueCrypt from my workstation (Win XP PRO). And then just mount this container file using TrueCrypt as a drive in XP. Works fine with no efficiency problems at all. It works just like a normal drive that is sitting in the workstation.

I believe there is a version of TrueCrypt for LINUX… So we don’t have to WIN:)

pic_micro · 2007-08-01 19:06:13

rguerra wrote:
i'd rather use a kernel module on the DNS 323, that way software does not need to be used on the client machine. One would just connect via samba, and then all the files would be - transparently - encrypted on the 323.

For me that's a better solution then running an application on the client PC. To make things worse, truecrypt doesn't work on a mac.

I'm with you. Maybe we should establish a bounty $ to compile and make it work on the DNS 323. I'm really interested on this but I don't have the knowledge to start.

HaydnH · 2007-09-28 13:57:27

Has anyone got any further looking at encryption as a kernel module? I get my dns-323 tomorrow and will be looking at getting crypto-loop working soon, I use it on my desktop anyway using an old sd-card as an encryption key but will be using a usb key for this device... setting it up shouldn't be too complicated (hopefully) although I need to have a look at how the device handles mirroring and multiple slices on each disk.

w00 · 2008-01-03 01:39:48

HaydnH wrote:
Has anyone got any further looking at encryption as a kernel module? I get my dns-323 tomorrow and will be looking at getting crypto-loop working soon, I use it on my desktop anyway using an old sd-card as an encryption key but will be using a usb key for this device... setting it up shouldn't be too complicated (hopefully) although I need to have a look at how the device handles mirroring and multiple slices on each disk.

sounds very promising! any news on crpyting the dns323 (except for making an IMAGE of some files on the dns...)

cheerio

HaydnH · 2008-01-07 13:54:00

I didn't bother looking in the end - the laws in the UK changed around the time of my last post so that lot's of "official people" (i.e: the world and his dog) can require that you provide them with your encryption key or you face a jail sentence! As far as I am aware, kernel module based encryption doesn't have "plausible deniability", i.e: the ability to hide an encrypted section inside another so that you could provide a key to unlock the "container" and still have the encrypted section inside it safe and unseen. There are applications for linux/unix out there which allow this form of encryption (Truecrypt for example) but I haven't tried to cross compile them.

Haydn.

May · 2010-02-12 16:28:36

Hi,

I'm bringing that thread up again, because I'm planning to buy a 323 especially for the encrpytion. My old NAS is completely closed and thats why I'm searching for a new one, where I can install all the features I want. So my question is, does somebody get it worked? Or is there any other solution to get encrpytion in a NAS, directly on the system?

Regards,

May

oxygen · 2010-02-12 19:03:29

embedded system dont have enough processing power to support encryption with a usuable speed.

May · 2010-02-12 19:57:49

Ah k, thx for the hint. So there is just the possibility over truecrypt and a host PC? Does somebody use that? Any experience with that?

May

oxygen · 2010-02-13 12:33:36

May wrote:
Ah k, thx for the hint. So there is just the possibility over truecrypt and a host PC? Does somebody use that? Any experience with that?

I did not try it, but that should work. just make sure you dont mount the image simultanously on different clients.

tester321 · 2010-02-13 17:59:29

May wrote:
Hi,

I'm bringing that thread up again, because I'm planning to buy a 323 especially for the encrpytion. My old NAS is completely closed and thats why I'm searching for a new one, where I can install all the features I want. So my question is, does somebody get it worked? Or is there any other solution to get encrpytion in a NAS, directly on the system?

Regards,

May

I have had a DNS-323 for over a year and I love it (running funplugs).

BUT, IMHO it does NOT have enough horsepower (CPU or Memory) to support Encrypted volumes in real time. (I am talking about LUKS here ... assuming you can even get it to work on the DNS-323).

This is after much research and even querying Martin Michlmayr via email (this is my conclusion -- not his).

You would be much better served by coupling a Thin Client with USB, Firewire, or eSATA external hard drives.

I do this all the time and serve Music, Video, Files etc from numerous external USB/Firewire/eSATA hard drives with good performance.

PS: These are "embedded" in that I have loaded Debian onto their DOM's and they boot from the internal DOM. (You can also replace DOM with laptop hard drive if you want a conventional drive with the commensurate heat, noise, and failure rate). Passphrase is needed to access Encrypted Volumes after the OS is booted.

So I can have my cake and eat it too:
- Small form factor
- Low wattage (HP Thin client T5000 series consume between 9w - 27w depending what else you put in them; measured by a "Kilawatt")
- Very secure Encryption (LUKS with a passphrase as long as your arm)
- Reliable file format (EXT3 with LVM2)
- Client platform independent
- Can do a TON of other stuff (I do SSH, SAMBA, VOIP Proxying, Perl scripts, you can do FTP, web server, etc etc etc)
- Very good performance (multiple clients watching videos and listening to music music simultaneously) since the HP models have 733Mhz - 1.2Ghz and can run 512MB - 2GB RAM depending on model (undocumented)
- In fact, if you get higher end thin client (like HP T5730) you have Gigabit Ethernet, and PCIe 1x expansion capability to make a "real" NAS with awesome performance
- Absolutely nothing extra needed on clients that are accessing it
- Portable solution
- Cost effective, not much more expensive that retail price of DNS-323 if you source thin client from ebay/etc

You can see my previous post in this forum here on this topic when I was getting serious about playing with the DNS-323 vs thin client.

Cheers

Last edited by tester321 (2010-02-13 18:36:39)

DSM-G600, DNS-3xx and NSA-220 Hack Forum

Announcement

#1 2007-07-05 07:29:21

Encryption with cryptsetup and dm_crypt

#2 2007-07-07 16:36:01

Re: Encryption with cryptsetup and dm_crypt

#3 2007-07-09 20:22:37

Re: Encryption with cryptsetup and dm_crypt

#4 2007-07-09 23:30:06

Re: Encryption with cryptsetup and dm_crypt

#5 2007-07-25 16:48:18

Re: Encryption with cryptsetup and dm_crypt

#6 2007-07-25 23:42:08

Re: Encryption with cryptsetup and dm_crypt

#7 2007-07-25 23:49:27

Re: Encryption with cryptsetup and dm_crypt

aahorn wrote:

#8 2007-07-26 16:54:26

Re: Encryption with cryptsetup and dm_crypt

aahorn wrote:

#9 2007-07-26 16:55:52

Re: Encryption with cryptsetup and dm_crypt

rguerra wrote:

aahorn wrote:

#10 2007-07-26 17:05:03

Re: Encryption with cryptsetup and dm_crypt

#11 2007-07-26 17:59:08

Re: Encryption with cryptsetup and dm_crypt

rguerra wrote:

#12 2007-07-26 18:05:05

Re: Encryption with cryptsetup and dm_crypt

#13 2007-07-30 07:14:55

Re: Encryption with cryptsetup and dm_crypt

#14 2007-08-01 19:06:13

Re: Encryption with cryptsetup and dm_crypt

rguerra wrote:

#15 2007-09-28 13:57:27

Re: Encryption with cryptsetup and dm_crypt

#16 2008-01-03 01:39:48

Re: Encryption with cryptsetup and dm_crypt

HaydnH wrote:

#17 2008-01-07 13:54:00

Re: Encryption with cryptsetup and dm_crypt

#18 2010-02-12 16:28:36

Re: Encryption with cryptsetup and dm_crypt

#19 2010-02-12 19:03:29

Re: Encryption with cryptsetup and dm_crypt

#20 2010-02-12 19:57:49

Re: Encryption with cryptsetup and dm_crypt

#21 2010-02-13 12:33:36

Re: Encryption with cryptsetup and dm_crypt

May wrote:

#22 2010-02-13 17:59:29

Re: Encryption with cryptsetup and dm_crypt

May wrote:

Board footer