You have a computer. You're afraid of it being stolen by baddies or
raided by the police, so you've encrypted its hard disk with LUKS.
You also want to carry around some of your crypto keys (SSH and/or
GPG), or any kind of sensitive data, on an USB key, so you can restore
a normal activity in case the computer gets stolen or becomes
untrustworthy. You like things that Just Work, including automounting
with
autofs (no GUI popups, no need to manually unmount and so on).
But of course, you can't very well just mount the drive and store your
keys on it in the clear. Well, actually you can (I did it for way too
long), but let's assume you want to do without. Because USB keys get
stolen or lost, too.
autofs just handles the mounting of the drives, not their unlocking,
and there's no hook in there specifically for LUKS. There is,
however, a more generic way of running arbitrary commands on mounting:
the program maps. It's all described in the documentation, so I'll
just paste the relevant parts of my
/etc/auto.removable, with a few
comments. Remember to make it executable and reference it in
/etc/auto.master.
#! /bin/sh
volume=$1
autoluks ()
dev=/dev/$1
cryptname=$ 1 _crypt
cryptdev=/dev/mapper/$cryptname
keyfile=/etc/private/$cryptname.key
options=$2
[ ! -e $dev ] && exit 0
if [ -b $cryptdev ] && ! cryptsetup status $cryptname grep -q device:.*$dev ; then
cryptsetup remove $cryptname logger
fi
cryptsetup --key-file $keyfile luksOpen $dev $cryptname logger
[ -b $cryptdev ] && echo $options :$cryptdev true
case "$volume" in
# LUKS-encrypted volumes
lacie-keys)
autoluks lacie-keys -fstype=ext4,ro,noatime,nodev,noexec,nosuid
;;
lacie-keys-rw)
autoluks lacie-keys -fstype=ext4
;;
lacie-backups)
autoluks lacie-backups -fstype=ext4
;;
# Non-encrypted volumes
cd)
echo -fstype=iso9660,ro,nodev,nosuid :/dev/cdrom
;;
floppy)
echo -fstype=auto,sync,nodev,nosuid :/dev/fd0
;;
esac
The astute reader will have noticed that the keys volume is
mounted either read-only or read-write with the same mechanism. This
volume contains SSH keys that I use quite regularly, that filesystem
is going to be mounted and unmounted very often. USB keys, and flash
memory in general, don't really like repeated writes. Fortunately,
the SSH keys are mostly read, and very rarely written to, so I can
afford to mount the partition read-only and save the write cycles for
when I generate new keys (the mere action of mounting a partition
read-write changes it, even if the files in it are never modified).
The backups volume is mostly accessed in write mode, and much less
frequently anyway, so there's no need for a distinction there.
This supposes that the partitions on the USB key appear as
/dev/lacie-keys and
/dev/lacie-backups. Due to the dynamic naming
of devices, you may like to use rules similar to the following in
/etc/udev/rules.d/local.
KERNEL=="sd[a-z]1", ATTRS idProduct =="1027", ATTRS idVendor =="059f", ATTRS manufacturer =="LaCie", ATTRS product =="LaCie iamaKey", SYMLINK+="lacie-keys"
KERNEL=="sd[a-z]2", ATTRS idProduct =="1027", ATTRS idVendor =="059f", ATTRS manufacturer =="LaCie", ATTRS product =="LaCie iamaKey", SYMLINK+="lacie-backups"
You'll also need to initialize LUKS on the partitions, save the key,
make the filesystems, and so on. If you're still with me, you
probably know what I'm talking about, then I don't need to explain
about that.
This setup works for me, but there's no guarantee and so on. Based
on a
tutorial
found on the Debian Administration website (great resource, by the
way).
Update: I'm told a large part of the script could be replaced with
pmount. If you like short scripts, you may want to investigate that
too.
Update 2: Josselin points out
a different solution using
Gnome,
udisks,
gnome-disk-utility and Nautilus. It's worth
checking out, for those who like to run all that and click around. I
can't test it right now (Gnome/Nautilus currently refuses to mount any
USB key, for some presumably transitional reason), but I have no
reason to believe it's inherently broken. I just don't like having to
do anything when I plug my key or before I unplug it, and I'm not
always running a graphical session with a desktop.
Today, I went through the status page
of Portuguese translations for debconf tempaltes and gently pushed
my friends from Portugal to do the final bits of work missing.
When those translation are sent to the BTS, I'll be able to kick my
maintainer friends to fix them and hopefully bring Portuguese to the
100% Grail.
Russian, French, Swedish and German teams are nearly
touching this Grail..
French should reach it when my NMU of qmail reaches unstable (5 days
left in DELAYED). Russian and Swedish should when Andrew Pollock
finishes fighting with isc-dhcp. German also needs fts, which I just
sent to DELAYED/7-day and mailgraph which I haven't worked on yet (but
the maintainer is).
Fear my anger if you happen to break this by uploading uncoordinated
new debconf templates!
A conffile is a configuration file managed by dpkg, I m sure you remember 
Steve Jobs is a name that comes up a lot when talking to businesspeople, especially in the technology industry. His ideas, his background, his companies, their products, and his personal style are intertwined in the folklore of tech. I have no idea whether most of it is fiction or not, and I write this with apologies to Mr. Jobs for using him as shorthand. I have never met him, and my point here has nothing to do with him personally.
What I want to discuss is the behavior of people who invoke the myth of Steve Jobs. In my (entirely subjective) experience, it seems to me that there is a pattern which comes up again and again: People seem to want to discuss and emulate the worst of his alleged qualities.
Jobs 
A month or so ago, I published 
Around three years ago I've migrated my stuff to Subversion from GNU Arch. Last year I migrated most important/alive things to Git. Unfortunately not all, so I still needed to host 
Just to give you an idea of how much I can procrastinate:
16 years after I first said I would start doing so, I have finally
bit the bullet, and started taking Tennis classes.
Of course my physical condition, after more than 10 years of not
doing any sport in a structured manner, is terrible; and as a result, my
muscles are complaining to me almost every day now. I'm sure that's
something which will diminish over time, as I shape up. At any rate, I'm
enjoying it, and it seems like I'm not doing too bad. We'll
see.
In slightly-related news, I finally stopped procrastinating on my
latest 
Lucas has written two long, insightful posts on the frustration about the social aspects of integrating Ruby stuff Debian 
Usually I like to monitor as much as possible. but unfortunately my cable provider does not allow to access the cable modem via SNMP, so I had to find a different way to retrieve at least some basic information. After a bit of googling I figured out how to access the web interface of the Scientific Atlanta modems. The model here is a EPC2203 - seems to work for various models, though.
These modems do not only provide access to the traffic within the cable network on their internal networking port (ever tried tcpdump on that?), but they also have their own IP (192.168.100.1). To be able to access the modem you should add something like
This is mostly inspired on