I have whole-disk encryption on my laptop, so I’ve been frustrated that my backups were going to an unencrypted disk that sits in a shared office. The chance of that disk wandering off is low, but still: I wanted encryption. My first strategy was to make an 11GB .img file with dd and losetup, but mounting and unmounting were a pain and there’s not an elegant way to grow the image if need be. Next I tried using ecryptfs, but I twice ended up with processes I couldn’t kill -9 as root. Not fun. Additionally, that approach only encrypts the contents of files. Your filenames and directory structure are still plain to see, which would be too much of a disclosure for some people.

I was glad I found this howto, then, since it accomplishes everything I need:

• userspace: no root/sudo needed after initial setup
• nested in existing filesystem & directory structure
• grows dynamically
• simple

So let’s walk through how this worked for me. My laptop is named kant, the machine I’m backing up to garp (both running Ubuntu), and my username in all this is cmp. Substitute to meet your needs. Let’s start by setting up on garp:

sudo apt-get install encfs fuse-utils
sudo modprobe fuse
sudo adduser cmp fuse
sudo sh -c "echo fuse >> /etc/modules"

So what we’ve done so far is install encfs and fuse, load the fuse module, add my user to the fuse group, and set things up so that fuse will be loaded automatically at boot time. You should now reboot your machine or the rest of this howto won’t work.

We’re going to make two directories. One will hold the encrypted filesystem and the data, and the other is the mount point. Since in my case I’m backing up kant, I’m going to call the mount point kant.

mkdir ~/encrypted
mkdir ~/kant

The first time we use encfs to mount our encrypted directory, it will walk us through the setup process. That looks like this:

cmp@garp:~$ encfs /home/cmp/encrypted /home/cmp/kant
Creating new encrypted volume.
Please choose from one of the following options:
 enter "x" for expert configuration mode,
 enter "p" for pre-configured paranoia mode,
 anything else, or an empty line will select standard mode.
?>

Please note that I used full paths for the the two directories because encfs isn’t happy otherwise. If you ignored my suggestion to reboot above, you’ll get a fuse error at the end of this setup process. Once you have picked your settings and passphrase, you’ll be dumped back at a prompt with your ~/encrypted mounted to ~/kant. You can now put things in ~/kant as you would any normal directory, but when you unmount they will be nice gobbledygook over in ~/encrypted. I made a cmp/ directory and did a bit of syncing by hand to see if stuff works. I was satisfied so then I unmounted. Unmounting is done thusly:

fusermount -u /home/cmp/kant

Perusing ~/encrypted showed gobbledygook as expected. Huzzah! Now on to the backups. I decided I’m lazy enough that I made two one-line shell scripts to mount and unmount my backup directory. I put those in ~/bin on garp. Here is ‘backupmounter’:

#!/bin/bash
encfs /home/cmp/encrypted /home/cmp/kant

And then ‘unmountbackupdir’:

#!/bin/bash
fusermount -u /home/cmp/kant

Again, those are in ~/bin on garp. Now let’s head over to kant, where I put ‘backuptogarp’ in my ~/bin:

#!/bin/bash

# mount the encrypted directory
# note that we use -t to allocate a tty
# so that the password for the encfs directory won't echo
ssh -t cmp@garp.metalab.unc.edu /home/cmp/bin/backupmounter

# back up homedir
rsync -a --exclude="evil" \
        --exclude="plots" \
        /home/cmp/ cmp@garp.metalab.unc.edu:~/kant/cmp/

# unmount the encrypted directory
ssh cmp@garp.metalab.unc.edu /home/cmp/bin/unmountbackupdir

After saving backuptogarp to my ~/bin on kant, I can open a new shell and simply type ‘backuptogarp’. I get prompted for an encfs password and then the sync is off and running. Huzzah! Please note that I have an ssh key that gets me from kant to garp, and I have set up my gnome session to prompt me for my ssh key passphrase at login:

So that the script above only prompts me for the encfs passphrase. If you don’t want to use ssh keys, my approach probably isn’t terribly convenient for you.

From the cc-devel mailing list post a few hours ago:

I’ve finally finished creating and updating the liblicense packages for Debian and Ubuntu.

For Debian, just make sure your system is set to pull from Debian sid (“unstable”) – the packages are in the official archives; take a look at http://packages.debian.org/liblicense ! (Thanks to Mako for sponsoring my upload.)

For Ubuntu, for the time being, you should use the Creative Commons repository. Information on that is at http://mirrors.creativecommons.org/packages/ – short summary:

deb http://mirrors.creativecommons.org/packages hardy main

Add that sources.list, do “sudo aptitude install liblicense-python”, and then you can “import liblicense” to your heart’s content!

– Asheesh.

I’ve used pbuilder to build .deb packages of wordpress 2.5.1-4 (current in debian Sid) for Ubuntu 8.04 (hardy heron), along with its dependencies that aren’t available from the standard repos. Find the .deb packages here or use pbuilder to build your own.

Mutt 1.5.18-1 just came out recently, and the news just hit google reader, so I decided to build it. Why am I going with the debian package and not with the source straight from the mutt website? Two reasons. The first is that I run Ubuntu, so the build process is the same as with debian and the process is easier and more familiar than whatever various projects may want me to do for their particular build. The second is that the kind debian folks have a “mutt-patched” that rolls in the sidebar and other patches that many people (including myself)  find very handy.

Let’s get to building! Note that I’m assuming you’re on an Ubuntu Hardy Heron system here. I tried this build on a gutsy system and pbuilder choked. Step 1: backups. Back up your muttrc, local mail, kitchen sink, etc. Step 2: download the .dsc, .orig, and .diff files from the qa website linked to earlier and put them in a directory for this build, say “muttbuild” or similar:

cmpalmer@kant:~/muttbuild$ wget http://ftp.debian.org/debian/pool/main/m/mutt/mutt_1.5.18-1.dsc
cmpalmer@kant:~/muttbuild$ wget http://ftp.debian.org/debian/pool/main/m/mutt/mutt_1.5.18.orig.tar.gz
cmpalmer@kant:~/muttbuild$ wget http://ftp.debian.org/debian/pool/main/m/mutt/mutt_1.5.18-1.diff.gz

And unpack the “orig” one:

cmpalmer@kant:~/muttbuild$ tar -xzvf mutt_1.5.18.orig.tar.gz

Now you should be ready to use pbuilder to build it. If you’ve never used pbuilder before, have a look at the Ubuntu wikipage on using pbuilder. If my target distro is gutsy, for example, I’d have to change a line in /etc/pbuilderrc (or my own personal pbuilderrc). Once all that is squared away, let’s update to apply any changes to the rc:

cmpalmer@kant:~/muttbuild$ sudo pbuilder –update

And now we can let fly with the build:

cmpalmer@kant:~/muttbuild$ sudo pbuilder –build *.dsc

Did you get errors? Leave me comments. If not, you should find your .deb files in /var/cache/pbuilder/result (unless you changed the output directory in the rc file) and you can move them to your target machine for install. I built this version of mutt for gutsy and the install on the gutsy box failed dependencies for libgnutls and libncurses. I’ll have to either update the gutsy box or poke at this more. Both will have to wait.

LOL:

[22:55] <norsetto> crimsun: have you built this in a ppa? Trying to build it locally just trashes my hd to death
[22:59] <crimsun> norsetto: I’ve tried twice to build it locally. I gave up after, each time, it ate through all RAM and swap. I finally got work permission to build it on a machine there. It eats about 6 GB.
[23:01] <norsetto> crimsun: right, god bless java ….
[23:03] <norsetto> crimsun: ok, go on with that bloated thing

For some context, the trang packaged in gutsy and hardy has been broken for some time now. Crimsun fixed it. He rocks. Seriously: God Bless the Ubuntu MOTUs and everyone else who makes Ubuntu work. Hardy is gonna be awesome.

If you run Ubuntu and aren’t subscribed to Tombuntu, I recommend you grab your feed reader and go add it. Inspired by this post on screenlets, I mac-ified my Ubuntu:

The little flower-pot-looking-thing on the left is in fact a flower pot. You have to right-click and “give water” for the flower to grow. I’ve heard at least one complaint that that kind of tamagotchi-like software is insidious and perverse, but I’ve managed to convince myself that it will help me remember to properly water my real plants.

In the background you’ll notice a screenshot with a pony. That comes from this wired post on an XSS attack against cia.gov’s search box. Hilarity!

Why do I feel really self-conscious looking at this?

cmpalmer@kant:~$ history|awk ‘{a[$2]++ } END{for(i in a){print a[i] ” ” i}}’|sort -nr|head
85 ssh
58 sudo
57 cd
53 ls
40 host
34 ping
24 ifconfig
13 top
13 svn
13 mplayer

(hat tip: lucidfox)

I felt all responsible for having whole-disk encryption on my laptop, but sadly that’s defeatable:

Perhaps my google-fu is failing. I can’t seem to find an equivalent to debian’s apticron in Fedora. My specific requirements are for a tool that:

• shows what packages have updates available
• shows what kind (eg. critical security, moderate security, bugfix) of update each package is
• checks at user-configurable intervals
• sends mail at user-configurable intervals
• includes changelog or similar info in the email
• plain text. I don’t want a GUI, nor do I need HTML prettification.

Does such an animal already exist? I’ve already had one person tell me I should cook it up with the python yum module. I can’t believe nobody has done this already.

The box that hosts this blog, garp, is now running Ubuntu 7.10 “gutsy gibbon” for great most-recent-release justice. It had been happily running 7.04 for some time. The intersession break gave me the breathing room to push through the upgrade.

Garp had been mirroring gutsy since Thursday, so the upgrade was a convenient matter of pointing garp’s /etc/apt/sources.list to itself, more or less. I used file:///path/to/files instead of http://garp.

The last thing I did was add hardy to the mirror. I have the disk space, so now I’m mirroring the binaries for both gutsy and hardy, but not security updates for either. This is a gentle reminder to anybody using me as a mirror: use archive.ubuntu.com for your security updates. Oh, and those of you who aren’t at NCSU or UNC-CH: I’m sorry, but I have to limit the availability of my mirror to those campuses since it’s not clear whether opening garp to the world would violate the AUP here in the office or not.

Now back to reading Antarctica. Enjoy $DECEMBER_HOLIDAY, everybody.