ssh clarification needed

[Anne Wilson]

On Sunday 04 January 2009 15:28:13 Mail Lists wrote:
> On 01/04/2009 09:03 AM, Anne Wilson wrote:
> > Hmm - Is there no reasonably safe way of doing this?  There seems to be
> > some risk with everything.   I've not lost a usb stick yet, but one can
> > never guarantee that one won't.
>
>   The general recomendation for any laptop (with anything sufficiently
> private) is to encrypt the disk. My preference is to (luks) encrypt
> /home and swap 

I have luks encryption on /home on the netbook - which is what I'm really 
thinking about.  

> and then bind mount /tmp and /var/tmp out of /home/tmp
> /home/var/tmp. 

I don't understand that bit, I'm afraid.

> You could encrypt root as well and then skip the bind
> mounts.
>
I didn't think it worth while to encrypt root.  Root login is disabled, and 
/home is luks encrypted.  How can they get in?

>   Many (if not most) businesses these days require laptops all be
> encrypted - certainly mine does. (See some posts by mike.cloaked on
> encryption in F10)
>
It takes a government department to lose laptops with unencrypted confidential 
information :-)

>   Avoid any fuse type encryptions - nice toys to test things but they
> are very slow. Using encryption (encfs is the default in Luks) does not
> impact my daily activities at all speed wise, tho' backup/restores may
> be a little slower. Witrh encrypted swap you likely cannot hibernate tho
> suspend may be an option - I usually just shutdown and reboot.
>
Again, I assumed that it was not possible for an intruder to get as far as 
swap.  If I'm wrong, how can that be encrypted after an install?

>   In addition, as Tom mentioned, you likely use a passphrase to protect
> your ssh private key (and like most of us probably use ssh-agent so you
> dont need to keep typing it).
>
Yes, I only use ssh with passphrase, and I do use ssh-agent.

Anne
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part.
URL: <http://listman.redhat.com/archives/fedora-list/attachments/20090104/9aa321a1/attachment-0001.sig>