Showing posts with label encryption. Show all posts
Showing posts with label encryption. Show all posts

Wednesday, October 14, 2015

Encrypt DNS Traffic In Ubuntu With DNSCrypt [Ubuntu PPA]

This article was posted a while back but I've decided to repost it because there's a new PPA that you can use to install dnscrypt-proxy in Ubuntu (14.10, 14.04 and 12.04) and also, some parts of the article needed to be updated.

DNSCrypt is a protocol for securing communications between a client and a DNS resolver, preventing spying, spoofing or man-in-the-middle attacks. To use it, you'll need a tool called dnscrypt-proxy, which "can be used directly as your local resolver or as a DNS forwarder, authenticating requests using the DNSCrypt protocol and passing them to an upstream server".

Thanks to Pascal Mons (work based on  Sergey "Shnatsel" Davidoff's initial PPA, which doesn't have packages for Ubuntu 14.04 or 14.10 right now), you can easily install it Ubuntu. His packages use 127.0.0.2 as the local IP address so it doesn't interfere with Ubuntu's default setup. Also, for extra security, the packages use a dedicated system user, with no privileges - DNSCrypt will chroot to this user's home directory and drop root privileges for this user's uid as soon as possible.

The default DNSCrypt-enabled resolver used by Pascal's package is DNSCrypt.eu Resolver #1 @ The Hague, Holland, but this, along with other settings, can be changed by editing the /etc/default/dnscrypt-proxy configuration file (use "sudo service dnscrypt-proxy restart" after making changes to the configuration file). A list of public DNS resolvers supporting DNSCrypt can be found HERE (note that to get to the actual provider name, address and public key, you need to scroll to the right - annoying, I know).

According to Pascal, he didn't use the US based OpenDNS resolver, because it keeps logs of the websites you visit and it hijacks the homepage on all browsers, redirecting any URL bar search to its own servers in some cases, which does not happen with the DNSCrypt.eu servers.

If you want to add DNSCrypt support to your own public or private resolver, check out DNSCrypt-Wrapper, a server-side dnscrypt proxy that works with any name resolver.


Install DNSCrypt (dnscrypt-proxy) in Ubuntu / Linux Mint via PPA


1. To add Pascal's DNSCrypt PPA and install dnscrypt-proxy in Ubuntu, Linux Mint, elementary OS or other Ubuntu-based Linux distributions (including armhf), use the following commands:
sudo add-apt-repository ppa:anton+/dnscrypt
sudo apt-get update
sudo apt-get install dnscrypt-proxy
Note: the PPA description provides information on how to check the authenticity of the code used for building the packages.

2. After installing DNSCrypt, you need to set your network connection DNS server to 127.0.0.2. 

To do this in Unity, from the Network Manager indicator select Edit Connections, then select the connection and click Edit, switch to the IPv4 Settings tab and:

- if you're using Manual (static IP) as the "Method", enter "127.0.0.2" under "DNS servers" (and remember / note your original DNS server in case you want to go back to it), then click "Save":


- if you're using "Automatic (DHCP)" as the "Method", switch it to "Automatic (DHCP) addresses only" and enter "127.0.0.2" under "DNS servers", then click "Save":


3. And finally, restart your network connection (under Unity: select Network indicator > Enable Networking twice to disable and then re-enable it) and web browser.

You may want to check if the "127.0.0.2" DNS is actually in use (it needs to be the only DNS) - to do this in Unity, from the Network indicator select Connection Information.

Because the dnscrypt-proxy packages from Pascal's PPA don't use OpenDNS, you can't check to see if the DNS are used via the "dig txt debug.opendns.com" command or by visiting OpenDNS' test pages. However, you can check this by visiting https://dnsleaktest.com/ and running a DNS check - if you didn't change the default dnscrypt-proxy package resolver, it should display something like this:


Another way of checking if dnscrypt-proxy is working is by using the following command:
sudo tcpdump -i NETWORK-INTERFACE dst host 176.56.237.171
... and then visiting some website in your web browser.

(where NETWORK-INTERFACE is your active network interface like eth0, p5p1, etc. - you can find it using "ifconfig" -, and "176.56.237.171" is the default resolver used by Pascal's packages - if you've used a different one, change it in the command above with yours!)

The command output should look like this:
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on p5p1, link-type EN10MB (Ethernet), capture size 262144 bytes
16:14:53.142488 IP ubuntu-desktop.local.57467 > resolver1.dnscrypt.eu.https: UDP, length 512
16:14:53.142514 IP ubuntu-desktop.local.57467 > resolver1.dnscrypt.eu.https: UDP, length 512
16:14:53.291372 IP ubuntu-desktop.local.57467 > resolver1.dnscrypt.eu.https: UDP, length 512
16:14:53.291450 IP ubuntu-desktop.local.57467 > resolver1.dnscrypt.eu.https: UDP, length 512
16:14:53.464624 IP ubuntu-desktop.local.57467 > resolver1.dnscrypt.eu.https: UDP, length 512
16:14:53.464641 IP ubuntu-desktop.local.57467 > resolver1.dnscrypt.eu.https: UDP, length 512
16:14:53.751950 IP ubuntu-desktop.local.57467 > resolver1.dnscrypt.eu.https: UDP, length 512
16:14:53.815789 IP ubuntu-desktop.local.57467 > resolver1.dnscrypt.eu.https: UDP, length 512

Tip: DNSCrypt can be used with Unbound or dnsmasq (I didn't test it though) - for this and other tips, see THIS ArchWiki entry.

For more information on DNSCrypt / dnscrypt-proxy, check out the following links:

seen @ desdelinux.net, thanks to Pascal Mons for the PPA!
Read more »
Posted by at No comments:
Labels: , , , ,

Tuesday, October 6, 2015

EncFS 1.8 RC1 Available For Download

EncFS is a FUSE-based cryptographic filesystem which encrypts individual files. As some of you might know, an EncFS security audit that was conducted in February 2014, revealed some potential vulnerabilities:

EncFS is probably safe as long as the adversary only gets one copy of the ciphertext and nothing more. EncFS is not safe if the adversary has the opportunity to see two or more snapshots of the ciphertext at different times. EncFS attempts to protect files from malicious modification, but there are serious problems with this feature.

And that's understandable since the last stable EncFS version was released back in December 2011. But that also means that the tool needs an update badly and a first step in this direction was made recently, with the release of EncFS 1.8 RC1.

The first EncFS 1.8 release candidate fixes two of the potential vulnerabilities mentioned in the security audit and brings a few other improvements:
  • improve automatic test converage: also test reverse mode (make test)
  • add per-file IVs based on the inode number to reverse mode to improve security
  • add automatic benchmark (make benchmark)
  • compare MAC in constant time
  • add --nocache option
  • lots of fixes to make building on OSX easier

Unfortunately, EncFS 1.8 RC1 doesn't fix all the potential vulnerabilities, but more should come with future release candidates - see the EncFS GitHub issues page for more information.

More information on EncFS:

The tool is especially useful to encrypt private files before syncing them with various cloud storage services such as Dropbox (without encrypting the whole cloud storage folder):

GNOME EncFS Manager

Note: EncFS doesn't come with a GUI, the tool in the screenshot above is called GNOME EncFS Manager.

Build EncFS 1.8 RC1 in Ubuntu or Linux Mint


As I said above, there are still some potential vulnerabilities so you may want to wait until all are fixed. But if you want to install the latest EncFS 1.8 RC1 anyway, here's how to build it under Ubuntu or Linux Mint.

1. Enable source code repositories:
  • in Ubuntu: enable "Source code" in Software & Updates (Ubuntu Software tab), then run "sudo apt-get update";
  • in Linux Mint: under Software Sources, check the box next to "Enable source code repositories" (Official Repositories tab), then run "sudo apt-get update".

2. Download the latest EncFS and extract it.

3. In the extracted EncFS directory, run the following commands to build EncFS:
sudo apt-get build-dep encfs
autoreconf -if
./configure --prefix=/usr --with-boost-libdir=/usr/lib/$(dpkg-architecture -qDEB_HOST_MULTIARCH)
make

4. Install EncFS 1.8 RC1

Now you can either install it directly or create a deb (using checkinstall) and install that, so it's easier to remove / upgrade.

To create an EncFS 1.8 deb and install it, use the following commands (in the EncFS 1.8 folder):
sudo apt-get install checkinstall
sudo checkinstall
And follow the steps. Important: when prompted, change the package name from "encfs-1.8" to just "encfs" and the version from "rc1" to "1.8~rc1".

Or, to install it directly, simply use (in the EncFS 1.8 folder):
sudo make install
Read more »
Posted by at No comments:
Labels: , , , ,
Subscribe to: Posts (Atom)