My retro box (Cindy) is finally up and running again. Three different operating systems (WinXP, Backtrack 3 and Ubuntu), with full-disk encryption on every partition except sda2, makes reinstalling everything rather more tedious than normal. is out, but at the time of this writing it was still in beta, so I didn't bother with it. I just wanted to fix Cindy ASAP.
Install WinXP as normal Install Backtrack 3 Download and burn the BT3 CD from here. Partition the hard disk and create one primary partition (about 500 MB will do), and one extended partition with three logical partitions within: "swap", "/root" and "/". The sizes of the "swap" and "/root" partitions are essencially up to you, but I believe "/" requires a minimum of 4 GB (I used 8 GB). Also remember to set off a few gigabytes of free space at the end of your disk. We'll later use it to make sda3. Boot from the BT3 CD and install cryptsetup: cd /usr/src wget http://cryptsetup.googlecode.com/files/cryptsetup-1.0.6.tar.bz2 tar -xvf cryptsetup-1.0.6.tar.bz2 cd cryptsetup-1.0.6 ./configure make make install ln -s /usr/sbin/cryptsetup /sbin/cryptsetup.static Make sure sda5 is formated as swap, and sda6 and sda7 are formated as ext3. Also remember to tell BT3 to actually use the swap partition: swapon /dev/sda5 Next we encrypt the home partition (in Backtrack this is "/root", not "/home"): cryptsetup --verbose --verify-passphrase luksFormat /dev/sda6 cryptsetup luksOpen /dev/sda6 home mkfs.ext3 /dev/mapper/home Now it is time to mount the partitions and install BT3: mkdir /mnt/backtrack mount /dev/sda7 /mnt/backtrack/ mkdir /mnt/backtrack/boot mount /dev/sda1 /mnt/backtrack/boot/ mkdir /mnt/backtrack/root mount /dev/mapper/home /mnt/backtrack/root/ cp --preserve -R -v /root/{*,.[a-zA-Z0-9]*} /mnt/backtrack/root/ cp --preserve -R -v /{bin,changes,dev,home,pentest,usr,msf3,etc,lib,opt,sbin,var} /mnt/backtrack cp /boot/vmlinuz /mnt/backtrack/boot/ cp /boot/vmlinuz /mnt/backtrack/ mkdir /mnt/backtrack/{mnt,proc,sys,tmp} mount --bind /dev/ /mnt/backtrack/dev/ mount -t proc proc /mnt/backtrack/proc/ Next we configure the new installation: chroot /mnt/backtrack/ /bin/bash echo "home /dev/sda6" > /etc/crypttab echo "/dev/sda1 /boot auto defaults 0 0" >> /etc/fstab echo "/dev/mapper/home /root auto defaults 0 0" >> /etc/fstab nano /etc/lilo.conf Alter lilo.conf so that it contains the following: lba32 boot = /dev/sda prompt timeout = 1200 change-rules reset vga=791 image = /boot/vmlinuz root = /dev/sda7 label = Backtrack3 read-only Reboot your box: lilo -v reboot Eject your Backtrack CD and select "Backtrack" from the boot menu. If you have done everything correctly, you will be prompted for a password. Once your newly installed BT3 has finished booting up, open a terminal and encrypt your swap: echo "swap /dev/sda5 none swap" >> /etc/crypttab echo "/dev/mapper/swap swap swap defaults 0 0" >> /etc/fstab Move the /pentest directory to your encrypted /root: mv /pentest/ /root/ ln -s /root/pentest/ /pentest reboot Install Ubuntu. Download and burn the alternate CD from here. Boot from the CD and choose "Manual" from the menu. Select /boot from the list. Hit enter at "use as" and select ext3. Set it to format the partition (!). Choose "/boot" as mount point. Done. Make a primary partition from the free space we set of earlier. Set "use as" to "physical volume for encryption". Done Select "Configure encrypted volumes", select yes to write changes to disk, and type a password when asked. Hit enter at the partition directly beneath "Encrypted volume (sda3_crypt)". Set "use as" to "physical volume for LVM". Done. Select "Configure the Logical Volume Manager" at the top and choose yes to write changes to disk. Select "Create volume group" and call it "lvm". Hit space to select sda3_crypt. Choose "Create logical volume", choose "lvm" and call it "swap". Size is up to you. Choose "Create logical volume" again, choose "lvm" and call it "swap". Size is (still) up to you. Done. The partitioner probably looks a bit confusing now. Find "LVM VG lvm, LV root" and select it. Choose "use as" and select "ext3". Mount point to "/". Done. Find "LVM VG lvm, LV swap". Choose "use as" and select "swap area". Done. Choose "Finish partitioning and write changes to disk" at the bottom. Ubuntu will now be installed. When it asks you where to install Grub, tell it /dev/sda to install it to the MBR and overwrite lilo. When the installation is finished, eject the CD and boot into Ubuntu. Next we have to move vmlinuz to sda2 so that we can boot Backtrack: mkdir /media/sda7 mount /dev/sda7 /media/sda7 mkdir /boot/BT3 mv /media/sda7/vmlinuz /boot/BT3 umount /media/sda7 rmdir /media/sda7 nano /boot/grub/menu.lst At the bottom of menu.lst add this: title Backtrack 3 root (hd0,1) kernel /BT3/vmlinuz root=/dev/sda7 Encrypt the Windows partition, copy the TrueCrypt boot loader and reinstall Grub: Simple enough. Install TrueCrypt, select System > Encrypt System Partition/Drive. Lie to TrueCrypt and tell it that you only have one OS installed. This means that it will write the TrueCrypt Boot Loader to the MBR, overwriting Grub. Relax... trust me :) Download and burn the desktop CD from here. Boot from the CD and choose "try ubuntu with no change to my system". Open a terminal. Copy the TrueCrypt Boot Loader to the /boot partition: mkdir /media/boot mount /dev/sda2 /media/boot ---> Note: I can't remember if the live CD auto-mounts the /boot partition or not, so this may not be necessary. dd if=/dev/sda of=/media/boot/truecrypt.mbr count=1 bs=512 dd if=/dev/sda of=/media/boot/truecrypt.backup count=8 32256 Next we reinstall Grub to the MBR: sudo grub root (hd0,1) setup (hd0) Finally we must alter menu.lst a bit, so that Grub can find the boot loader. Type "nano /media/boot/grub/menu.lst" and find the Windows XP stanza near the bottom. Change it to this: title Windows XP rootnoverify (hd0,0) makeactive chainloader (hd0,1)/truecrypt.mbr boot And you are done! Now all you have to do is give your encrypted, triple-boot box a cute name, like "Cindy". Everyone does this, though they never admit it in public.