USB encryption
The Packet Squirrel supports optional encryption of USB storage devices for increased security.
The Packet Squirrel uses the Linux full-disk encryption system (luks); USB devices encrypted on the Packet Squirrel will typically only be readable on another Linux system (but a VM may be sufficient).
Preparing the drive
This should only be done once - this will permanently erase the contents of the USB drive you target!
These preparatory commands can be run either in a shell on the Packet Squirrel directly (via the web UI shell or via ssh) or on a Linux computer or Linux VM with USB passthrough.
Remember - only perform these setup instructions once per disk! Read on for how to script a payload which automatically mounts the disk!
Unmount the USB drive
If the USB drive has an existing formatted partition, it will be automatically mounted. To configure encryption, we need to first unmount this drive.
Prepare the partition for encryption
We'll assume the USB drive has one primary partition, the first one. If necessary you may need to repartition the USB drive using fdisk or a partition tool on a Linux computer.
This will add the encryption metadata to the partition. You will need to confirm that this will erase the device, and you will need to set a password. DO NOT FORGET THIS PASSWORD as your data will be unrecoverable without it!
For example:
Activate the partition
This opens the encrypted partition and creates the virtual encrypted disk.
You will be prompted to enter the password you created above. For example:
Format the virtual encrypted disk
Finally, we need to create a filesystem on the encrypted disk. We suggest using ext4: It is a fast, Linux-native filesystem. As there is no way to read the encrypted disk without a Linux system, using a Linux filesystem does not make it any more difficult.
For example:
Close the encrypted disk
This step is optional, but returns the encrypted disk to the closed state where we can then mount it as expected from a payload.
Enabling encrypted storage from a payload
To enable automatic mounting of encrypted storage in a payload, you'll need to add the cryptsetup commands to your payload script.
In the demonstration payloads, this requires you to place the encryption password in your payload script. For more complex payloads, you may be able to implement other mechanisms for retrieving the password, such as fetching it from a HTTPS server on boot.
Even with the password stored in the internal Packet Squirrel flash, the USB storage is still encrypted at rest, and the password can be erased via a factory reset or the SELFDESTRUCT payload command.
Example encrypted payload
This example payload unlocks the encrypted USB partition, waits for it to become available, and changes the LED:
Last updated