TrueCrypt is an open source disk-encryption software which runs on
Windows (Vista/XP/2000) and on Linux. It creates encrypted disks (containers)
which can reside within an existing native file system or as a disk partition,
and its use is quite transparent to the underlying system: the encrypted
volume behaves as a native file system to the operating system. TrueCrypt
volumes are portable between supported operating systems, as long as the
original file system the volume was created on is supported. So if I create an
NTFS encrypted volume on an NTFS-formatted device such as an external USB
disk, I can mount that TrueCrypt volume under Linux as long as my Linux groks
NTFS. Getting TrueCrypt to run under Windows is a cynch; simply download
and run the installer and within a few minutes, TrueCrypt is ready to run
(without rebooting). Creation of an encrypted volume can take some time: a
64GB volume required about an hour on my notebook, but this is a one-time
operation. Getting TrueCrypt to run on Linux is a different matter. Either
your version is supported or you have to download the source code
and compile it yourself. I downloaded the kernel source package for my version
and installed the source RPM, and prepared it for building with cd
/usr/src/redhat/SPECS; rpmbuild –bp ––target i686–unknown–linux
kernel-2.6.spec. After changing to
/usr/src/redhat/BUILD/kernel-2.6.9/linux-2.6.9, I edited the Makefile and
set EXTRAVERSION= to blank and left the kernel otherwise uncompiled. I then
downloaded and unpacked the truecrypt 4.3 source, and launched the
building process, after which I installed the software.
# tar xvzf /tmp/truecrypt-4.3-source-code.tar.gz
# cd truecrypt-4.3-source-code/Linux/
# ./build.sh
Checking build requirements...
Linux kernel (2.6.9-42.0.3.ELsmp) source directory [/usr/src/linux]: /usr/src/redhat/BUILD/kernel-2.6.9/linux-2.6.9
Building kernel module... Done.
Building truecrypt... Done.
# ./install.sh
Checking installation requirements...
Testing truecrypt... Done.
Install binaries to [/usr/bin]:
Install man page to [/usr/share/man]:
Install user guide and kernel module to [/usr/share/truecrypt]:
Allow non-admin users to run TrueCrypt [y/N]: y
Installing kernel module... Done.
Installing truecrypt to /usr/bin... Done.
Installing man page to /usr/share/man/man1... Done.
Installing user guide to /usr/share/truecrypt/doc... Done.
Installing backup kernel module to /usr/share/truecrypt/kernel... Done.
I then mounted my external USB disk and proceeded to create a TrueCrypt volume on it.
# mount /dev/sdb2 /mnt
$ truecrypt --size 70G -c /mnt/backup.tc
TrueCrypt prompts me for missing options such as the file system type, hash algorithm and encryption algorithm, as well as the password with which the volume is to be protected, and it then spent the better part of fourty minutes creating the volume. Consult the online documentation and the manual page for the details. As soon as this is completed, the TrueCrypt volume is read, but I still have to create a Linux file system on it.
# truecrypt -N 2 /mnt/backup.tc
# ls -l /dev/mapper/truecrypt2
brw-rw---- 1 root disk 253, 0 Mar 19 21:22 /dev/mapper/truecrypt2
# mke2fs /dev/mapper/truecrypt2
# truecrypt -d /mnt/backup.tc
Now the volume is ready to be used, and I can mount it onto an existing mount point.
# mkdir /tc
$ truecrypt /mnt/backup.tc /tc
Password: **************
TrueCrypt is ideal for storing sensitive data or simply to create a backup on an external drive that you want to keep off site. I can give the drive to neighbours for safe-keeping without having to worry that they will look at my data. And what is the downside? Well, cryptography does put some strain on your CPU
load average: 63.22, 36.24, 16.71
when the volume is heavily utilized… :-(