One method to encrypt /home/phablet



  • @malditobastardo run apt-get update first, it is in Xenial.



  • @chrisc Hello Sir, thank you for your answer.

    I just realized that I am getting tons of errors when trying to do apt-get update

    ( Could not open file /var/lib/apt/lists/partial/ports.ubuntu.com_ubuntu-ports_dists_xenial-updates_main_source_Sources.xz - open (13: Permission denied) [IP: 91.189.88.150 80])
    Similar lo this.

    Maybe is a ubports server issue?
    @advocatux

    and this:

    "phablet@ubuntu-phablet:~$ sudo mount -o rw,remount /
    [sudo] password for phablet:
    phablet@ubuntu-phablet:~$ apt-get update
    Reading package lists... Done
    W: chmod 0700 of directory /var/lib/apt/lists/partial failed - SetupAPTPartialDirectory (1: Operation not permitted)
    E: Could not open lock file /var/lib/apt/lists/lock - open (13: Permission denied)
    E: Unable to lock directory /var/lib/apt/lists/
    W: Problem unlinking the file /var/cache/apt/pkgcache.bin - RemoveCaches (13: Permission denied)
    W: Problem unlinking the file /var/cache/apt/srcpkgcache.bin - RemoveCaches (13: Permission denied)"

    Ok I needed "sudo", is that normal??? (installing cryptsetup)



  • @malditobastardo run sudo -i to become root.



  • @trainailleur I only have a OnePlus One at the moment and sometimes it takes a while for the display to come back up after a /etc/init.d/lightdm restart and yes it is easier doing it via SSH.



  • @chrisc First step done! I am getting this in the second part:

    sent 40,788,174 bytes received 21,557 bytes 16,323,892.40 bytes/sec
    total size is 40,668,865 speedup is 1.00
    root@ubuntu-phablet:/home# umount /media/phablet/
    root@ubuntu-phablet:/home# mount /dev/mapper/phablet /home/phablet
    root@ubuntu-phablet:/home# cd /tmp
    root@ubuntu-phablet:/tmp# nohup /etc/init.d/lightdm force-reload
    nohup: ignoring input and appending output to 'nohup.out'
    root@ubuntu-phablet:/tmp# cd
    root@ubuntu-phablet:~# cryptsetup luksOpen phablet.img phablet
    Device phablet.img doesn't exist or access denied.

    edit: is this step needed? (I did this in a fresh install). Should I just leave the "phablet.img" sitting there (2GB) in /home/phablet?

    edit2: ok I am starting to understand how this works.. I think. So after a restart of the phone I can't see any of my files, config, photos, etc. so it looks like every time I restart or shutdown my phone I need to "decrypt" the disk manually. The issue is that I am trying to follow the steps mentioned in the guide but I am getting access denied? Is this correct? Its normal that I have to decrypt everytime i restart the phone?

    Edit3: Ok so I managed to "decrypt" and I have all of my files back again. I had to run the commands in /home to make it work (mybad).
    Anyway, whats the best way to decrypt the phone? Because most of the times in don't have the chance to ssh into my phone and I usually restart the device 2-3 times per day, so doing this everytime is kind of PIA πŸ™‚ . There is no easy way to deal with this? Otherwise I may just reset the phone and wait for a proper way to Encrypt the phone in the future 😞 .
    Thanks everyone for everything specially @chrisc !!!



  • @malditobastardo said in One method to encrypt /home/phablet:

    ...
    phablet@ubuntu-phablet:~$ apt-get update
    ...
    Ok I needed "sudo", is that normal??? (installing cryptsetup)

    As far I know, you always need sudo when doing apt-get install, or apt-get update. For me this works:

    phablet@ubuntu-phablet:~$ sudo apt-get update
    


  • @chrisc said in One method to encrypt /home/phablet:

    @trainailleur I only have a OnePlus One at the moment and sometimes it takes a while for the display to come back up after a /etc/init.d/lightdm restart and yes it is easier doing it via SSH.

    I had inconsistent results with restart (sometimes display would never return, and other times it would return but with wifi broken, though I admit I have no idea what would cause that to happen. ☺ ), but force-reload has worked every time so far.

    Thank you again for your help with this!

    @malditobastardo said in One method to encrypt /home/phablet:

    edit: is this step needed? (I did this in a fresh install). Should I just leave the "phablet.img" sitting there (2GB) in /home/phablet?

    Sorry I was offline when all of your questions came up. Glad @chrisc was here to help!

    You could put it anywhere, so long as it's on a writable filesystem. Since much of the UBPorts filesystem is not writable by default, /home seems a good place to me.

    edit2: ok I am starting to understand how this works.. I think. So after a restart of the phone I can't see any of my files, config, photos, etc. so it looks like every time I restart or shutdown my phone I need to "decrypt" the disk manually. The issue is that I am trying to follow the steps mentioned in the guide but I am getting access denied? Is this correct? Its normal that I have to decrypt everytime i restart the phone?

    Yes, normal. You could write a script or create a bash alias to make it simpler. Since I'm still tinkering, I've not yet done this but plan to.

    Edit3: Ok so I managed to "decrypt" and I have all of my files back again. I had to run the commands in /home to make it work (mybad).
    Anyway, whats the best way to decrypt the phone? Because most of the times in don't have the chance to ssh into my phone and I usually restart the device 2-3 times per day, so doing this everytime is kind of PIA πŸ™‚ . There is no easy way to deal with this? Otherwise I may just reset the phone and wait for a proper way to Encrypt the phone in the future 😞 .

    Use the built in terminal application, and you won't have to ssh. ☺ ssh is useful for doing a lot of setup, but just to unlock and mount the crypt is only a few commands and easy enough to type in the terminal. Just note what my earlier posts said about the steps I had to take to get lightdm to restart when run from the local terminal on the phone as opposed to ssh. I agree that ssh isn't a good solution to unlocking the phone, which is why I kept chipping away at it until I found steps which would work in the on-board terminal.

    I may have a bit of an advantage in that from other work I'm extremely used to typing cryptsetup commands by hand and could type them in my sleep (I have in fact dreamt them before 😨 ), but it's pretty easy to set up bash aliases or write a simple bash script if you have trouble remembering the steps or syntax or simply want to save the hassle of typing on a software keyboard.

    Thanks everyone for everything specially @chrisc !!!

    I'm delighted to know there are now at least three of us doing this. ☺



  • @trainailleur thanks for you help with this and I'm glad it has been of use, I have updated the top post with your method to restart the display manager.

    As I said in the top post, "I'd strongly suggest that only people who know their way around Linux via the command line do this…"

    I have also added a e2fsck /dev/mapper/phablet line β€” if your phone goes flat or has to be forcibly power cycled it can result in some disk inconsistency so best check before mounting.

    I don't have a SIM card in my Ubuntu Touch OnePlus One (in fact I have the mobile phone network modem switched off via /usr/share/ofono/scripts/disable-modem /ril_0), I only use WiFi and also have an encrypted Debian Stretch chroot on the phone (which also runs a SSH server) that I use for most things and I run all my terminal sessions in screen so that when there is the occasional display manager crash I don't lose them. I also make a lot of use of git and mosh and ansible (via Debian backports) β€” I don't like carrying a laptop around all the time but I like to be able to do emergency sysadmin work from anywhere and the Ubuntu Touch phone enables this.

    I have terrible battery life when WiFi is on, I generally only have it on when it is plugged in or when doing something in an emergency, I use my LineageOS OnePlus 3 (without Gapps) as a hotspot and connect via that. When the WiFi is off I have excellent battery life, the phone might only drop 1% overnight even with multiple mosh sessions running in screen in the Debian chroot with Prevent app suspension enabled for the Terminal app via the UT Tweak Tool.

    I have some old notes on some other tricks on a wiki, but I haven't updated that for a couple of years so much of it might be outdated.



  • @chrisc @trainailleur Hey guys, thanks for your help!

    Ok so everything is working fine with ssh after each restart etc. I was also experimenting doing it by the phone terminal but when I go that route I only get half of my config working. For example, the contacts are not visible, the changes made with UTweaktool are not present, the keyboard theme etc. Sadly for some reason doing it by the terminal only decrypt half of my config or something like that. I don't know why.
    Also I noticed a worse battery perfomance in my Nexus 5. It was 65% 8 hours ago before going to sleep and today in the morning the phone was dead. Other than that. I will try to figure out why decrypting the phone via the terminal is not working for me, if I manage to get that working or by a script/bash alias I will keep with the encryption long term. Let's see.. Thank you again.

    One more thing, I am also experiencing the wifi dissapearing sometimes, usually I fix that by restarting once the phone.

    edit2: after trying to decrypt with the new commands, it worked well doing it from the phone terminal πŸ™‚



  • Revisiting this a year later, following a fresh install of OTA-12 on a OnePlus One. It still works.

    I did have to bind mount /var/cache/apt as per @jezek 's tip here: https://forums.ubports.com/post/20297

    I also dispensed with the cd to /tmp when I remembered that nohup is just writing standard output to a file anyway, so there was no reason not to write to /dev/null, obviating the need to write to a filesystem that will survive the lightdm reload:

    nohup /etc/init.d/lightdm force-reload > /dev/null
    

    Will test on PinePhone when I get the chance, but unfortunately my BraveHeart device has been gathering dust for a few months. (Too many projects, too little time, even with all this extra quarantine time in my life. 😞 )

    As always, DON'T do this unless you know what you're doing* and are prepared to accept the risk of a broken system, either now or at the next OTA.

    *A good litmus test might be: you understand what all of the commands in this thread are doing and why they were chosen, as that comprehension implies understanding of the potential consequences as well as the limitations.



  • @trainailleur said in One method to encrypt /home/phablet:

    Will test on PinePhone when I get the chance, but unfortunately my BraveHeart device has been gathering dust for a few months. (Too many projects, too little time, even with all this extra quarantine time in my life. 😞 )

    I finally tested this on the PinePhone (dev channel). It works fine, as expected, though instead of using a file as the encrypted block device, I created a new partition on the sdcard I'm using for testing.



  • Have gone further on the PinePhone and copied all of the writable data into a new luks-encrypted partition.

    I now have a shell script in my home directory as initially booted that will:

    1. check to see if cryptsetup is installed and if not kick off an install script
    2. turn off swap so we don't end up with encryption keys in swap
    3. unlock the encrypted partition
    4. cd to /tmp (because not doing so was tripping me up in the next step)
    5. force umount /userdata using "umount -l"
    6. remount the encrypted partition on it
    7. in sequence force umount each userdata-mounted writeable part of the filesystem using "umount -l" then bind mount it back on the new, encrypted userdata (the bind mounts for your system can be found with findmnt)
    8. turn swap back on using a new swap file in the encrypted partition with the same -1 setting that the original swap had (a larger swap file, in my case)
    9. force-reload lightdm

    Is anything aside from updates writen to permanent storage other than to bind mounts on /userdata? I didn't find anything, but there's always the possibility that I missed something.

    All of this adds a couple of minutes to getting the phone ready for use, of course, and there may be things I've not yet discovered which will turn out to be broken.

    Given how much is not yet working in the PinePhone, I should probably replicate this on an Android-based UBPorts device like the OnePlus One or the Nexus 5 for further testing. I'm thinking it should probably work with a large container in /userdata, skipping the umount of /userdata and mounting the decrypted block file (and the consequent bind mounts) on a file within /userdata, but this isn't testing I plan to pursue for now, as other tests take priority.

    I am not posting my script here because it only applies to how I have set up my PinePhone. There are a few choices I made which would break completely for someone who made different setup choices. Anyone capable of getting this working on their device will need to understand what is meant by each step above so should be able to develop a process that works for them. If anyone who does want to try this and does know what they're doing hits a snag and has a question, I'll try to answer it.

    Standard caveat applies: this could break everything on your phone, and UBPorts developers will not support this or help you fix it. Proceed at your own risk.



  • Seems that lightdm doesn't restart with the latest OTA. Any tips ?



  • @ernest said in One method to encrypt /home/phablet:

    Seems that lightdm doesn't restart with the latest OTA. Any tips ?

    Hmm. I've not been testing lately so hadn't noticed. Will see what I can figure out when I next have some time, but that may be a while. What errors or symptoms occur?



  • @trainailleur
    Lomiri cannot restart thus the screen remains black, while ssh access works fine.


Log in to reply