Nick Guenther wrote:

quoted text
> On 10/6/07, Timo Myyrd  wrote:

>

>> I'm just trying to encrypt my laptops /home partition to hide my

>> personal info if the worst happens and my lappy is stolen.

>>

>> I'm wondering what would be the best method to encrypt the hard drive? I

>> saw some discussion on the mailing list recently and somebody pointed

>> out that I could encrypt whole partition.

>>

>> I'm currently creating a image within a partition which I intend to

>> encrypt then as instructed for example here:

>> http://www.blackant.net/other/docs/howto-encrypted-home.php

>>

>> Which would be a better method, the separate image or encrypt whole

>> partition and how to encrypt whole partition on OpenBSD?

>>

>

> *The* way to make encrypted disks on OpenBSD is through vnconfig -k.

> Go read up on that and come back.

> Then here's what you can do (it's dead simple):

> # vnconfig -k  svnd0 /path/to/image

> # mount /dev/svnd0 /home

>

>  #note: the image file should be available somewhere that isn't /home,

> obviously... you may be able to have a /home with it on there and then

> mount over that and it might keep working but it's just asking for

> trouble to do it that way

>

>   

using the -K switch for vnconfig is good if you're worried about offline

brute forcing.
> are you sure you want to encrypt your *whole* drive though? Is your

quoted text
> data really that secret? For most people there are only a few /really

> secret/ things, and you can just make a small secure partition and

> place them in there. Encryption does take a performance hit.

>

>   

the performance hit is pretty unnoticeable unless you're doing lots of

reads and writes, e.g. a fileserver. on a decently fast machine you can

get 20-30 MBps read and write speed on an encrypted image which is

plenty for your /home in most cases.
> -Nick