Template: partman/method_long/scubed3 Type: text Description: base device for scubed3 (hidden encrypted partitions) Template: partman/method_short/scubed3 Type: text Description: scubed3 Template: partman-scubed3/text/configure Type: text Description: Configure scubed3 (hidden encrypted partitions) Template: partman-scubed3/text/active Type: text Description: (scubed3 runs) Template: partman-scubed3/text/not_active Type: text Description: (not configured) Template: partman-scubed3/text/in_use Type: text Description: In use as the base device of scubed3 Template: partman-scubed3/text/disk_model Type: text Description: scubed3 partition %s (LUKS) Template: partman-scubed3/text/partition_description Type: text Description: the scubed3 partition "%s" Template: partman-scubed3/text/luks_description Type: text Description: the LUKS volume on the scubed3 partition "%s" Template: partman-scubed3/text/new_partition_description Type: text Description: the new scubed3 partition "%s". With a passphrase it can also be opened without the key store (its key is in the key store too). Leave both fields empty for a random key (256 bits): then only the key store opens it Template: partman-scubed3/text/new_luks_description Type: text Description: the LUKS volume on the scubed3 partition "%s". The passphrase is the one key of the volume (its keyslot), it opens it also without the key store; the key store keeps the volume key (512 bits, random). Leave both fields empty for no passphrase: then only the key store opens it Template: partman-scubed3/text/boot_passphrase Type: text Description: the key store, the boot passphrase (it is asked at boot, as for an encrypted disk; it gives the keys of root and of the partitions that are not hidden) Template: partman-scubed3/text/hidden_passphrase Type: text Description: the key store, a hidden passphrase (it gives the keys of hidden partitions; at boot, type it before the boot passphrase: it gets the message of a wrong passphrase) Template: partman-scubed3/text/no_partitions Type: text Description: none yet Template: partman-scubed3/confirm Type: boolean Default: false Description: Write the changes to disk and configure scubed3? Before scubed3 can be configured, the current partitioning scheme has to be written to disk. These changes cannot be undone. . After scubed3 has been configured, its base device cannot be changed anymore during this installation. . ${ITEMS} Template: partman-scubed3/confirm_nooverwrite Type: boolean Default: false Description: Write the changes to disk and configure scubed3? Before scubed3 can be configured, the current partitioning scheme has to be written to disk. These changes cannot be undone. . ${ITEMS} Template: partman-scubed3/confirm_nochanges Type: boolean Default: false Description: Keep the current partition layout and configure scubed3? After scubed3 has been configured, its base device cannot be changed anymore during this installation. Template: partman-scubed3/commit_failed Type: error Description: The partition table could not be written An error occurred while writing the changes to the disks. scubed3 is not configured. Template: partman-scubed3/no_math64 Type: error Description: The shell of the installer has no 64 bit arithmetic partman-scubed3 needs it to compute the sizes of the blocks. scubed3 cannot be configured with this installer. Template: partman-scubed3/no_base Type: error Description: No base device for scubed3 No partition is used as the base device of scubed3. Choose a partition (or make one in free space), and set "Use as:" to "base device for scubed3". Then choose "Configure scubed3" again. Template: partman-scubed3/too_many_bases Type: error Description: More than one base device for scubed3 The installed system can use only one base device of scubed3. Use only one partition as "base device for scubed3". Template: partman-scubed3/too_large Type: error Description: ${DEVICE} is too large for scubed3 scubed3 cannot use this partition as its base device. Use a smaller partition (at most some tens of terabytes). Template: partman-scubed3/options Type: string Description: Options of the scubed3 daemon: The sizes of the blocks are not stored on the base device: the same -m (mesoblock size) and -M (macroblock size) must be used forever. The default is chosen for the size of the base device. Change this only if you know what you are doing, for example to use an existing base device with the sizes it was made with. Template: partman-scubed3/store_type Type: select Choices-C: new, existing Choices: A new scubed3 store (the partition is filled with random data), An existing scubed3 store (keep the data on the partition) Default: new Description: What is on ${DEVICE}? scubed3 hides encrypted partitions in a device full of random data: without its passphrase a partition cannot be told apart from unused space. . A new store starts with random data on the whole partition. If the partition already holds scubed3 partitions, choose the existing store: you need its salt (in /etc/scubed3.conf of the system that made it) and the passphrases of ALL its partitions. Template: partman-scubed3/fill Type: boolean Default: true Description: Fill ${DEVICE} with random data? All data on ${DEVICE} will be overwritten with random data. This is the last opportunity to abort. . This can take long on a large partition. Without it, the old data on the partition shows which blocks scubed3 has written, and which not: do not skip it, unless the partition was filled with random data before. Template: partman-scubed3/progress/fill_title Type: text Description: Filling ${DEVICE} with random data Template: partman-scubed3/progress/fill_text Type: text Description: The installer is now overwriting ${DEVICE} with random data. Cancelling leaves the rest of the partition as it is. Template: partman-scubed3/progress/busy_title Type: text Description: Configuring scubed3 Template: partman-scubed3/progress/derive Type: text Description: Computing the key of the passphrase (this can take a minute, longer in a slow virtual machine)... Template: partman-scubed3/progress/open Type: text Description: Opening the partition: computing the key of its passphrase (this can take a minute, longer in a slow virtual machine)... Template: partman-scubed3/progress/luks_check Type: text Description: Checking the passphrase of the LUKS volume... Template: partman-scubed3/progress/luks Type: text Description: Setting up LUKS (this can take a minute)... Template: partman-scubed3/fill_failed Type: error Description: ${DEVICE} could not be filled with random data An error occurred while ${DEVICE} was filled with random data. scubed3 is not configured. . ${ERROR} Template: partman-scubed3/no_salt Type: error Description: No random salt The installer could not make a random salt for scubed3. Template: partman-scubed3/salt_note Type: note Description: The salt of the new scubed3 store The passphrases of the scubed3 partitions are turned into keys with this salt: . ${SALT} . It is not secret, but without it the partitions cannot be opened. It is stored in /etc/scubed3.conf of the installed system (and in its initramfs); also keep a copy elsewhere, on paper is fine. Template: partman-scubed3/salt Type: string Description: Salt of the existing scubed3 store: The salt is in /etc/scubed3.conf of the system that made the store (the line salt=...). Without the right salt no partition can be opened. Leave it empty for the default salt of scubed3 (if that system had no salt= line). Template: partman-scubed3/iterations Type: string Default: 16777216 Description: Number of iterations of the key derivation: The line iterations=... of /etc/scubed3.conf of the system that made the store; 16777216 is the default of scubed3. Template: partman-scubed3/start_failed Type: error Description: scubed3 could not be started The scubed3 daemon did not start on the base device. . ${ERROR} . scubed3 needs the kernel modules fuse and loop; if they are not loaded, load them in a shell (modprobe fuse; modprobe loop) and try again. Template: partman-scubed3/mainmenu Type: select Choices-C: create, open, layout, finish Choices: Create a partition, Open an existing partition, Show the layout, Finish Description: scubed3 configuration actions Open partitions: ${PARTITIONS} . The root file system goes on the partition "root", with LUKS on it (the LUKS volume is the disk you partition next): create it. The keys of the partitions are in a key store: at boot one passphrase is asked, as for an encrypted disk. . On an existing store, open ALL its partitions FIRST: blocks of a partition that is not open look unclaimed, a new partition can get them (and in paranoia level 2 and 3 scubed3 overwrites them). Create the partitions you want now, also hidden ones you will not install on. Template: partman-scubed3/layout Type: note Description: The layout of scubed3 ${LAYOUT} . Hidden partitions are only shown while their passphrase is unlocked; blocks of a partition that is not open are counted as unclaimed. Template: partman-scubed3/no_cryptsetup Type: error Description: cryptsetup or dm-crypt is missing The root file system goes on LUKS on a scubed3 partition, which needs cryptsetup and the kernel module dm-crypt. They could not be installed or loaded (anna-install cryptsetup-udeb crypto-dm-modules, modprobe dm-crypt, see /var/log/syslog). In a shell: anna-install partman-crypto-dm cryptsetup-udeb, depmod -a, modprobe dm-crypt; then choose "Configure scubed3" again. Template: partman-scubed3/name Type: string Description: Name of the scubed3 partition: The root file system goes on the partition "root". The name is used for the file of the partition, and for its LUKS volume (/dev/mapper/HOSTNAME-NAME); it is in the key store. Letters, digits, '.', '_' and '-' only. Template: partman-scubed3/bad_name Type: error Description: Invalid name A name has at most 30 characters: letters, digits, '.', '_' and '-'; it does not start with a '.'. Template: partman-scubed3/name_exists Type: error Description: "${NAME}" is already open A partition with this name is open already. Choose another name. Template: partman-scubed3/no_space Type: error Description: No unclaimed blocks All blocks of the base device belong to partitions. Template: partman-scubed3/size Type: string Description: Size of the scubed3 partition "${NAME}": The space for data, for example "20 GB" (at most ${MAX}; a quarter more is reserved for the garbage collector). Partitions can be enlarged and shrunk later with scubed3ctl, the file system on them must be resized with them. . Installing goes fastest when the partition you install on has most of the blocks of the base device. Do not make it larger than you need for that: at the end of the menu, the blocks that no partition claims are lent to it during the installation, and given back afterwards. Template: partman-scubed3/bad_size Type: error Description: Invalid size The size is not valid, or larger than the unclaimed space. Template: partman-scubed3/luks Type: boolean Default: true Description: Put LUKS on "${NAME}"? LUKS on the partition protects its data when someone takes the computer while it runs (in paranoia level 2 and 3 all partitions are open then). The installer can only install on a partition with LUKS on it: the LUKS volume is the disk you partition next. Its key is random, it is in the key store. Template: partman-scubed3/view Type: select Choices-C: boot, hidden Choices: the boot passphrase, a hidden passphrase Default: boot Description: Which passphrase of the key store gives the keys of "${NAME}"? The boot passphrase: the partition is opened at boot, with root; if it has LUKS, its LUKS volume too (a file system on it can be in /etc/fstab). Whoever has the boot passphrase sees it. . A hidden passphrase: the partition is hidden from whoever has only the boot passphrase. At boot, type the hidden passphrase first (you get the message of a wrong passphrase), then the boot passphrase: in paranoia level 2 and 3 all partitions must be opened at boot. Its LUKS volume is not opened (open it by hand: scubed3ctl, luksopen). Template: partman-scubed3/hidden_is_boot Type: error Description: This is the boot passphrase A hidden passphrase must be another passphrase than the boot passphrase. Template: partman-scubed3/wrong_passphrase Type: error Description: Not a passphrase of the key store This passphrase does not unlock a view of the key store. All passphrases of the key store are needed to change it. Template: partman-scubed3/passphrase Type: password Description: Passphrase: The passphrase of ${DESCRIPTION}. . Choose a passphrase that is hard to guess: with the disk and the passphrase anyone can open what it protects. Template: partman-scubed3/passphrase-again Type: password Description: Re-enter the passphrase to verify: Please enter the same passphrase again to verify that you have typed it correctly. Template: partman-scubed3/passphrase-mismatch Type: error Description: Passphrase input error The two passphrases you entered were not the same. Please try again. Template: partman-scubed3/backup_note Type: note Description: Make a backup of the key store and the configuration Without the key store and the configuration of scubed3 (the salt) the partitions cannot be opened, not even with the right passphrases: a damaged disk or a mistake loses everything. Keep a copy of both, NOT on this disk (a USB stick, another computer, a backup service: without the passphrases they show nothing, the key store is random data). . Now (a shell of the installer, Alt-F2) they are /var/lib/partman/scubed3/scubed3.keys and /var/lib/partman/scubed3/scubed3.conf; in the installed system /etc/scubed3.keys and /etc/scubed3.conf. Copy them again after every change of the key store (passphrases, partitions); write down the options of the daemon too (/etc/scubed3/initramfs.conf). Template: partman-scubed3/passphrase-empty Type: error Description: Empty passphrase You entered an empty passphrase, which is not allowed. Please choose a non-empty passphrase. Template: partman-scubed3/weak_passphrase Type: boolean Default: false Description: Use weak passphrase? You entered a passphrase that consists of less than eight characters, which is considered too weak. You should choose a stronger passphrase. Template: partman-scubed3/keystore_failed Type: error Description: The key store could not be created ${ERROR} Template: partman-scubed3/create_failed Type: error Description: The partition "${NAME}" could not be created ${ERROR} Template: partman-scubed3/no_blocks Type: error Description: No blocks found No blocks of "${NAME}" were found with this passphrase: the passphrase is wrong, or the salt is not the salt of this store (or the partition does not exist: scubed3 cannot tell the difference). Template: partman-scubed3/level Type: select Choices: 0, 1, 2, 3 Default: 2 Description: Paranoia level during the installation: Level 0: the writes of a partition go to its emptiest blocks: the fastest, but the order of the writes shows which blocks hold old data, and which blocks belong to which partition (to someone with two copies of the disk, or with the write log of a flash drive). . Level 1: the writes of a partition go to its own blocks (this shows which blocks belong to which partition, to someone with two copies of the disk, or with the write log of a flash drive). . Level 2: every write goes to a random block of the whole base device. ALL partitions on the base device must be open now: a partition that is not open is destroyed. . Level 3: as level 2, and the writes are done at random moments, also when nothing is written; a partition writes at most its share of the rate (800 KiB/s by default), installing takes long. . Level 2 is recommended for the installation. Template: partman-scubed3/boot_level Type: select Choices: 0, 1, 2, 3 Default: 2 Description: Paranoia level of the installed system: The initramfs of the installed system switches to this level after it has opened the partitions (the line paranoia= of /etc/scubed3.conf). In level 2 and 3 ALL partitions on the base device must be opened at boot: those of the boot passphrase, and those of the hidden passphrases (type them before the boot passphrase). Template: partman-scubed3/level_failed Type: error Description: The paranoia level could not be switched ${ERROR} Template: partman-scubed3/lend_failed Type: error Description: The blocks could not be lent to "${NAME}" ${ERROR} Template: partman-scubed3/no_root Type: error Description: No partition root with LUKS The root file system goes on the scubed3 partition "root", with LUKS on it (the initramfs of the installed system boots from it): create it, or open it (an existing partition can be opened with the name root). Template: partman-scubed3/luks_failed Type: error Description: LUKS could not be put on "${NAME}" ${ERROR} Template: partman-scubed3/luks_open_failed Type: error Description: The LUKS volume on "${NAME}" could not be opened The passphrase is wrong, or the LUKS header is damaged. Template: partman-scubed3/not_configured Type: error Description: scubed3 is not configured A partition is used as the base device of scubed3, but scubed3 has not been configured. Choose "Configure scubed3" in the main menu, or use the partition for something else. Template: partman-scubed3/others_need_root Type: error Description: Root is not on scubed3 ${MOUNTPOINTS} on scubed3 needs the root file system on scubed3 too: the installed system starts scubed3 at boot only for a root file system on it. Template: partman-scubed3/root_not_root Type: error Description: The root file system is not on the partition root The root file system on scubed3 must be on the partition "root" (its LUKS volume /dev/mapper/HOSTNAME-root): the initramfs of the installed system boots from it. Template: partman-scubed3/not_supported Type: error Description: Not supported on scubed3 A scubed3 partition can hold a file system, not "${METHOD}". Template: partman-scubed3/no_boot Type: error Description: /boot cannot be on scubed3 The kernel and the initramfs, which starts scubed3, are read from /boot: it must be a normal partition. Template: partman-scubed3/others_note Type: note Description: ${MOUNTPOINTS}: not hidden from the root partition These file systems are on scubed3 partitions of the boot passphrase too: their LUKS volumes are opened at boot, and they are mounted from /etc/fstab. . /etc/fstab is on the root file system: whoever has the boot passphrase sees that these partitions exist (the key store shows it anyway). Use them for data you can admit to; hidden partitions are never in /etc/fstab. Template: partman-scubed3/no_swap Type: error Description: No swap on scubed3 The kernel writes swap through the scubed3 daemon, which needs memory to do that. Do not put swap on a scubed3 partition; use swap on zram, or no swap. Template: partman-scubed3/root_needs_boot Type: error Description: No separate /boot partition The root file system is on scubed3, the kernel and the initramfs must be on a /boot partition that is not on scubed3. Create one (about 1 GB). Template: partman-scubed3/install_failed Type: error Description: scubed3 could not be set up in the installed system The step "${WHAT}" failed, see the installation log. The installed system may not boot from its scubed3 partition. Template: partman-scubed3/final_note Type: note Description: scubed3 is set up MAKE A BACKUP NOW of /etc/scubed3.conf (the salt: ${SALT}) and of the key store /etc/scubed3.keys (in the installed system; now they are in /target/etc), not on this disk, and write down the options of the daemon (${OPTIONS}): without them the partitions cannot be opened, not even with the right passphrases. Copy the key store again after every change. . At boot one passphrase is asked, as for an encrypted disk: the boot passphrase. With hidden partitions, type their passphrase first (you get the message of a wrong passphrase), then the boot passphrase: in paranoia level 2 and 3 ALL partitions must be opened at boot. . The blocks that were lent to root are given back: the garbage collector removes them while the system writes. "scubed3ctl p" shows "shrinking" until it is done. After that they can be used for other partitions.