Truecrypt encryption and Open Media Vault

  • Hiho,


    I need some help getting my TrueCrypt encrypted storage drive to work with OMV.
    To be clear, the entire disk is encrypted including the NTFS file system.
    How can I mount this encrypted hdd with omv and use cifs sharing?


    I belive that omv does not have a TrueCrypt plugin, but under the skirt omv is Debian.


    Is there a way? What should I do?


    I'm particularly interested in how to safely shut down omv after I mount such an encrypted drive. On the next omv boot there would prob be error due to not having the enc disk mounted despite having omv setup with a cifs share to a non-existing (Non-mounted) volume.


    I guess a very obvious q here is, is there a way to run a script in the OMV distro before omv share software loads loads? Also, is there a way to make omv run a script (dismount tc volumes) after it shuts down?

    • Offizieller Beitrag

    truecrypt will work on OMV because it is debian but there is no way to get it to work with the web interface/shared folders/etc (yet). Any script you run that makes changes to config files would be overwritten by the web interface. Give it a little more time. Volker is changing a few things in the storage backend and a truecrypt plugin may be possible in the future.

    omv 7.0.5-1 sandworm | 64 bit | 6.8 proxmox kernel

    plugins :: omvextrasorg 7.0 | kvm 7.0.13 | compose 7.1.4 | k8s 7.1.0-3 | cputemp 7.0.1 | mergerfs 7.0.4


    omv-extras.org plugins source code and issue tracker - github - changelogs


    Please try ctrl-shift-R and read this before posting a question.

    Please put your OMV system details in your signature.
    Please don't PM for support... Too many PMs!

  • hmmm. So I can't mount a tc disk in the debian backend OS and then in omv web interface choose the already mounted volume for sharing? Please confirm because I believe this is possible in omv... no?


    Tangentially , I think that Volker should add two fields.
    Add pre-omv-load script: [Browse]
    Add post-omv-shutdown script:[Browse]


    Scripts should be bash.


    With such, there should be no need for any plug-in for tc. In fact, this would make omv drastically more robust.
    I could mount the volumes with the script before omv even loads, and then safely auto unmount them after omv has shut down.

    • Offizieller Beitrag
    Zitat von "k567890"

    hmmm. So I can't mount a tc disk in the debian backend OS and then in omv web interface choose the already mounted volume for sharing? Please confirm because I believe this is possible in omv... no?


    No, it doesn't. A mounted filesystem doesn't show up in the Filesystems tab unless there is an entry in /etc/openmediavault/config.xml. I am working on this right now with a possible mhddfs plugin.


    Zitat von "k567890"

    With such, there should be no need for any plug-in for tc. In fact, this would make omv drastically more robust.
    I could mount the volumes with the script before omv even loads, and then safely auto unmount them after omv has shut down.


    Pre and post scripts wouldn't work because you can change settings in the web interface at any time which would overwrite any change made by those scripts. I disagree that this should be done without a plugin. The idea of OMV is to have a web interface that is easy to use. Plugins don't make anything less robust. If you look at the structure of a plugin, it is basically a javascript file for the web interface, php file to write to the database, and a shell script to write the config files. How is this less robust than a shell script run a start/shutdown?

    omv 7.0.5-1 sandworm | 64 bit | 6.8 proxmox kernel

    plugins :: omvextrasorg 7.0 | kvm 7.0.13 | compose 7.1.4 | k8s 7.1.0-3 | cputemp 7.0.1 | mergerfs 7.0.4


    omv-extras.org plugins source code and issue tracker - github - changelogs


    Please try ctrl-shift-R and read this before posting a question.

    Please put your OMV system details in your signature.
    Please don't PM for support... Too many PMs!

  • Interesting.


    If I was interested in making such a plug-in, is there some resource to help me / guide me?
    I saw the 3 part sticky guide in the forum. Asside from that, is there some IRC channel or something?
    Or am I supposed to just post here if I get stuck?


    To answer your question, what makes plug-ins less robust is that only those who know the internals of omv can make plug-ins. I need to know all sorts of schemes and hacks you are using. Where you db is, what you are storing in db. What is connected to what and how...etc etc etc. The internals of omv are not documented any plae as far as I know.


    Although in principle webinterface can clash with custom shell scripts, the point is that in some cases a person could make a script that doesn't clash because they are only adding functionality that webinterface doesn't have in the first place. Most of the time, there would not be any clash and it is often a one liner in linux. Making a plugin, is something that the avg linux user doesn't have the skills for but they can write a one line script no problem.


    So has something changed in OMV since 0.3 so that this is no longer possible?
    Here is someone that may have done it.
    http://forums.openmediavault.o…603&hilit=truecrypt#p2603

  • If you're interested in the Plugin Development I can let you invite to development forum. You'll find some of the Information you asked for there... Just let me know and I will take care off it.


    Greetings
    David

    "Well... lately this forum has become support for everything except omv" [...] "And is like someone is banning Google from their browsers"


    Only two things are infinite, the universe and human stupidity, and I'm not sure about the former.

    Upload Logfile via WebGUI/CLI
    #openmediavault on freenode IRC | German & English | GMT+1
    Absolutely no Support via PM!

  • davidh2k, thanks. I may be interested in this. The only issue for me is lack of time due to work. I'll send you a pm if I get some free time and decide to make a plug in. I just wanted to know that there was some help. Glad to know you have a dev forum.


    tekkbebe, that is true. However, is there really a diff from omv's point of view? The drive is already encrypted... When you mount something (be it a drive or a container) via TC, the end result is the same... a mounted volume. Things that use that mounted volume should not know the diff. In both cases TC uses fuse and produces the same end ressult.

  • OMV needs to have the fstab entry for your in the omv conf.xml. I think you could add these entries yourself, but I don't know if OMV can execute the mounting procedure of TC, even if its just with a keyfile and without any password. - If you mount it manually you can't add the fstab entry into the conf.xml because OMV would try to remount it. You could however do something like a share on one of your normal data drives, which symlinks to the mounted TC volume. I would try that.


    Unmounting while shutdown? Add a script that executes a truecrypt unmount in rc.0 and give a high priority!


    PS: You will get a PM in the next few minutes from me about the Dev forum. Take your time and have a look when you want to.


    Greetings
    David

    "Well... lately this forum has become support for everything except omv" [...] "And is like someone is banning Google from their browsers"


    Only two things are infinite, the universe and human stupidity, and I'm not sure about the former.

    Upload Logfile via WebGUI/CLI
    #openmediavault on freenode IRC | German & English | GMT+1
    Absolutely no Support via PM!

    • Offizieller Beitrag
    Zitat von "k567890"

    If I was interested in making such a plug-in, is there some resource to help me / guide me?
    I saw the 3 part sticky guide in the forum. Asside from that, is there some IRC channel or something?
    Or am I supposed to just post here if I get stuck?


    OMV 0.5 is documented here. You can post questions on the development forum (I don't use IRC). Looking at plugins Volker has written (here) and the 3rd party plugins (here) is how I learned. I still refer to the OMV code all the time. The rest comes from your knowledge of javascript, php, and shell scripting. The three part tutorial is very good. It is hard to go much further without making it specific to a service.


    Zitat von "k567890"

    To answer your question, what makes plug-ins less robust is that only those who know the internals of omv can make plug-ins. I need to know all sorts of schemes and hacks you are using. Where you db is, what you are storing in db. What is connected to what and how...etc etc etc. The internals of omv are not documented any plae as far as I know.


    All OMV does is give you an interface to enter values and a method to get those values to a shell script. You don't have to know the internals of OMV. You write the script that writes the config files. Once you look at the plugins more, it will make more sense.


    Zitat von "k567890"

    Although in principle webinterface can clash with custom shell scripts, the point is that in some cases a person could make a script that doesn't clash because they are only adding functionality that webinterface doesn't have in the first place. Most of the time, there would not be any clash and it is often a one liner in linux. Making a plugin, is something that the avg linux user doesn't have the skills for but they can write a one line script no problem.


    Very few services (minidlna, transmission, virtualbox, mysql, etc...) can be used with a one line script. It is tough enough supporting a web interface let alone a script where one semi-colon may make the script non-functional.

    omv 7.0.5-1 sandworm | 64 bit | 6.8 proxmox kernel

    plugins :: omvextrasorg 7.0 | kvm 7.0.13 | compose 7.1.4 | k8s 7.1.0-3 | cputemp 7.0.1 | mergerfs 7.0.4


    omv-extras.org plugins source code and issue tracker - github - changelogs


    Please try ctrl-shift-R and read this before posting a question.

    Please put your OMV system details in your signature.
    Please don't PM for support... Too many PMs!

  • Very good. I'll look into this time permitting.


    I think I figured out a quick (temp) solution for now but I think a plug-in is something I would be interested in making once I'm not bombarded with work.

  • I'm interested in Truecrypt aswell. I'm just about to setup my first OMV installation and would really like to secure my RAID10 (6x4TB) setup with some sort of encryption.


    How does encrypting the whole data set impede my performance would you think?
    I read something about newer Intels CPU's are supposed to have hardware acceleration for AES so shouldn't be that bad.


    To me it's most important to make sure that the data is safe is someone where to remove the server from my home.

  • Since the first Core-i Generation the AES codeset exists, however it isn't available on all CPUs. If you got it on your CPU the speed impact will be really small.


    Do you need to secure all Data? If its just a bunch of personal Data I would suggest a TrueCrypt Container over a whole drive encryption.


    Greetings
    David

    "Well... lately this forum has become support for everything except omv" [...] "And is like someone is banning Google from their browsers"


    Only two things are infinite, the universe and human stupidity, and I'm not sure about the former.

    Upload Logfile via WebGUI/CLI
    #openmediavault on freenode IRC | German & English | GMT+1
    Absolutely no Support via PM!

  • I'd like to encrypt the whole RAID since I don't want anybody to be able to access any content.
    If somebody steals it or whatever they would have to format to be able to even use it.


    Any idea if Truecrypt will be available for easy implementation in the near future?

  • At least no one is working on a truecrypt (plugin) implementation, yet. However I will put it up on the plugin wish list.


    Greetings
    David

    "Well... lately this forum has become support for everything except omv" [...] "And is like someone is banning Google from their browsers"


    Only two things are infinite, the universe and human stupidity, and I'm not sure about the former.

    Upload Logfile via WebGUI/CLI
    #openmediavault on freenode IRC | German & English | GMT+1
    Absolutely no Support via PM!

Jetzt mitmachen!

Sie haben noch kein Benutzerkonto auf unserer Seite? Registrieren Sie sich kostenlos und nehmen Sie an unserer Community teil!