Encrypting NAS Under RT-N66U With Entware-ng

[Lukasz Obara]

I have the Asus RT-N66U with Tomato v.132 installed, Entware-ng installed on a usb key, and I recently got the Vantec NST-400MX-S3R installed with 2x2TB harddrives mounted running in Raid 1 and connected to the second usb port. I wanted to know if it was worth encrypting the NAS under the RT-N66U using the crypsetup package available from the entware-ng repository, or if anybody has done so with a similar setup? Documentation is sparse and the only page I found discussing the proess is:

http://vip.asus.com/forum/view.aspx...)&id=20121022225145408&page=1&SLanguage=en-us

I also wanted to know what might be some of the drawbacks of this.

 

[sfx2000]

The drawback is how to decrypt the drive if things go awry...

 

[Lukasz Obara]

@sfx2000 do you care to elaborate? When you mean when things go awry are you referring to the router failing, a drive failing, a software issue...

 

[Nullity]

I think ryzhov_al made a post about setting up an encrypted file-system with AsusWRT. It should more or less be just like setting up an encrypted FS on any standard Linux device.

I think you can backup some important part of the file-system and be reasonanly safe from catastrophic data loss.

 

[sfx2000]

@sfx2000 do you care to elaborate? When you mean when things go awry are you referring to the router failing, a drive failing, a software issue...

Yep, all of the above - encryption of a file system isn't a bad thing, but it will definitely complicate any kind of recovery..

 

[DrPozo]

Don't forget to encrypt the swap partition too.
https://wiki.archlinux.org/index.php/Dm-crypt/Swap_encryption

 

[schnappi]

1) Install EncFS using Entware-ng

2) Create an encrypted EncFS folder

2) Put the following in "Run after mounting" within "USB Support":
modprobe fuse && echo "ENCFS-PASSWORD-HERE" | encfs -S --public /mnt/ENCFS-MOUNTED-FOLDER /mnt/ENCFS-ENCRYPTED-FOLDER

First time mounting will need to run the above command manually (if no restart). This will not provide full device encryption, but it will provide file based encryption within the limitations of EncFS (not perfect). EncFS password will be stored in router NVRAM. If not okay with this run the above command manually every time restart router.

CryFS (better+newer EncFS alternative) and cryptsetup (what is need for LUKS volume) are also available packages for Entware-ng mips devices, so theoretically either could be used in place of EncFS using slightly different commands. Never had luck with either on a Tomato device though. EncFS confirmed works in this setup.

 

[fourty6and2]

I had to look that NAS up as it seems the router shouldn’t be doing any of this. But it seems it has to in this case.

The QNAP I run handles all the encryption/etc on its own and is plugged into the router via Ethernet.