{"id":809,"date":"2013-12-30T01:47:53","date_gmt":"2013-12-29T17:47:53","guid":{"rendered":"http:\/\/www.ceh-photo.de\/blog\/?p=809"},"modified":"2013-12-30T01:52:02","modified_gmt":"2013-12-29T17:52:02","slug":"truecrypt-on-netgear-readynas-100-series-debian-with-auto-mount-on-attached-keyfile-thumb-drive-dongle","status":"publish","type":"post","link":"https:\/\/www.ceh-photo.de\/blog\/?p=809","title":{"rendered":"Truecrypt on Netgear ReadyNAS 100 series (Debian) with auto mount on attached keyfile thumb drive dongle"},"content":{"rendered":"

Since I own a Netgear ReadyNAS 102 I was wondering how I could use encryption for special content in a convenient way. Because the Netgear firmware does not provide an encryption feature inside its ReadyNAS OS wrapper on top of the underlying Debian Linux I decided to have a closer look on Truecrypt, which I already have in use on my other desktop and mobile computers.<\/p>\n

Because Truecrypt binaries are not available for the used ARM architecture the first required step was building Truecrypt from source. During my research I came over a posting which explained the build process step by step.<\/p>\n

http:\/\/www.readynas.com\/forum\/viewtopic.php?f=11&t=63214<\/a><\/p>\n

If you really want to build it on your own, be aware of my comment inside the forum thread above. If you just want to go ahead, I have simplified the procedure for you with a prebuild binary available on my personal Debian-Dropbox-Repository:<\/p>\n

1) Install some dependencies for https access<\/p>\n

apt-get install<\/span> apt-transport-https<\/div><\/div>\n

2) Add my repo to your \/etc\/apt\/sources.list<\/p>\n

deb https:\/\/<\/span>dl.dropboxusercontent.com\/<\/span>u\/<\/span>8916436<\/span>\/<\/span>deb-packages\u00a0.\/<\/span><\/div><\/div>\n

3) Install truecrypt<\/p>\n

apt-get update<\/span>
\napt-get install<\/span> truecrypt<\/div><\/div>\n

Now you are able to use truecrypt. Some usage examples:<\/p>\n

#basic mounting e.g. container \u00a0with EXT4 filesystem, you will need to adjust right privileges after mounting with chown\/chmod<\/span>
\ntruecrypt\u00a0-t -k<\/span> "KEYFILE(S)"<\/span> -p<\/span> "PASSWORD"<\/span> --mount-options<\/span>=nokernelcrypto --protect-hidden<\/span>=no --mount<\/span> CONTAINER.tc \/<\/span>MOUNTPOINT\/<\/span>
\n#mounting with more useful right\u00a0privileges<\/span>
\n#owner will be user guest (ID=99) and the files will be accessible by all users due to umask=000<\/span>
\ntruecrypt\u00a0-t -k<\/span> ""<\/span> -p<\/span> ""<\/span> --fs-options<\/span>=rw,uid<\/span>=99<\/span>,gid<\/span>=99<\/span>,umask<\/span>=000 --mount-options<\/span>=nokernelcrypto --protect-hidden<\/span>=no --mount<\/span> testContrainer.tc crypt\/<\/span><\/div><\/div>\n

You can find the user and group id with the commands<\/p>\n

id<\/span> -u<\/span> USERNAME
\nid<\/span> -g<\/span> GROUPNAME<\/div><\/div>\n

Now we are able to use truecrypt on the ReadyNAS, but we will need to use SSH everytime we want to mount a volume. Of course this is not\u00a0convenient, so my idea was to encrypt the container(s) with keyfile(s) instead of a password (you can also use a password and a keyfile) and mount the volume once my keyfile thumb drive is plugged into the NAS.<\/p>\n

1) Create udev rules for automatic script execution once the keyfile thumb drive is attached or removed from the USB port<\/p>\n

2) New udev rule:<\/p>\n

touch<\/span> \/<\/span>etc\/<\/span>udev\/<\/span>rules.d\/<\/span>99<\/span>-truecrypt-auto.rules<\/div><\/div>\n

3) With content below:<\/p>\n

ACTION<\/span>=="add"<\/span>,KERNEL<\/span>=="sd?[0-9]"<\/span>,ATTRS{<\/span>serial}<\/span>=="13371337"<\/span>,SYMLINK+="truecryptkeys"<\/span>,RUN+="\/data\/Documents\/automount.sh add"<\/span>
\n
\nACTION<\/span>=="remove"<\/span>,KERNEL<\/span>=="sd?[0-9]"<\/span>,ENV{<\/span>ID_SERIAL_SHORT}<\/span>=="13371337"<\/span>,RUN+="\/data\/Documents\/automount.sh remove"<\/span><\/div><\/div>\n

The udev rules are executed once the specified variables are matched by a device. I figured out the variable values for the new attached device with following command after I had already attached the thumb drive.<\/p>\n

# In my case sdg was my usb thumb drive. You can check the device node for your attached device with dmesg<\/span>
\nudevadm info --name<\/span>=\/<\/span>dev\/<\/span>sdg --attribute-walk<\/span><\/div><\/div>\n

To gather the right environment variable to use I have used follwing command before I have unplugged my thumb drive.<\/p>\n

udevadm monitor --environment<\/span> --udev<\/span><\/div><\/div>\n

Like you may have already mentioned, the udev rule is executing another script, which takes care of mounting and unmounting of the truecrypt container. Here comes the script, which I have stored on \/data\/Documents\/automount.sh. Take a closer look onto the variables defined at the beginning, they specify the container, mountpoint, password(if you have one configured) and so on. The script uses all files from the thumb drive as key files for uncrypting the container. If you only want to use specific files, you will need to change the script accordingly. I just use “\/media\/USB_FLASH_1\/” to access the thumb drive, because I do not have attached other devices usually. You may have to change this, if you have a more sophisticated environment.<\/p>\n

#!\/bin\/bash<\/span>
\n
\nLOGFILE<\/span>="\/data\/Documents\/automount.log"<\/span>
\n
\nCONTAINER<\/span>="PATHTOMYCONTAINER.tc"<\/span>
\n
\nMOUNTPOINT<\/span>="MY_FORMER_CREATED\/MOUNT_DIRECTORY\/ON\/DATA_XYZ"<\/span>
\n
\nDEVICESYMBOL<\/span>="\/dev\/truecryptkeys"<\/span>
\n
\nDATUM<\/span>=`<\/span>date<\/span> +"%d.%m.%y %H:%M:%S"<\/span>`<\/span>
\n
\nPASSWORD<\/span>=""<\/span>
\n
\n#Redirect outputs<\/span>
\n# Open STDOUT as $LOGFILE file for read and write.<\/span>
\nexec<\/span> 1<\/span>>><\/span>$LOGFILE<\/span>
\n# Redirect STDERR to STDOUT<\/span>
\nexec<\/span> 2<\/span>>&<\/span>1<\/span>
\n
\n#check parameters<\/span>
\nif<\/span> [<\/span> $#<\/span> = 0<\/span> ]<\/span>; then<\/span>
\necho<\/span> "$DATUM<\/span> Missing parameters - Use 'add' or 'remove'"<\/span>
\nexit<\/span>
\nfi<\/span>
\n
\n#check parameters<\/span>
\nif<\/span> [<\/span> !<\/span> -L<\/span> $DEVICESYMBOL<\/span> ]<\/span>; then<\/span>
\necho<\/span> "$DATUM<\/span> Key device symbolic link $DEVICESYMBOL<\/span> is not available"<\/span>
\nexit<\/span>
\nfi<\/span>
\n
\n#plug in key dongle<\/span>
\nif<\/span> [<\/span> $1<\/span> = "add"<\/span> ]<\/span>; then<\/span>
\n
\necho<\/span> "$DATUM<\/span> Truecrypt automount key add"<\/span>
\n
\ntruecrypt -t<\/span> -k<\/span> "\/media\/USB_FLASH_1\/"<\/span> -p<\/span> "$PASSWORD<\/span>"<\/span> --mount-options<\/span>=nokernelcrypto --fs-options<\/span>=locale<\/span>=de_DE.utf8,umask<\/span>=000 --protect-hidden<\/span>=no --mount<\/span> $CONTAINER<\/span> $MOUNTPOINT<\/span>
\n
\nfi<\/span>
\n
\n#unplug key dongle<\/span>
\nif<\/span> [<\/span> $1<\/span> = "remove"<\/span> ]<\/span>; then<\/span>
\n
\necho<\/span> "$DATUM<\/span> Truecrypt automount key removed"<\/span>
\n
\n#dismount container<\/span>
\ntruecrypt -d<\/span> $MOUNTPOINT<\/span>
\n#dismount all containers<\/span>
\n#truecrypt -d<\/span>
\n
\nfi<\/span><\/div><\/div>\n

In my case the container is formatted with NTFS (therefor the mounting options “–fs-options=locale=de_DE.utf8,umask=000”), this takes advantage of\u00a0accessibility for direct mounting on Windows and Linux computers while being able to store files larger than 4GB. I have initialized and created my truecrypt container remotely from my PC. Another important thing to note is, I recommend to disable continous protection on the share where you store the truecrypt container, as long as you have a huge container of several GB.<\/p>\n

You can check if the script is working proberly by manual execution with commands below<\/p>\n

# mounting<\/span>
\n\/<\/span>data\/<\/span>Documents\/<\/span>automount.sh add
\n#unmounting<\/span>
\n\/<\/span>data\/<\/span>Documents\/<\/span>automount.sh remove<\/div><\/div>\n

All outputs will be written to \u00a0“\/data\/Documents\/automount.log”<\/p>\n

A last thing is missing, the udev rules seems not beeing proberly executed during boot, so the container is not mounted on boot while the key file thumb drive is attached.\u00a0To solve this issue I have used an rc-script.<\/p>\n

1) Create a new executable script<\/p>\n

touch<\/span> \/<\/span>etc\/<\/span>init.d\/<\/span>truecryptmount
\nchmod<\/span> +x \/<\/span>etc\/<\/span>init.d\/<\/span>truecryptmount<\/div><\/div>\n

2) Here comes the script content:<\/p>\n

#! \/bin\/sh<\/span>
\n
\n### BEGIN INIT INFO<\/span>
\n# Provides: truecryptmount<\/span>
\n# Required-Start: udev<\/span>
\n# Required-Stop:<\/span>
\n# Should-Start: $named<\/span>
\n# Default-Start: 2 3 4 5<\/span>
\n# Default-Stop:<\/span>
\n# Short-Description: mount available truecrypt containers by key file<\/span>
\n# Description: mount available truecrypt containers by key file if usb device is available<\/span>
\n### END INIT INFO<\/span>
\n
\nset<\/span> -e<\/span>
\n
\n# \/etc\/init.d\/truecryptmount: tries to mount available truecrypt containers by key file<\/span>
\n
\ncase<\/span> "$1"<\/span> in<\/span>
\nstart|<\/span>reload|<\/span>restart)<\/span>
\n
\n\/<\/span>data\/<\/span>Documents\/<\/span>automount.sh add
\n#udevadm trigger --verbose --action=add --property-match serial=44380c78721298<\/span>
\n;;<\/span>
\nstop)<\/span>
\n;;<\/span>
\n*<\/span>)<\/span>
\necho<\/span> "Usage: \/etc\/init.d\/truecryptmount {start|stop|restart|reload}"<\/span>
\nexit<\/span> 1<\/span>
\nesac<\/span>
\n
\nexit<\/span> 0<\/span><\/div><\/div>\n

3) Register the script with<\/p>\n

update-rc.d truecryptmount defaults 19<\/span><\/div><\/div>\n

Happy Crypting!<\/p>\n","protected":false},"excerpt":{"rendered":"

Since I own a Netgear ReadyNAS 102 I was wondering how I could use encryption for special content in a convenient way. Because the Netgear firmware does not provide an encryption feature inside its ReadyNAS OS wrapper on top of the underlying Debian Linux I decided to have a closer look on Truecrypt, which I […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[46],"tags":[115,40,116,117,118],"class_list":["post-809","post","type-post","status-publish","format-standard","hentry","category-linux-it-2","tag-debian","tag-linux","tag-netgear","tag-readynas","tag-truecrypt"],"_links":{"self":[{"href":"https:\/\/www.ceh-photo.de\/blog\/index.php?rest_route=\/wp\/v2\/posts\/809","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ceh-photo.de\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ceh-photo.de\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ceh-photo.de\/blog\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ceh-photo.de\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=809"}],"version-history":[{"count":1,"href":"https:\/\/www.ceh-photo.de\/blog\/index.php?rest_route=\/wp\/v2\/posts\/809\/revisions"}],"predecessor-version":[{"id":810,"href":"https:\/\/www.ceh-photo.de\/blog\/index.php?rest_route=\/wp\/v2\/posts\/809\/revisions\/810"}],"wp:attachment":[{"href":"https:\/\/www.ceh-photo.de\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=809"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ceh-photo.de\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=809"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ceh-photo.de\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=809"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}