I was wondering about the following method used to create a swap space in GNU+Linux: dd if=/dev/zero of=/root/swap.img bs=1024 count=1048576 chmod 600 /root/swap.img mkswap /root/swap.img swapon /root/swap.img if(window.hljsLoader && !document.currentScript.parentNode.hasAttribute('data-s9e-livepreview-onupdate')) { window.hljsLoader.highlightBlocks(document.currentScript.parentNode); } Notice the usage of /dev/zero . Wouldn't it be safer to use /dev/urandom instead? To prevent anyone from knowing how much data is stored on the swap.

Nope, all it does is to slow down the execution. Generating a swap file here is pretty fast anyway tho. That's what you get with modern and fancy NVMe SSD's. If you want a secure swap you should encrypt it. Something like this might work: dd if=/dev/urandom of=swapfile.crypt bs=1M count=64 loop=$(losetup -f) losetup ${loop} swapfile.crypt cryptsetup open --type plain --key-file /dev/urandom ${loop} swapfile mkswap /dev/mapper/swapfile swapon /dev/mapper/swapfile if(window.hljsLoader && !document.currentScript.parentNode.hasAttribute('data-s9e-livepreview-onupdate')) { window.hljsLoader.highlightBlocks(document.currentScript.parentNode); } Tho, this might not make any sense if the disk is already encrypted. It's also not that relevant on a cloud instance without encrypted disks. I suppose if you keep your data on a encrypted block storage device then you'd want to encrypt the swap too. Let me know if it works. 🙂

Secure swap in GNU+Linux

George_Hegland

I was wondering about the following method used to create a swap space in GNU+Linux:

dd if=/dev/zero of=/root/swap.img bs=1024 count=1048576
chmod 600 /root/swap.img
mkswap /root/swap.img
swapon /root/swap.img

Notice the usage of /dev/zero. Wouldn't it be safer to use /dev/urandom instead? To prevent anyone from knowing how much data is stored on the swap.

Kenneth_Crayton

Unless you encrypt your swap space it won't make any difference, because a attacker with physical access to your server would be able to read the content anyway. /dev/zero might be faster to read from. But security wise, there's no benefit in your approach.

Magnus_Lind

Nope, all it does is to slow down the execution. Generating a swap file here is pretty fast anyway tho. That's what you get with modern and fancy NVMe SSD's. If you want a secure swap you should encrypt it. Something like this might work:

dd if=/dev/urandom of=swapfile.crypt bs=1M count=64
loop=$(losetup -f)
losetup ${loop} swapfile.crypt
cryptsetup open --type plain --key-file /dev/urandom ${loop} swapfile
mkswap /dev/mapper/swapfile
swapon /dev/mapper/swapfile

Tho, this might not make any sense if the disk is already encrypted. It's also not that relevant on a cloud instance without encrypted disks. I suppose if you keep your data on a encrypted block storage device then you'd want to encrypt the swap too. Let me know if it works. 🙂

Megan_Wilson

Magnus_Lind So this will use a different encryption key on every boot or for every written file?

Magnus_Lind

Megan_Wilson Yes, temp and swap are literally wiped out on reboot anyway so it makes perfect sense to just generate a competently random key for every time the partition/file is mounted.