applications that has its commands themed around its name. For example, it has commands like dig, bury, and exhume. For a full list of Tomb’s commands check out its man page by typing:
To create your first tomb, you need to dig it! When your ready, type:
tomb dig -s 200 secrets.tomb
This command creates a 200MB tomb to store your unlucky selfie collection. Feel free to create whichever size suits you. A tomb can always be resized using the resize command. Bear in mind that you can always grow a tomb, but not shrink one.
Locking the Tomb
Now we have one part of our secure file, we need to create a key and lock the tomb. To create this, type:
tomb forge secrets.tomb.key
You may have noticed that this command didn’t execute and Tomb has issued a warning. The warning shows that you have a running swap file. This is a risk because contents of your RAM can be written to your swap file during this process, and if someone analyzes your swap file they could potentially pick out your key or password!
Tomb at this point recommends turning off your swap file when working with your tomb and turning swap back on again after you’re done. Tomb kindly provides you with the command to do so! To view any configured swap partitions type:
sudo swapon -s
You can turn your swap on and off by using the following commands:
sudo swapoff -a sudo swapon -a
If you aren’t bothered by your swap file you can force the creation of the key by typing:
tomb forge secrets.tomb.key -f
Depending on the speed of your PC the key generation may take a while. You can accelerate this by some random mouse movements. You will be prompted to enter and confirm a password for your key. Now to lock your tomb with the key you just created type:
tomb lock secrets.tomb -k secrets.tomb.key
Using a Tomb
To open and use your tomb type:
tomb open -k secrets.tomb.key secrets.tomb
At this point, you will be prompted to enter your password for the key. Once done, the tomb will be unlocked, and mounted like an external drive.
Tombs can also be used to store config files for some of your applications. You could first unlock your tomb and start an application that requires said config files. If someone tries to start that application without unlocking the tomb, the application will seem like it’s just unconfigured.
Once you’re done organizing your X Factor rehearsal videos inside your tomb, you can close it in one of two ways. Either using the close command or the slam command.
tomb close [<name of tomb> | all] tomb slam all
If you have more than one tomb open, you can either specify the name of the tomb to be closed or use all for closing all currently open tombs. The close command will fail if the tomb is in use by a running process.
If you’re in a hurry and need to close your tombs regardless of running processes you can use the slam command. This may result in unsaved data loss to files that are in use, so use with caution.
More Security Through Obscurity
One of the things to be aware of when using Tomb is that there isn’t any cleanup process. That means once you’re done with your tomb, you need to ensure the key is removed if it exists on the same machine.
Keeping a tomb and key on the same machine creates an element of risk. There are ways to be a little sneaky and hide keys in plain sight. Take this folder for example:
It contains some family pictures, all with sequential names. At first glance, nothing seems out of place. Anyone looking at these pictures would be none the wiser. Now, look at this picture in particular:
This picture has a lot more to it that meets the eye. Embedded inside this picture is a key used to unlock a tomb hidden using steganography. Impressive right? If you’re feeling like James Bond and would like to do this type:
sudo apt install steghide
To hide a key inside a JPEG type:
tomb bury -k secrets.tomb.key Picture-name.jpg
After entering the password for your key file, you can now delete the key file entirely. This means that there will no key file left in plain sight. Instead, it will actually be hidden inside a JPEG. To get the key back out run:
tomb