/
RELNOTES
809 lines (435 loc) · 21.1 KB
/
RELNOTES
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
Release notes for cryptmount-6.2
RW Penney, January 2023
Introduction
============
cryptmount is a utility for GNU/Linux operating systems which allows
an ordinary user to mount an encrypted filing system without requiring
superuser privileges, and which assists the system-administrator in
creating and managing encrypted filesystems & swap-partitions.
cryptmount automatically performs the various stages of configuring
any supporting loopback and device-mapper targets needed to access
an encrypted filing system before actually mounting it, but
without requiring the user to be explicitly granted root privileges
through either knowing the root password or through tools such as sudo.
Filesystems managed by cryptmount can also be designated so that only
the superuser can (un)mount them.
By allowing user-level, on-demand, mounting of encrypted filing systems,
cryptmount allows filesystems that are only used intermittently to be
left in a more secure state than if they have to be made available by
the system administrator whenever the system is booted.
cryptmount also provides an aid to the system manager in allowing easier
control over the configuration and mounting of encrypted filesystems,
especially within system start-up scripts.
Summary of new features in cryptmount-6.2
=========================================
This (stable) release offers the following improvements:
* More robust handshaking on device setup using libudev
It has been tested on the following systems:
* Arch Linux (early-Jan-2023) (x86_64)
* Debian GNU/Linux 12.x ("bookworm"/"testing", early-Jan-2023) (amd64)
* Debian GNU/Linux 11.6 ("bullseye") (amd64)
* Debian GNU/Linux 10.13 ("buster") (x86)
* Fedora 37 (x86_64)
* openSUSE Leap 15.4 (x86_64)
* Ubuntu 22.10 ("kinetic") (x86_64)
Summary of new features in cryptmount-6.1
=========================================
This (stable) release offers the following improvements:
* Improved deconfliction when operating simultaneously with other device-mapper tools
* Revised installation instructions, now in markdown format
It has been tested on the following systems:
* Alma Linux 9.0 (x86_64, lacking libcryptsetup headers)
* Arch Linux (mid-Dec-2022) (x86_64)
* Debian GNU/Linux 12.x ("bookworm"/"testing", early-Oct-2022) (amd64)
* Debian GNU/Linux 11.6 ("bullseye") (amd64)
* Debian GNU/Linux 10.13 ("buster") (x86)
* Fedora 37 (x86_64)
* Ubuntu 22.10 ("kinetic") (x86_64)
Summary of new features in cryptmount-6.0
=========================================
This (stable) release offers the following enhancements:
* cryptmount-setup script uses LUKS format by default
* Support for wider range of libgcrypt & OpenSSL cipher algorithms
It has been tested on the following systems:
* Arch Linux (mid-Aug-2022) (x86_64)
* Debian GNU/Linux 12.x ("bookworm"/"testing", early-Sep-2022) (amd64)
* Debian GNU/Linux 11.4 ("bullseye") (amd64)
* Debian GNU/Linux 10.12 ("buster") (x86)
* Fedora 36 (x86_64)
* Ubuntu 22.04 ("jammy") (x86_64)
Summary of new features in cryptmount-5.3
=========================================
This (stable) release offers the following enhancements:
* Improved compatability with libcryptsetup-2.x
It has been tested on the following systems:
* Arch Linux (late-Dec-2020) (x86_64)
* CentOS 8.3.2011 (x86_64)
* Debian GNU/Linux 11.x ("bullseye"/"testing", late-Dec-2020) (amd64)
* Debian GNU/Linux 10.7 ("buster") (amd64, x86)
* Debian GNU/Linux 9.13 ("stretch") (x86)
* Fedora 33 (x86_64)
* Gentoo (late-Dec-2020) (x86)
* Ubuntu 20.10 ("groovy") (x86_64)
Summary of new features in cryptmount-5.2
=========================================
This (stable) release offers the following enhancements:
* Fixes to filesystem-check (fsck) PATH setup
* Allowing multiple password attempts within setup script
* Various code cleanups
It has been tested on the following systems:
* Arch Linux (mid-Jan-2018) (x86_64)
* CentOS 7.4 (x86_64)
* Debian GNU/Linux 10.x ("buster"/"testing", mid-Jan-2018) (x86)
* Debian GNU/Linux 9.3 ("stretch") (amd64)
* Debian GNU/Linux 8.10 ("jessie") (x86)
* Gentoo (mid-Dec-2017) (x86)
* Ubuntu 17.10 ("artful") (x86_64)
Summary of new features in cryptmount-5.1
=========================================
This (stable) release offers the following enhancements:
* Improved portability of RPM build scripts
It has been tested on the following systems:
* Arch Linux (early-May-2015) (x86)
* CentOS 7.1 (x86_64)
* Debian GNU/Linux 8.0 ("jessie") (x86, amd64)
* Debian GNU/Linux 7.3 ("wheezy") (x86)
* Fedora 21 (x86_64)
* OpenSuSE 13.2 ("harlequin") (x86)
* Ubuntu 15.04 ("vivid") (x86_64)
Summary of new features in cryptmount-5.0
=========================================
This (stable) release offers the following enhancements:
* Delegation of all LUKS functionality to libcryptsetup
* Addition of '--status' option to query filesystem mounting status
It has been tested on the following systems:
* Arch Linux (late-Apr-2014) (x86)
* Gentoo (late-Apr-2014) (x86)
* Debian GNU/Linux 7.x ("jessie"/"testing", late-Apr-2014) (x86)
* Debian GNU/Linux 7.3 ("wheezy") (x86, amd64)
* Mageia 4 (x86)
* OpenSuSE 12.3 ("dartmouth") (x86_64)
* Ubuntu 14.04 ("trusty") (x86_64)
Summary of new features in cryptmount-4.5
=========================================
This (stable) release offers the following enhancements:
* Support for TRIM/allow_discards options suitable for solid-state disks
* Moving run-time state information from /etc into /run
* Updating of loop-device management to use /dev/loop-control interface
It has been tested on the following systems:
* Arch Linux (early-Jan-2014) (x86)
* CentOS 6.5 (x86_64)
* Debian GNU/Linux 7.x ("jessie"/"testing", early-Jan-2014) (x86)
* Debian GNU/Linux 7.3 ("wheezy") (x86, amd64)
* Debian GNU/Linux 6.0 ("squeeze") (x86)
* Debian GNU/Linux 5.0 ("lenny") (x86)
* Fedora 20 ("heisenbug") (x86_64)
* Gentoo (early-Jan-2014) (x86)
* Mageia 3 (x86)
* OpenSuSE 12.3 ("dartmouth") (x86_64)
* Ubuntu 13.10 ("saucy") (x86_64)
Summary of new features in cryptmount-4.4
=========================================
This (stable) release offers the following enhancements:
* Support for systemd
* Unified support for automatic filesystem setup on system boot
* Improved handling of kernel module loading on initial setup
* Improved support for management of LUKS partitions to mirror cryptsetup-1.6
It has been tested on the following systems:
* Arch Linux (mid-May-2013) (x86)
* CentOS 6.4 (x86_64)
* Debian GNU/Linux 7.x ("jessie"/"testing", mid-May-2013) (x86)
* Debian GNU/Linux 7.0 ("wheezy") (x86, amd64)
* Debian GNU/Linux 6.0 ("squeeze") (x86)
* Debian GNU/Linux 5.0 ("lenny") (x86)
* Fedora 18 ("spherical cow") (x86_64)
* Gentoo (x86, mid-May-2013)
* OpenSuSE 12.2 ("mantis") (x86_64)
* Ubuntu 13.04 ("raring ringtail") (x86_64)
Summary of new features in cryptmount-4.3
=========================================
This (stable) release offers the following enhancements:
* Support for environmental variables within target definitions
* Improved support for management of LUKS partitions to mirror cryptsetup-1.4
It has been tested on the following systems:
* CentOS 5.7 (x86)
* Debian GNU/Linux 6.1 ("wheezy"/"testing", mid-March-2012) (x86)
* Debian GNU/Linux 6.0 ("squeeze") (x86, amd64)
* Fedora 16 (x86_64)
* Gentoo (x86, mid-February-2012)
* Linux Mint 11 ("kataya")
* OpenSuSE 11.4 (x86)
* Ubuntu 10.04 ("lucid lynx") (x86_64)
Summary of new features in cryptmount-4.2
=========================================
This (stable) release offers the following enhancements:
* Improved protection against accidental formatting of swap partitions
* Improved support for management of LUKS partitions to mirror cryptsetup-1.2
It has been tested on the following systems:
* CentOS 5.6 (x86)
* Debian GNU/Linux 6.1 ("wheezy"/"testing", mid-June-2011) (x86)
* Debian GNU/Linux 6.0 ("squeeze") (x86, amd64)
* Debian GNU/Linux 5.0 ("lenny") (x86)
* Fedora 13 (x86_64)
* Gentoo (x86, early-June-2011)
* OpenSuSE 11.4 (x86)
* Ubuntu 10.04 ("lucid lynx") (x86_64)
* Ubuntu 8.04 ("hardy heron") (x86)
Summary of new features in cryptmount-4.1
=========================================
This (stable) release focuses on compatibility improvements including:
* Facilities for user-supplied options to 'fsck' for automatic checking
of filesystems on mounting
* Improved support for management of LUKS partitions to mirror cryptsetup-1.1
including user-selected hashing functions and code-cleanup
It has been tested on the following systems:
* Debian GNU/Linux 5.1 ("squeeze"/"testing", mid-May-2010) (x86)
* Debian GNU/Linux 5.0 ("lenny") (x86, amd64, ppc)
* Fedora 12 (x86)
* FedoraCore-7 (x86)
* Gentoo (x86, late-May-2010)
* OpenSuSE 11.1 (x86)
* Slackware 12.2 (x86)
* Ubuntu 10.04 ("lucid lynx") (amd64)
* Ubuntu 8.04 ("hardy heron") (x86)
Summary of new features in cryptmount-4.0
=========================================
This (stable) release focuses on security & functionality
improvements including:
* Support for encrypted filesystems protected by password,
without the need for a separate keyfile or partition header
* Enhanced protection against password attacks in the builtin key-manager
through additional hash-based password strengthening
* Improved support for selecting different encryption schemes
when creating LUKS partitions
* Substantial tidying of internal interfaces & removal of legacy code
It has been tested on the following systems:
* Debian GNU/Linux 5.1 ("squeeze"/"testing", late-Apr09) (x86)
* Debian GNU/Linux 5.0 ("lenny") (x86, ppc)
* Debian GNU/Linux 4.0 ("etch") (x86, amd64)
* Fedora 9 (x86)
* FedoraCore-7 (x86)
* OpenSuSE 11.1 (x86)
* Slackware 12.2 (x86)
* Ubuntu 8.04 ("hardy heron") (x86)
* Ubuntu 7.10 ("gutsy gibbon") (x86)
Summary of new features in cryptmount-3.1
=========================================
This (stable) release focuses on adding support for LUKS partitions
* Support for mounting of existing LUKS partitions was added
* Support for basic formatting of LUKS partitions was added
* Support for changing passwords on LUKS partitions was added
It has been tested on the following systems:
* Debian GNU/Linux 4.1 ("lenny"/testing, mid-Sep08) (x86)
* Debian GNU/Linux 4.0 ("etch") (x86, amd64)
* Fedora 9 (x86)
* FedoraCore-7 (x86)
* OpenSuSE Linux 10.2 OSS (x86)
* Ubuntu 8.04 ("hardy heron") (x86)
* Ubuntu 7.10 ("gutsy gibbon") (x86)
Summary of new features in cryptmount-3.0
=========================================
This (stable) release focuses on code-tidying and usability improvements
* Support for default settings within filesystem configuration file
* Support for multiple password attempts when interactively
mounting encrypted filesystems
* Improved internationalization infrastructure in filesystem setup-script,
including French localization
* German localization of message in main application
* Removed dependence on OpenSSL library for OpenSSL-compatible access-keys
It has been tested on the following systems:
* Debian GNU/Linux 4.1 ("lenny"/testing, mid-May08) (x86)
* Debian GNU/Linux 4.0 ("etch") (x86, amd64)
* FedoraCore-7 (x86)
* FedoraCore-5 (x86)
* OpenSuSE Linux 10.2 OSS (x86)
* Ubuntu 8.04 ("hardy heron") (x86)
* Ubuntu 7.10 ("gutsy gibbon") (x86)
Summary of new features in cryptmount-2.2
=========================================
This (stable) release focuses on code-tidying and usability improvements
* Support for reading passwords from streams,
to allow integration with scripts or GUI wrappers
* Prioritization of libgcrypt (with OpenSSL compatibility layer) over libssl
for access-key security
It has been tested on the following systems:
* Debian GNU/Linux 4.0 ("etch") (x86, amd64)
* Debian GNU/Linux 3.1 ("sarge") (x86)
* FedoraCore-7 (x86)
* FedoraCore-5 (x86)
* OpenSuSE Linux 10.2 OSS (x86)
* Ubuntu 7.10 ("gutsy gibbon") (x86)
Summary of new features in cryptmount-2.1
=========================================
This (stable) release focuses on extended functionality and consolidation
* Setup script added for basic configuration of new encrypted filesystems
* Support for OpenSSL key-files via the libgcrypt library
* Facilities for translating between access-keys stored in different formats
* Improved handling of system shutdown while loopback filesystems are active
It has been tested on the following systems:
* Debian GNU/Linux 4.0 ("etch") (x86, amd64)
* Debian GNU/Linux 3.1 ("sarge") (x86)
* FedoraCore-7 (x86)
* FedoraCore-5 (x86)
* OpenSuSE Linux 10.2 OSS (x86)
* Ubuntu 7.04 ("feisty fawn") (x86)
(may need 'modprobe dm-crypt' and creation of extra /dev/loop? nodes)
Summary of new features in cryptmount-2.0
=========================================
This (stable) release focuses on extended functionality and improved internal structure, including:
* Built-in key management based on SHA1 + Blowfish crypto-algorithms,
which can be used when OpenSSL or libgcrypt are not available
(e.g. during system boot-up, or if not installed at all)
* OpenSSL & libgcrypt key-management now available through
dynamically loadable modules
* Improved support for very large (64bit) filing systems
* Improved support for setup of encrypted devices at system boot
* Various improvements to error-trapping and portability
It has been tested on the following systems:
* Debian GNU/Linux 4.0 ("etch") (x86, amd64)
* Debian GNU/Linux 3.1 ("sarge") (x86, kernel-2.6)
* OpenSuSE Linux 10.2 OSS (x86)
* FedoraCore-5 (x86)
Summary of new features in cryptmount-1.2
=========================================
This (stable) release focuses on extensions in functionality, including:
* support for reading configuration data via the command-line
* support for priority-setting on crypto-swap
* improved robustness to pathological (un)mount operations
It has been tested on the following systems:
* Debian GNU/Linux 3.1 ("sarge") (x86, kernel-2.6)
* Ubuntu 6.06.1 ("dapper drake") (x86)
(may need patching of 'dd' and creation of extra /dev/loop? nodes)
* SuSE Linux 10.0 OSS (x86)
* Mandriva Linux 2005 (x86)
* FedoraCore-5 (x86)
* FedoraCore-4 (x86)
Summary of new features in cryptmount-1.1
=========================================
This (stable) release focuses on extensions in functionality, including:
* support for encrypted swap partitions
* multiple formats for key-files, currently either OpenSSL or libgcrypt
* addition of a script for mounting filesystems/swap partitions at boot
It has been tested on the following systems:
* Debian GNU/Linux 3.1 ("sarge") (x86, kernel-2.6)
* SuSE Linux 10.0 OSS (x86)
* Mandriva Linux 2005 (x86)
* FedoraCore-5 (x86)
* FedoraCore-4 (x86)
Summary of new features in cryptmount-1.0
=========================================
This (stable) release focuses on extensions in robustness, user-friendliness
and internationalization, including:
* addition of options for changing the access password for each target
* addition of mechanisms for generating
random decryption keys for new filesystems
* addition of compile-time option for responding to invocation via
linked executables named "cryptumount", "cryptunmount" etc.
* added support for GNU gettext, including French translations of
manual pages and common messages
* improved mechanisms for preventing unauthorized unmounting of filesystems
It has been tested on the following systems:
* Debian GNU/Linux 3.1 ("sarge") (x86, kernel-2.6)
* SuSE Linux 10.0 OSS (x86)
* Mandriva Linux 2005 (x86)
* FedoraCore-4 (x86) (may need extra configuration of
security policies governing losetup, mke2fs etc)
Summary of new features in cryptmount-0.4
=========================================
This (beta) release focuses on extensions in functionality and robustness,
including:
* addition of switches allowing filesystem mounting to be restricted
only to superuser
* addition of automatic filesystem checking (via fsck) prior to mounting
* compile-time choice between in-built mount, or /bin/mount etc
* addition of facility for unencrypted filesystem key
(e.g. stored on removable device such as a USB key)
It has been tested on the following systems:
* Debian GNU/Linux 3.1 ("sarge") (x86, kernel-2.6)
* FedoraCore-4 (x86) (may need extra configuration of
security policies governing losetup, mke2fs etc)
* Mandriva Linux 2005 (x86)
* SuSE Linux 10.0 OSS (x86)
Summary of new features in cryptmount-0.3
=========================================
This (beta) release focuses on extensions in functionality and robustness,
including:
* addition of '--all' command-line option, for example to allow easier
unmounting of all encrypted filing systems via 'cryptmount --unmount --all'
* multiple targets can be specified on the command-line, for example
for mounting multiple filing systems at the same time
* support for loopback filingsystems >2GB has been improved
* all mounting/unmounting activity is now recorded via syslog
* security checks on the configuration file have been extended
* improved documentation of password-changing & fsck tasks
It has been tested on the following systems:
* Debian GNU/Linux 3.1 ("sarge") (x86, kernel-2.6)
* FedoraCore-4 (x86) (may need extra configuration of
security policies governing losetup, mke2fs etc)
* Mandriva Linux 2005 (x86)
* SuSE Linux 10.0 OSS (x86)
Summary of new features in cryptmount-0.2
=========================================
This (beta) release focuses on extensions in functionality, including:
* addition of optional configuration-file parameters for selecting
a subset of blocks within a device for hosting the filing system
* addition of optional configuration-file parameter for selecting
a particular loopback device rather than having one chosen automatically
* addition of optional cipher-IV parameter to configuration-file
* improved detection of errors in the configuration-file
* basic security checks performed on configuration-file and
target-description before any privileged action is taken
It has been tested on the following systems:
* Debian GNU/Linux 3.1 ("sarge") (x86, kernel-2.6)
* FedoraCore-4 (x86) (may need extra configuration of
security policies governing losetup, mke2fs etc)
* Mandriva Linux 2005 (x86)
* SuSE Linux 10.0 OSS (x86)
Summary of new features in cryptmount-0.1
=========================================
This (beta) release focuses on improvements in robustness, portability
and documentation, including:
* improved support for systems with glibc built against kernel-2.4 headers
* addition of mechanisms for updating /etc/mtab on (un)mounting filing
systems, so the programs such as df can operate normally on filesystems
controlled by cryptmount
* clearer examples on usage within README & the cryptmount man-page
(avoiding ambiguities about whether 'aes256', rather than 'aes',
is a valid kernel-module name)
It has been tested on the following systems:
* Debian GNU/Linux 3.1 ("sarge") (x86, kernel-2.6)
* FedoraCore-4 (x86) (may need extra configuration of
security policies governing losetup, mke2fs etc)
* Mandriva Linux 2005 (x86)
* SuSE Linux 10.0 OSS (x86)
Summary of new features in cryptmount-0.0.3
===========================================
This (alpha) release further improves robustness, and portability including:
* a bug which restricted protection of cipher-key to the Blowfish and
md5 algorithms has been fixed, thereby allowing any cipher/hash
supported by the openssl library to be used
* differences in behaviour of libdevmapper which may or may not create
device-nodes below /dev/mapper, have been allowed for
* an automatic testing script has been written
* improved detection of failure to decrypt the cipher-key has been added
It has been tested on the following systems:
* Debian GNU/Linux 3.1 ("sarge") (x86, kernel-2.6)
* SuSE Linux 10.0 OSS (x86)
Summary of new features in cryptmount-0.0.2
===========================================
This (alpha) release of cryptmount improves general robustness and documentation as follows:
* a basic manual-page has been written
* a locking mechanism has been added, to ensure that only the
(non-root) user that mounted a filing system can unmount it
* tidying-up of devices occurs if mounting fails
It has been tested on the following system:
* Debian GNU/Linux 3.1 ("sarge") (x86, kernel-2.6)
Summary of features in cryptmount-0.0.1
=======================================
This initial (pre-alpha) release of cryptmount offers the following features:
* support for all encryption algorithms supported by the kernel
* encryption of cipher-key by Blowfish algorithm & md5 message-digest
It has been tested on the following system:
* Debian GNU/Linux 3.1 ("sarge") (x86, kernel-2.6)
Acknowledgements
================
Please see the file 'AUTHORS' in the source package for a list of contributors.