Encryption is an essential security practice. While your file system may have encryption enabled, what about shared machines or extremely sensitive information?
Fear not, you can keep your secret Justin Bieber music collection in your closet with Tomb.
What Is a Tomb?
In the Linux sense of the word, a tomb is like a locked folder that can be safely stored within a file system. Another great feature is that the keys that unlock the tomb can be kept separately. For example, you may have your tomb on a shared computer, and your keys on a USB drive.
One of the best things about Tomb is that it sits on standard Linux technology. The underlying technology used by Tomb has been in Linux kernels since version 2.6, which means you’re using technology developed by arguably some of the best Linux developers.
Tomb claims their ambition is to provide military-grade security by way of:
- A minimalist design consisting of small and readable code.
- Facilitation of good practices, like physical separation of storage and keys.
- Adoption of a few standard and well-tested implementations.
Tombs are like single files whose contents are inaccessible in the absence of the key they were locked with and its password. Once open, the tombs are just like regular folders. Tombs can even be slammed close even when in use.
As mentioned, you must have the tomb, its key, and the password to access it. Files can be further obfuscated using obscurity to hide tombs, and embedding keys into JPEGs.
Interested? Here’s how to do it.
Installing Tomb and its dependencies is as easy as it gets. Just download the latest version, unzip the file, then use the make command.
The dependencies you need are:
You may already have these installed. If not, once you’ve downloaded all the dependencies using apt or whichever package manager your system uses type:
wget https://files.dyne.org/tomb/Tomb-2.5.tar.gz tar xvfz Tomb-2.5.tar.gz sudo make install
And that’s all there is to it. You’re ready to start creating and using Tomb!
Creating a Tomb
Tomb is one of those applications that has its commands themed around its name. For example, it has commands like dig, bury, and exhume. For a full list of Tomb’s commands check out its man page by typing:
To create your first tomb, you need to dig it! When your ready, type:
tomb dig -s 200 secrets.tomb
This command creates a 200MB tomb to store your unlucky selfie collection. Feel free to create whichever size suits you. A tomb can always be resized using the resize command. Bear in mind that you can always grow a tomb, but not shrink one.
Locking the Tomb
Now we have one part of our secure file, we need to create a key and lock the tomb. To create this, type:
tomb forge secrets.tomb.key
You may have noticed that this command didn’t execute and Tomb has issued a warning. The warning shows that you have a running swap file. This is a risk because contents of your RAM can be written to your swap file during this process, and if someone analyzes your swap file they could potentially pick out your key or password!
Tomb at this point recommends turning off your swap file when working with your tomb and turning swap back on again after you’re done. Tomb kindly provides you with the command to do so! To view any configured swap partitions type:
sudo swapon -s
You can turn your swap on and off by using the following commands:
sudo swapoff -a sudo swapon -a
If you aren’t bothered by your swap file you can force the creation of the key by typing:
tomb forge secrets.tomb.key -f
Depending on the speed of your PC the key generation may take a while. You can accelerate this by some random mouse movements. You will be prompted to enter and confirm a password for your key. Now to lock your tomb with the key you just created type:
tomb lock secrets.tomb -k secrets.tomb.key
Using a Tomb
To open and use your tomb type:
tomb open -k secrets.tomb.key secrets.tomb
At this point, you will be prompted to enter your password for the key. Once done, the tomb will be unlocked, and mounted like an external drive.
Tombs can also be used to store config files fo