In HOW-TO create and use an encrypted SD card as a folder on your eee I showed a way to store files easily in an encrypted SD card. However, for complete security, this is not enough. As you use your eee, all sorts of potentially sensitive information may be written to your Home Folder without you being able to divert it to your encrypted folder - copies of emails, log on information for web sites, etc. What is needed is a way to store all your Home Folder on an encrypted SD card.

In an ideal world, it should be possible to interrupt the eee PC boot process to allow you to enter a Truecryt password, and then allow the boot to continue as normal. Alternatively it should be possible to use the Linux pam mechanism to share your login password with Truecrypt. I've not been able to get either of these to work. The process I'm documenting here has been working successfully for me - please comment here to suggest better ways.

Warning - the initial setup is a bit flakey and may result in an unbootable eee, so don't try it unless you're happy you can restore your Eee using some other method.

Install Truecrypt and create an encrypted SD card

See HOW-TO create and use an encrypted SD card as a folder on your eee. The HOW-TO you are reading now assumes you have done worked through the previous HOW-TO successfully.

Store the necessary files on /opt

We need to move the myfolder.sh out of harm's way off the Home Folder. I'm putting it on /opt.

home/user> cd /opt
/opt> sudo mkdir /opt/truecrypt
/opt> sudo chown user:user /opt/truecrypt
/opt> cd truecrypt
/opt/truecrypt> mv -v /home/user/myfolder.sh .

I now need to change myfolder.sh and simpleui.rc to point to the new locations.
Edit /opt/truecrypt/myfolder.sh:

#!/bin/bash

STORE="/dev/sdcard1"
HOME="/home/user"

Sudo edit /opt/xandros/share/AsusLauncher/simpleui.rc:

<parcel simplecat="Work" extraargs="/opt/truecrypt/myfolder.sh"
    icon="disk_utility_norm.png" 
    selected_icon="disk_utility_hi.png">
    <name lang="en">Disk</name>    
</parcel>

If you're still using the default desktop theme, I suggest you change it now (the reason will be obvious later) using Settings -> Personalization -> Desktop Theme. Close down any running applications except your terminal window.

Copy your Home Folder to the encrypted SD card

Note: the -a archive flag copies all sub folders too.

/opt/truecrypt> mkdir user
/opt/truecrypt> truecrypt /dev/sdcard1 user
Enter password for '/dev/sdcard1':
/opt/truecrypt> sudo cp -av /home/user .
/opt/truecrypt> truecrypt -d

Backup your Home Folder and create a new empty one

This is the scary bit. Once we've moved /home/user to /home/backup, we have effectively cut the ground away from under our feet. Even though we quickly create a new /home/user, it's empty, and any programs currently running on the eee which are expecting to write to the old /home/user might die terribly. Cross your fingers ... and type quickly

/opt/truecrypt> sudo mv -v /home/user /home/backup
/opt/truecrypt> sudo mkdir /home/user
/opt/truecrypt> sudo chown user:user /home/user


Reboot your eee

You'll probably find nothing much works, but you should be able to <Alt><Ctrl><Backspace> to reboot the eee. You should see the initial set-up screens - as if you had a brand new eee. Login as normal - set the eee for automatic login. Note the theme - it will be the eee default.

Now find the 'Disk' icon you put on the 'Work' tab. Click on it, and give your Truecrypt password. You may or may not see the 'Successful' message. Now <Alt><Ctrl><Backspace>. The eee will reboot, and you should see everything as normal (the desktop theme will change).

Using the encrypted SD card

From now on, when you switch on your eee, it will always boot into the 'empty' home folder (having a different theme reminds you that you aren't connected to your encrypted drive yet). Click on the 'Disk' icon, enter your Truecrypt password, <Alt><Ctrl><Backspace>, and you're in business.

A simpler boot up process

Note: once you are happy everything is working correctly you can remove the backup with sudo rm -rf /home/backup.

I also recommend you download and use this modified myfile.sh script which automatically does the <Alt><Ctrl><Backspace> as soon as the Truecrypt disk is connected. With this script, all you need to do is click on the Disk icon, enter your Truecrypt password, and click <OK>. Just like logging on.

Have you a better way to do this?

Please post replies below.

Do not ever ever forget your Truecrypt password

Last edited by jpmcc (2008-01-22 2:01:34 pm)