diff --git a/tomb/404.html b/tomb/404.html index 991d5fa..df3a5df 100644 --- a/tomb/404.html +++ b/tomb/404.html @@ -185,7 +185,26 @@ - tomb(1) - the Crypto Undertaker + Introduction + + + + + + + + + + + + + +
  • + + + + + Manpage diff --git a/tomb/index.html b/tomb/index.html index d120aeb..07616d5 100644 --- a/tomb/index.html +++ b/tomb/index.html @@ -6,19 +6,23 @@ + + + + - Tomb Manual + Tomb :: Folder Encryption on GNU/Linux - Tomb Manual @@ -65,7 +69,7 @@
    - + Skip to content @@ -100,7 +104,7 @@
    - tomb(1) - the Crypto Undertaker + Tomb :: Folder Encryption on GNU/Linux
    @@ -194,19 +198,146 @@ - + - tomb(1) - the Crypto Undertaker + Introduction + + + + +
    • + + + + + + + + +
  • + + + + + Manpage + + + +
    • @@ -228,8 +359,96 @@ - + + @@ -244,641 +463,170 @@ -

    tomb(1) - the Crypto Undertaker

    -

    tomb, Jun 25, 2023

    -
    .B .IP "tomb [options] command [arguments]"
    - -

    -

    Description

    -

    Tomb is an application to manage the creation and access of encrypted -storage files: it can be operated from commandline and it can -integrate with a user's graphical desktop.

    -

    Tomb generates encrypted storage files to be opened and closed using -their associated keys, which are also protected with a password chosen -by the user. To create, open and close tombs a user will need super -user rights to execute the tomb commandline utility.

    -

    A tomb is like a locked folder that can be safely transported and -hidden in a filesystem; it encourages users to keep their keys -separate from tombs, for instance keeping a tomb file on your computer -harddisk and its key file on a USB stick.

    -

    -

    Commands

    +

    +

    Tomb is a 100% free and open source tool that facilitates managing secret files in volumes protected by strong encryption.

    +

    Tomb's ambition is to improve safety by way of:

    -

    -

    Options

    - -

    -

    Dev Mode

    +

    How it works

    +

    We design Tomb's hidden file encryption to generate encrypted storage folders to be opened and closed using associated key files, which are also protected with a password chosen by the user.

    +

    A tomb is a file whose contents are kept secret and indistinguishable; it can be safely renamed, transported and hidden in filesystems; its keys should be kept separate, for instance, keeping the tomb file on your computer's hard disk and the key files on a USB stick. Once open, the tomb looks like a folder.

    +

    Tomb derives from scripts used in the dyne:bolic 100% Free GNU/Linux distribution and a shell script (Zsh) using standard filesystem tools (GNU) and the cryptographic API of the Linux kernel (dm-crypt and LUKS via cryptsetup). Tomb's status and error messages are translated into many human languages and have multiple graphical applications to operate.

    +

    awesome-shot

    +

    Get Started

    +

    Tomb works only on GNU/Linux systems and WSL2 starting with Windows11.

    +

    If you are already familiar with using the command line, download the tar.gz and jump to the installation instructions.

    +

    Tomb is also found in many distributions, so you can use your package manager to install it.

    +

    However, Tomb is a single script and is very easy to install manually. Using make install in our source distribution will copy it into /usr/local/bin along with its manpage (man tomb) and language translations.

    +

    Be in charge of your system, and may the source be with you!

    +

    tomb_songs

    +

    Usage

    +

    Tombs are operated from a terminal command line and require root access to the machine (or just sudo access to the script).

    +

    To create a 100MB tomb called "secret" do:

    +
    tomb dig -s 100 secret.tomb
+tomb forge secret.tomb.key
+tomb lock secret.tomb -k secret.tomb.key
+
    +

    To open it, do +

    tomb open secret.tomb -k secret.tomb.key
+
    +And to close it +
    tomb close
+
    +Or if you are in a hurry +
    tomb slam all
+
    +Will close immediately all open tombs, killing all applications using them.

    +

    Here is a lovely review made by the Linux Action Show guys in August 2014, where they recommend Tomb as a replacement for Veracrypt

    +

    + +

    +

    Advanced usage

    +

    The tomb script takes care of several details to improve a user’s +behaviour and the security of tombs in everyday usage: it protects the +typing of passwords from keyloggers, facilitates hiding keys inside +images, mounts directories in place without copying delicate files around, allows a user to kill all running processes and slam close a tomb in a straightforward command, warns the user about free space and last-time usage, etc.

    +

    Tomb logo by monmort

    +

    One can use multiple tombs simultaneously on the same system and list them using tomb list.

    +

    Tomb logo by monmort

    +

    Using tomb resize, one can expand tombs to have more space (but cannot shrink them).

    +

    Tomb logo by monmort

    +

    When it is open, a tomb can bind contents inside the user’s $HOME folder using bind-hooks. For instance, .gnupg will only be found inside your $HOME when the tomb opens.

    +

    Tomb logo by monmort

    +

    A tomb can be used on a local machine with keys on a server and never stored on the same device: ssh me@dyne.org 'cat my.tomb.key' | tomb open my.tomb -k - the option -k - tells tomb to take the key from stdin.

    +

    Tomb logo by monmort

    +

    It is also possible to store a tomb on a cloud service and mount it locally, ensuring remote servers cannot access contents. One can use sshfs for this:

    +
    sshfs -o allow_root me@dyne.org:/ /mnt/cloud/
+tomb open /mnt/cloud/my.tomb -k my.key
+
    +

    This paper provides a lot of details about using tombs hosted on cloud storage.

    +

    Tomb logo by monmort

    +

    Tomb also supports deniable key storage using steganography. One can tomb bury and tomb exhume keys to and from JPEG images when the utility steghide is installed. When securing private data, one must never forget where the keys are. It may be easier to remember a picture, as well it may be less suspicious to transport it and exchange it as a file.

    +

    Tomb logo by monmort

    +

    The command tomb engrave also allows to backup keys on paper by saving them as printable QR codes, to hide it between the pages of a book. To recover an engraved key, one can scan it with any phone and save the resulting plain text file as the tomb key.

    +

    + +

    +

    You can also watch this other video guide by Nerd on the Street.

    +

    External applications

    +

    The following applications are compatible with Tomb:

    -

    -

    Hooks

    -

    Hooks are special files that can be placed inside the tomb and trigger -actions when it is opened and closed; there are two kinds of such -files: bind-hooks and exec-hooks can be placed in the -base root of the tomb.

    - -
    
-    mail          mail
-    .gnupg        .gnupg
-    .fmrc         .fetchmailrc
-    .mozilla      .mozilla
-
-
    - -

    -

    Privilege Escalation

    -

    The tomb commandline tool needs to acquire super user rights to -execute most of its operations: so it uses sudo(8) or other configured -tools, while pinentry(1) is adopted to collect passwords from the -user. Tomb executes as super user only when required.

    -

    To be made available on multi user systems, the superuser execution of -the tomb script can be authorized for users without jeopardizing the -whole system's security: just add such a line to /etc/sudoers:

    -
    
-    username ALL=NOPASSWD: /usr/local/bin/tomb
-
-
    -

    To avoid that tomb execution is logged by syslog also add:

    -
    
-    Cmnd_Alias TOMB = /usr/local/bin/tomb
-    Defaults!TOMB !syslog
-
-
    -

    -

    Password Input

    -

    Password input is handled by the pinentry program: it can be text -based or graphical and is usually configured with a symlink. When -using Tomb in X11 it is better to use a graphical pinentry-gtk2 or -pinentry-qt because it helps preventing keylogging by other X -clients. When using it from a remote ssh connection it might be -necessary to force use of pinentry-curses for instance by unsetting -the DISPLAY environment var.

    -

    -

    Swap

    -

    On execution of certain commands Tomb will complain about swap memory -on disk when present and abort if your system has swap -activated. You can disable this behaviour using the ---force. Before doing that, however, you may be interested in -knowing the risks of doing so:

    - -

    If you don't need swap, execute _ swapoff -a_. If you really need -it, you could make an encrypted swap partition. Tomb doesn't detect if -your swap is encrypted, and will complain anyway.

    -

    -

    Deniability

    -

    The possibility to have an encrypted volume which is invisible and -cannot be detected is called "deniability". The cryptographic layer of -the device mapper in Linux (dm-crypt) does not implement -deniability. Tomb is just a wrapper on top of that and it doesn't add -cryptographic deniability. However a certain way of using tomb can -facilitate a weak sort of deniability outside of the scenario of -seized devices and forensic analysis of files and blocks on disc.

    -

    For instance to eliminate any trace of tomb usage from the shell -history ZSh users can activate the "HISTIGNORESPACE" feature and -prefix all invocations of tomb with a blank space, including two lines -in ".zshrc":

    -
    
-    export HISTIGNORESPACE=1
-    alias tomb=' tomb'
-
-
    -

    -

    Password Input

    -

    Tomb uses the external program "pinentry" to let users type the key password -into a terminal or a graphical window. This program works in conjunction with -"gpg-agent", a daemon running in background to facilitate secret key -management with gpg. It is recommended one runs "gpg-agent" launching it from -the X session initialization ("~/.xsession" or "~/.xinitrc" files) with this -command:

    -
    
-    eval $(gpg-agent --daemon --write-env-file "${HOME}/.gpg-agent-info")
-
-
    -

    In the future it may become mandatory to run gpg-agent when using tomb.

    -

    -

    Share a Tomb

    -

    A tomb key can be encrypted with more than one recipient. Therefore, a -tomb can be shared between different users. The recipients are given -using the -r (or/and -R) option and if multiple each GPG -key ID must be separated by a comma (,). Sharing a tomb is a -very sensitive action and the user needs to trust that all the GPG -public keys used are kept safe. If one of them its stolen or lost, it -will be always possible to use it to access the tomb key unless all -its copies are destroyed. The -r option can be used in the tomb -commands: open, forge setkey, passwd, -bury, exhume and resize.

    -

    -

    Sphinx (Pake)

    -

    Using the package libsphinx - -and its python client/daemon implementation pwdsphinx - -is possible to store and retrieve safely the password that locks the -tomb. Using this feature will make it impossible to retrieve the -password without the oracle sphinx server running and reachable. Each -key entry needs a username and a domain specified on creation and -a password that locks it.

    -

    SPHINX makes it impossible to maliciously retrieve the password -locking the tomb key without an attacker accessing both the -server, the sphinx password and the tomb key file.

    -

    -

    Examples

    - -
    
-    tomb dig -s 128 secret.tomb
-
-    tomb forge secret.tomb.key
-
-    tomb lock secret.tomb -k secret.tomb.key
-
-    tomb open secret.tomb -k secret.tomb.key
-
-
    - -
    
-    ssh user@my.shell.net 'cat .secrets/tomb.key' | tomb open secret.tomb -k -
-
-
    - -
    
-    gpg -d .secrets/tomb.key | ssh server tomb open secret.tomb -k cleartext --unsafe
-
-
    +

    How secure is Tomb?

    +

    Death is the only sure thing in life. That said, Tomb is a pretty +secure tool mainly because it is kept minimal, its source is +always open to review (even when installed), and its code is easy to +read with some shell script knowledge. Plus, no cloud or network connection is needed: Tomb works offline.

    +

    GNU/Linux distributions include all encryption tools we use in Tomb +and therefore, they are regularly peer-reviewed: we don't add anything else to them, just a layer of usability.

    +

    If needed, it is always possible to access the contents of a tomb without the tomb script, only using a few commands typed into any shell interpreter:

    +
    lo=$(losetup -f)
+losetup -f secret.tomb
+gpg -d secret.key | head -c -1 | cryptsetup --key-file - luksOpen $lo secret
+mount /dev/mapper/secret /mnt
+
    +

    One can change the last argument /mnt to where the Tomb has to be +mounted and made accessible. To close the tomb, use:

    +
    umount /mnt
+cryptsetup luksClose /dev/mapper/secret
+
    +

    Who needs Tomb

    +
    +

    Democracy requires privacy as much as Freedom of Expression. - Anonymous

    +
    +

    The world is full of prevarication and political imprisonments, war rages in several places, and media is mainly used for propaganda by the powers in charge. Some of us face the dangers of being tracked by oppressors opposing our self-definition, independent thinking and resistance to homologation.

    +

    Our target community are GNU/Linux users with no time to click around, sometimes using old or borrowed computers, operating in places endangered by conflict where a leak of personal data can be a threat.

    +

    Even if one can't own a laptop, Tomb makes it possible to go around with a USB stick and borrow computers, leaving no trace and keeping data safe during transport.

    +
    +

    The distinction between public and private is becoming increasingly blurred with the increasing intrusiveness of the media and advances in electronic technology. While this distinction is always the outcome of continuous cultural negotiation, it continues to be critical, for where nothing is private, democracy becomes impossible.

    +
    +

    The Internet offers plenty of free services; in most cases, corporate or state monopolies host all private information. Server-hosted services and web-integrated technologies gather all data into huge information pools made available to established economic and cultural regimes.

    +

    Tomb is ethical software that empowers everyone to protect their privacy.

    +

    +

    Aren't there enough encryption tools?

    +

    The current situation in personal desktop encryption is far from optimal.

    +

    The encrypted home mechanism of most operating systems doesn’t make it easy to transport around, and they do not separate the keys from the storage: only the password is needed to open them, which is prone to brute-forcing attacks.

    +

    TrueCrypt makes use of statically linked libraries so that its code is hard to audit, plus is not considered free by operating system distributors because of liability reasons, see Debian, Ubuntu, Suse, Gentoo and Fedora.

    +

    Veracrypt is a very portable rewrite of TrueCrypt (works also on Mac OSX) but is very slow and has some interaction patterns that are not secure. Its way of encrypting is comparable to Tomb.

    +

    EncFS doesn’t need root access. But it has drawbacks: it implements weaker encryption, doesn't promote the separated storage of keys and exposes the size of each single file rather than hiding the structure of a folder.

    +

    + +

    +

    Watch Tomb's development history in this infographic based on git commits.

    +

    Compliancy

    +

    Tomb qualifies as sound for use on information rated as "top secret" +when used on an underlying stack of carefully reviewed hardware +(random number generator and other components) and software (Linux +kernel build, crypto modules, device manager, compiler used to built, +shell interpreter and packaged dependencies).

    +

    Tomb volumes are fully compliant with the FIPS 197 advanced encryption +standard published by NIST and with the following industry standards: