to avoid leakage of sensitive information: any advice?
X-Habeas-SWE-1: winter into spring
X-Habeas-SWE-2: brightly anticipated
X-Habeas-SWE-3: like Habeas SWE (tm)
X-Habeas-SWE-4: Copyright 2002 Habeas (tm)
X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this
X-Habeas-SWE-6: email in exchange for a license for this Habeas
X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant
X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this
X-Habeas-SWE-9: mark in spam to <http://www.habeas.com/report/>.
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Fri, 16 Jul 2004 05:22:53 +0100
From: David Kreil <[EMAIL PROTECTED]>
Hi,
(1) I was wondering whether anyone knew of packages/tools to aid in
"sanitizing"
a FreeBSD system, i.e., wiping
+ the swap slice
+ non-allocated space on volumes
+ "file-tails" (the part of the last allocated block of files not used)
with random patterns to avoid leakage of sensitive information (plain text
keys or decrypted texts).
I am aware of the security limitations of any approach that does not involve
dissolving the entire disk in acid etc but would be grateful for a pointer to
a tool that at least
+ generates reasonably random data for its writes
+ ideally does a reasonable effort of turning off caching whereever it could
(ideally in the file system, the disk driver, and the disk itself)
or alternatively at least did the overwrites in such an order that the
effect of caching would be minimized.
If there are no "tools", would you know whether I can get FreeBSD on shutdown
to stop using swap and access it as a raw disk device that I can write to, and
how to hook into the shutdown process?
(2) Related to this:
I'm also interested in people's personal experiences in using partition or
file system encryption options.
For performance reasons I'd rather avoid having /tmp and swap and certain work
space on an encrypted disk, hence the need for (1).
If you feel that I'm asking this all in the wrong place, please let me know.
With many thanks for your help,
David.
------------------------------------------------------------------------
Dr David Philip Kreil ("`-''-/").___..--''"`-._
Research Fellow `6_ 6 ) `-. ( ).`-.__.`)
University of Cambridge (_Y_.)' ._ ) `._ `. ``-..-'
++44 1223 764107, fax 333992 _..`--'_..-_/ /--'_.' ,'
www.inference.phy.cam.ac.uk/dpk20 (il),-'' (li),' ((!.-'
_______________________________________________
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
