Setting up a multi-boot system with encrypted Ubuntu 10.04 + encrypted Windows 7 + Windows XP (not encrypted)

This document is intended to serve as my own list of things to remember the next time I need to set up a similar system. However I think it might be useful for others as well.

Initial requirements

My original intention was to fulfill the requirements below:

Software

Initial plan

My plan was to achieve this by the steps described below.

  1. Install Windows XP as usual.

  2. Install Windows 7 as usual.

  3. Installing Ubuntu, using the alternate installer CD (to be able to configure encryption from start). How?

  4. Install TrueCrypt in Windows 7 and encrypt the Windows 7 partition.

  5. Boot Ubuntu from the regular installation CD. (The Ubuntu system can not be booted because TrueCrypt boot-loader overwrites the MBR.)

  6. Backup the MBR (Master Boot Record) created by TrueCrypt. How?

  7. Restore GRUB. (Linux boot loader.) How?

  8. Add the TrueCrypt boot loader as an alternative in Linux boot menu to be able to boot windows. How?

  9. Add Windows XP as an alternative in the Linux boot menu. (So there will be no need to go through the TrueCrypt boot menu to boot Windows XP.)

  10. Install TrueCrypt in Ubuntu and test that I can access the Windows 7 partition. (Normally I will have no need to access that from Ubuntu, but it might be useful under certain circumstances.)

  11. Install Ext2IFS in Windows XP and 7 to be able to access ext3 partitions. (Ext4 is not supported.)

  12. Install FreeOTFE in Windows XP and 7 to be able to access the encrypted Linux partitions.

  13. Automatically mount the encrypted Linux partitions in Windows 7. (Since I don't want to have to enter the password again I plan to store it in clear-text in a script. This is of course a major security risk, but since it requires that the user is already logged in to the encrypted Windows 7 system I consider this acceptable in my case.)

There are a lot of things that might go wrong here, so I will use VirtualBox to test it in a virtual machine. (Note that TrueCrypt requires that an rescue cd iso file is burned during installation. This is not possible in the virtual machine because there is no CD writer. Instead use Daemon Tools Lite to mount the image, or copy it to to host and mount it in VirtualBox.)

Someone might wonder why I mess around with this at all instead of just using one operating system and run the other in a virtual machine. The answer is that I use Ubuntu for daily use. Then I need a real XP installation because it is not possible to set the screen resolution and aspect correctly for some of the child games in VirtualBox. About Windows 7 I will normally use a Virtual machine, but sometimes performance might not be good enough.

Also remember to disable automatic activation of Windows until everything works as it should.

Problems, problems, problems...

When testing this in the virtual machine I found a number of issues and had to change some plans.

Boot loader

It seems there is a major problem with this. In earlier versions of GRUB it was fairly easy to backup the MBR created by TrueCrypt and boot it using chain-loading. But Ubuntu 10.04 uses GRUB2 and apparently both GRUB2 and the TrueCrypt boot loader uses additional sectors after the MBR sector.

Due to that I have found no way to use them together.

I have considered the following options to get around this:

I also found a problem that XP can not be booted directly from GRUB without going through Windows 7 boot loader. This is probably because Windows 7 put its boot files on the Windows XP partition. It can probably be avoided by modifying the partition table so that the Windows XP partition is hidden before installing Windows 7, but I have not investigated that further.

Access to encrypted data

There are also some issues regarding the encrypted data access when using the encrypted volumes.

Because of these issues and the problem with FreeOTFE and 64-bit Windows (described further down) I will have to create the shared partitions using TrueCrypt instead.

File system

Although Ext2IFS works fine to mount ext3 (not ext4, but ext3 is OK with me) file systems with read and write permissions it seems it can only be used for regular partitions, not the encrypted partitions mounted through FreeOTFE or TrueCrypt. I have not found another good ext-driver for Windows either.

There is also a problem to install Ext2IFS in Windows 7. It seems that running the installation program in Windows Vista compatibility mode can be used as a workaround.

This means I will have to use NTFS instead of Ext3 for partitions that should be used in both Linux and Windows. An additional problem with that is that file flags and access rights in Linux can not be maintained. So it is not a good idea to mount it at “/home”, instead I will mount it at either “/home/myuserid” or “home/myuserid/documents”. (In the last case I will need to make some application setting folders like /home/myuserid/.mozilla soft links pointing to a directory in the shared partition if I want to use it in Windows 7 as well.)

64-bit Windows

There is a problem to install FreeOTFE in 64-bit Windows 7 because the drivers are not signed. More information.

On 64-bit Windows XP I was not able to mount any partitions in FreeOTFE because it complains about missing drivers. (Not a problem since I will not use 64-bit Windows XP in the final installation, but I used it in one of the tests.)

VirtualBox

When I finally had managed to set up the boot loader so that it should be able to boot all three systems I got a very annoying problem when booting any of the Windows systems. They seems to start to boot OK, but then VirtualBox halts the virtual machine and tells me there is a critical error.

This happens also for an unencrypted dual-boot installation with Windows XP and Ubuntu, so it seems very likely that this is a problem with VirtualBox.

(I was able to to perform my other tests with some backup/restoration of the boot records, but that's far to much work to do every time I want to switch OS.)

The new plan

Due to the problems I had to revise my plans. Now it looks like this instead:

  1. Disable the primary disk in BIOS. (Temporarily remove it in the virtual machine.) This is to make Windows 7 believe that it is installed on the primary disk.

  2. Install Windows 7 as usual

  3. Install TrueCrypt in Windows 7 and encrypt the system.

  4. Enable the primary disk.

  5. Install Windows XP as usual

  6. Installing Ubuntu, using the alternate installer CD (to be able to configure encryption from start).

  7. Configure an entry for Windows 7 in the GRUB boot menu. (There will already be an entry for this, but it will not work because the disk Windows was installed to is now the secondary disk. The entry for Windows XP should work without any further actions.) How?

  8. Make sure all three systems can be booted.

  9. Boot Windows 7. Create and encrypt the partitions that should be used in both Linux and Windows. Configure TrueCrypt to mount them automatically every time Windows is started.

  10. Boot Ubuntu. Add a script that automatically mounts the shared encrypted partitions every time Linux is started.

Disk configuration:

Some useful how-to-do-stuff

Using unsigned drivers in 64-bit Windows 7

There are several ways around this, but none of them seems very good. The method I selected is the following:

Open a command prompt with administrative rights and type “bcdedit.exe /set TESTSIGNING ON”. Then reboot. Now the sign check has been turned of permanently. (Unfortunately it can not be done for specified drivers only.)

What also happens is that there will be an ugly permanent warning message shown on the desktop background. On my system it says:

TestMode
Windows 7
Build 7600

This text comes from user32.dll.mui (several copies of this file exists on the system). There exists a crack to get rid of the message, but I prefer not to use that. (I have opened the file in a hex editor to see if I could get rid of the message, but it does not seem to be a matter of simply replacing strings.)

Restore TrueCrypt boot loader

Restore Windows XP boot loader

Restore Windows 7 boot loader

Setting up encrypted volumes during Ubuntu installation

Encrypt existing partitions in Ubuntu

To encrypt the partition /dev/sdb3, give the command:

sudo cryptsetup luksFormat -c "aes-cbc-essiv:sha256" /dev/sdb3

Then follow the instructions. Any existing data will be lost. Make sure the partition is not mounted.

The encryption parameters above is selected so that it should be possible to mount the encrypted partition in Windows with FreeOTFE.

Add Windows 7 to GRUB2 bootloader

The boot alternatives for GRUB2 are stored in /etc/grub.d/grub.cfg. However that file is generated automatically every time it needs to be updated, so it is a bad idea to edit it directly.

Instead the entry for Windows 7 can be added in /etc/grub.d/40_custom by the following lines:

menuentry "Windows 7 (TrueCrypt)" {
   insmod chain
   set root=(hd1)
   devicemap -s hd0 hd1
   chainloader +1
}

The important stuff here is the devicemap-entry that will swap the disks so that Windows 7 will think that the secondary disk (where it is installed) is the primary disk.

(It is not needed to add it to 40_custom, this is a sample file for adding manual entries. It is possible to create a new file in the same directory and add the entry there. The numbers in the beginning of the file name defines the order the entries will be shown in. Don't forget to flag it as executable.)

When the file has been updated and saved then run:

sudo update-grub

Reboot and test that the new entry works as expected.

Mount TrueCrypt encrypted Windows system partition in Linux

TrueCrypt encrypted partitions can easily be mounted from the command prompt.

The following command will attempt to mount the Windows system encrypted partition /dev/sda1 in /cryptmount using the password “mysecretpassword”:

truecrypt --mount-options=system --fs-options=uid=myuser,gid=myuser,umask=0007,utf8 --password=mysecretpassword /dev/sda1 /cryptmount

(The arguments given to fs-options are simply forwarded to the Linux mount command.)

To unmount from the command prompt use:

sudo truecrypt --dismount /dev/sda1

To automate mounting I have created the file /etc/init.d/tcmount with the following content:

#! /bin/sh
### BEGIN INIT INFO
# Provides: -
# Required-Start: -
# Required-Stop:
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: -
# Description: -
### END INIT INFO

mount() {
   truecrypt --keyfiles="" --protect-hidden=no --fs-options=uid=myuser,gid=myuser,umask=0007,utf8 --password=mysecretpassword /dev/sda4 /cryptmount
}

umount() {
   truecrypt --dismount /dev/sda4
}

case "$1" in
   start)
      mount
      ;;
   stop)
      umount
      ;;
   restart|force-reload)
      umount
      mount
      ;;
   *)
      echo "Bad luck..." >&2
      exit 3
      ;;
esac

:

I had to add the "--keyfiles" and "--protect-hidden" switches to get this working. I don't know why, because they are not needed when mounting/unmounting directly from a shell prompt. I also had the problem that "uid" and "gid" did not work, root always become the owner. This seems to have something to do with the NTFS filesystem created with TrueCrypt 7 on Windows XP. A normal reformatting in Windows solved the problem. If someone knows more, please send me a mail.

To make the script run automatically run:

update-rc.d tcmount defaults

Make sure to flag as executable. (Also set the owner to root and remove read access to the file to prevent anyone from read the clear-text password. Of course the script needs to be located on an encrypted partition, otherwise this will make a nice entry into the system for anyone that steals your computer.)

Backup & restore MBR in Linux

Backup MBR of sda:

sudo dd if=/dev/sda of=/somedir/backup.mbr count=1 bs=512

This will backup the 512 byte MBR. (Note that some boot loaders uses additional sectors.)

Restore is performed the same way, just specify /somedir/backup.mbr as input file and /dev/sda as output file instead.

Restore GRUB2 boot loader