text:
Principal Proposed Uses
Several forms of estrogen occur naturally in a woman's body. The ovary produces a form named estradiol, which is converted into another important estrogen called estrone. Estriol is yet another form of estrogen metabolized from estradiol, weaker than the other two, but still active.
The estrogen tablets prescribed for menopausal symptoms usually contain estradiol, estrone, or a combination of the two. Some alternative medicine physicians have popularized the use of estriol as an alternative, and there is no doubt that estriol is also effective for symptoms of menopause. However, despite claims that it is safer than other forms of estrogen, the balance of evidence suggests that, in fact, estriol presents precisely the same risks (see Safety Issues below).
Estriol is manufactured in the body from estrone, estradiol, and androstenedione . When taken as a drug, it is manufactured synthetically, or extracted from animal products.
Therapeutic Dosages
The usual dose of estriol is 2 to 8 mg taken once daily. Estriol is also commonly sold in combination with other forms of estrogen.
Therapeutic Uses
Like more common forms of estrogen, estriol is used for the treatment of menopausal symptoms . Double-blind, placebo-controlled studies and other controlled trials have found oral or vaginal estriol effective for symptoms of menopause, including hot flashes, night sweats, insomnia, vaginal dryness, and recurrent urinary tract infections. Estriol may also help prevent osteoporosis . 1-9
Estriol might cause less vaginal bleeding as a side effect than other forms of estrogen, although this has not been definitively established. 10,11
Some alternative practitioners claim that estriol actually fights cancer, as opposed to estrogen, which increases risk of some cancers. However, this claim is based on exaggerated interpretations of very weak studies. 12,13,14 It is more likely that estriol increases cancer risk in much the same way as other forms of estrogen (see Safety Issues, below).
Safety Issues
Like other forms of estrogen, oral estriol stimulates the growth of uterine tissue. This leads to risk of uterine cancer. In a placebo-controlled study of 1,110 women, uterine tissue stimulation was seen among women given estriol orally (1 to 2 mg daily) as compared to those given placebo. 15 Another large study found that oral estriol increased the risk of uterine cancer. 16 In a third study of 48 women, estriol (1 mg twice daily) caused uterine tissue stimulation. 17 In contrast, a 12-month double-blind trial of oral estriol (2 mg daily) in 68 Japanese women found no effect on the uterus. 18 It may be that the high levels of soy in the Japanese diet altered the results.
To protect the uterus, estriol—like other forms of estrogen—needs to be balanced with progesterone. Additionally, one study suggests that estriol is less likely to affect the uterus when taken in a once-daily dose rather than in multiple daily doses. 19
However, the uterus isn't the only organ at risk of cancer. Test tube studies suggest that estriol is just as likely to cause breast cancer as any other form of estrogen. 20 While this preliminary evidence doesn't constitute proof, it does raise alarm bells. Until proven otherwise, estriol must be regarded as increasing breast cancer risk.
As with other forms of estrogen, vaginal estriol preparations are safer than oral preparations. 21,22
Revision Information
- Reviewer: EBSCO CAM Review Board
- Review Date: 12/2015 -
- Update Date: 12/15/2015 -


text: Tuesday, May 10, 2011 New in the Literature: Weight Loss, Exercise, and Obesity (N Engl J Med. 2011 Mar 31;364:1218-29) Findings published in the March 31 issue of NEJM suggests that a combination of weight loss and exercise provides greater improvement in physical function than either intervention alone in older adults who are obese. In this 1-year, randomized controlled trial, researchers evaluated the independent and combined effects of weight loss and exercise in 107 adults who were 65 years of age or older and obese. Participants were randomly assigned to a control group, a weight-management (diet) group, an exercise group, or a weight-management-plus-exercise (diet-exercise) group. The primary outcome was the change in score on the modified Physical Performance Test. Secondary outcomes included other measures of frailty, body composition, bone mineral density, specific physical functions, and quality of life. A total of 93 participants (87%) completed the study. In the intention-to-treat analysis, the score on the Physical Performance Test, in which higher scores indicate better physical status, increased more in the diet-exercise group than in the diet group or the exercise group (increases from baseline of 21% vs 12% and 15%, respectively); the scores in all 3 of those groups increased more than the scores in the control group (in which the score increased by 1%). Moreover, the peak oxygen consumption improved more in the diet-exercise group than in the diet group or the exercise group (increases of 17% vs 10% and 8%, respectively); the score on the Functional Status Questionnaire, in which higher scores indicate better physical function, increased more in the diet-exercise group than in the diet group (increase of 10% vs 4%). Body weight decreased by 10% in the diet group and by 9% in the diet-exercise group, but did not decrease in the exercise group or the control group. Lean body mass and bone mineral density at the hip decreased less in the diet-exercise group than in the diet group (reductions of 3% and 1%, respectively, in the diet-exercise group vs reductions of 5% and 3%, respectively, in the diet group). Strength, balance, and gait improved consistently in the diet-exercise group. Adverse events included a small number of exercise-associated musculoskeletal injuries. APTA members David Sinacore, PT, PhD, FAPTA, and Tiffany Hilton, PT, PhD, coauthored the study.

subset: commoncrawl


text:
Bulk SMS China
Welcome to SMS India Hub – China – We are India's top Bulk SMS Service provider offering top class bulk SMS Gateway in China at very affordable rate which can fix in your budget. We are providing multiple digital marketing products like, Short Code SMS, Long Code SMS, Transaction Bulk SMS, Promotional Bulk SMS, Missed Call Alert SMS, Toll Free Service for Business need. We are providing Robust Bulk SMS API which you can connect with your application, website or Software. We have direct connectivity with all the networks in india. We are also dealing in International Bulk SMS Solutions with free API.
Cheapest Bulk SMS Service in China
China is the emerging marketing in terms of technology, marketing and population hence we need to capture this market we also need to use the different tool of marketing and Bulk SMS is the latest way of promotion and marketing wherein you can directly send your offers and alert to your targeted audience. In India maximum people are using two handset or two mobile number So join Bulk SMS HUB and use the power of bulk sms.
Best Buk SMS Deal in China with following Featuers
- Best User Interface in the Market.
- Get Unlimited SMS Validity.
- Free Bulk SMS API
- Upload your contact list.
International Bulk SMS API China
Are you looking for International Bulk SMS API then you are at right place yes SMS INDIA HUB is the leading company providing International Bulk SMS with Free SMS API. Our SMS API is robust and Very Fast and you can develop it in any language as per your wish. We are also providing complete SMS API Document which will help you to understand and develop the API quickly. We have dedicated support team which are train to help you and guide you.


text:
In mild cases of benign prostatic hyperplasia (BPH), no treatment is necessary. In many cases, men with BPH eventually request medical intervention. The goals of treatment are to allow urine to pass easily, to prevent urine retention, and to reduce the risk of urinary infection .
The treatment and management of BPH may involve medication or surgery. Medication, which is used for less advanced cases, may either relax the bladder outlet valve or shrink the prostate by hormonal manipulation. Surgery removes the obstruction. There are several methods available.
Treatment involves the following:MedicationsSurgeryAlternative and complementary therapies
Revision Information
- Reviewer: EBSCO Medical Review Board Adrienne Carmack, MD
- Review Date: 09/2018 -
- Update Date: 09/17/2014 -


text:
Daniel Coudreaut, the senior director of culinary innovation for McDonald's USA, caused a blogosphere furor last week with a statement he made about his menu.
"I don't see anything on the menu that's unhealthy," Coudreaut told the Akron Beacon Journal. "I'm sure I could eat a 2,000-calorie meal at Thomas Keller's French Laundry. "I feel that if we were to close our doors of all of the McDonald's tomorrow, the obesity problem would not go away."
For Coudreaut, it's all about making the right choices.
"If you think McDonald's is part of the current obesity problem, there are two things you can do — stop eating there, or when you do eat there, select the most healthful offerings and make it clear to the person in charge of the store that you want to see more of them."
Can't decide if Coudreaut's comments have merit or not?
Click here to see esquire.com's 10 highest-calorie items on the McDonald's menu and decide for yourself.


text:
An ultrasound uses sound waves to create images of the inside of the body. A venous duplex ultrasound is an ultrasound that looks at the flow of blood through the veins in the arms or legs.
Reasons for Test
The test may be used for the following reasons:
To investigate the cause of the following symptoms in an arm or leg:
- Pain
- Swelling
- Increased warmth
- Bulging veins
To diagnose the following:
- A blood clot, like deep vein thrombosis (DVT)
- Poor vein function
What to Expect
Prior to Test
No special preparation is needed for this test.
Description of Test
You will be asked to lie on a table. Gel will be placed on the skin of your arm or leg, over the veins being tested.
The ultrasound machine has a hand-held instrument called a transducer, which looks like a microphone or wand. The transducer is pushed against your skin where the gel was applied. The transducer sends sound waves into your body. The waves bounce off structures in the body and echo back to the transducer. The echoes are converted to images that are shown on a screen. The doctor examines the images on the screen. He may make a photograph of them as well.
The technologist may push the probe firmly or softly against your skin in order to better see the vein and to see if it collapses under pressure.
After Test
You can get dressed and go home.
How Long Will It Take?
The length of the test varies, depending on your situation. In most cases, it will take between 15-45 minutes.
Will It Hurt?
In general, this test is not painful. You may feel some mild discomfort as pressure is applied to your arm or leg.
A radiologist, cardiologist, or vascular surgeon will read the images. The test results will be sent to your doctor. Your doctor will notify you of the results and provide you with recommendations.
Call Your Doctor
Call your doctor if any of these occur:
- Your symptoms continue or worsen
- You develop any new symptoms
If you think you have an emergency, call for emergency medical services right away.
Revision Information
- Reviewer: EBSCO Medical Review Board Michael J. Fucci, DO, FACC
- Review Date: 03/2018 -
- Update Date: 05/07/2014 -


text:
Puzzle Levels
Puzzle Categories
Download a FREE Solution for your puzzles!
Write your own review! Request the FREE solution for this item!
Blue Knight
Product Information
|Remove the Ring
|Level 9 - Gruelling
|Puzzle Master
|Puzzle Master Wire / Metal Puzzles
|5 3/16 in x 3 1/16 in / 13.2 cm x 7.8 cm
|Clam Shell
Product Description
Made from high quality nickel plated wire, this Blue Knight can put up a fight. Can you block his attacks by removing the golden ring? All those other rings look intimidating, but with determination nothing is impossible. Just shy of the highest difficulty level, this puzzle is only for serious puzzlers that want a real challenge. From our collection of PuzzleMaster Wire puzzles, the Blue Knight is packaged in a clam shell, easy for storage.
Customer Reviews |Write your own review!
Disclaimer: These reviews are written by our customers. Puzzle Master makes every attempt to keep these posts informative and relevant. If you find a post objectionable or inappropriate, please let us know by sending an email to email@example.com
Good puzzle. I solved it in about 20 minutes but I tend to do that. My neighbor bought me a level 10 (The Yak) and I solve it in 7 min flat...pissed him off.


text:
Price graph
Select departure flight to Rhodes|April 11, 2020(Updating your search...)
Prices are per person and include all taxes and fees. All flight times and dates are in local time.
- Clear All
Why Fly With Trip.com?
- Worldwide CoverageFlights to over 5,000 cities
- One-stop Service GuaranteePrice guaranteed upon confirmed payment, booking guaranteed once tickets issuedLearn more
- Secure PaymentConvenient & reliable booking and payment system
- Travel at Your FingertipsManage travel bookings easily through the app, website or by phone
Flights > Rhodes Flights > London to Rhodes Flights


text:
Sign in / Sign up
iYour password has been successfully changed.
We've sent an email with instructions to create a new password. Your existing password has not been changed.
{* public_profileBlurb *}
You have activated your account, please feel free to browse our exclusive contests, videos and content.
An error has occurred while trying to update your details. Please contact us.
Please confirm the information below before signing up.
We didn't recognize that password reset code. Enter your email address to get a new one.
Sorry we could not verify that email address. Enter your email below and we'll send you another email.


text:
Anil Kapoor Gossip
Anil Kapoor gossip, latest news, photos, and video.
Bollywood North
Bollywood took over Toronto this weekend for the International Indian Film Academy Awards with some of the biggest Bollywood stars in attendance. It's the first time in the history of the event that it's taken place in North America. This is no small deal. 16,000 tickets sold out in a matter of minutes. Full Story


text:
Treatment and outcomes will depend on your age, the severity of your symptoms, the cause of the hyperthyroidism, and whether you are pregnant or breastfeeding.
The treatment and management of hyperthyroidism involves anti-thyroidal medications, and possibly radioactive iodine or surgery. The goal is to reduce the activity of the thyroid gland and achieve a normal level of thyroid hormone in your body.
Treatment may involve one of the following:MedicationsSurgeryOther treatments—radioactive iodine
Revision Information
- Reviewer: EBSCO Medical Review Board James Cornell, MD
- Review Date: 11/2018 -
- Update Date: 12/20/2014 -


text:
Start Your Soccer Game pass Free Condensed Games Manchester United vs Saint-Etienne Live Stream. Any game? Every Game All Season in stunning HD.Multiple Digital Game Devices. Soccer Network.Manchester United vs Saint-Etienne Hello, Soccer viewer's to Manchester United vs Saint-Etienne Live Stream kick off the Soccer 2017 Live with the annual Football game. Usually, the starters don't play much in the first FOOTBALL Live Stream game of the year and this game is an extra all game for both teams.The current year's Soccer 2017 Manchester United vs Saint-Etienne Live Stream game,every year the primary challenge of the year and part of the festival of the current year's Soccer Football introduction class,will high light the Soccer Football going head to head against the Football.Click here.
Watch Manchester United vs Saint-Etienne Live @ Feb 22, 2017
Match Info <<
Competitor: Soccer Football 2017
Team: Manchester United vs Saint-Etienne
Date: February 22, 2017
Time: 12:30 am ET
Watch Manchester United vs Saint-Etienne Live Soccer Game 2017 HD TV
You can watch this Event Live Stream on all TV Chanel Manchester United vs Saint-Etienne. Espn, ESNP3,SONY SIX,Fox Sports,Star Sports,HBO,ABC,NBC,ESPN2S any one of these channel will broadcast this*Watch 2017 Soccer Live*Manchester United vs Saint-Etienne Live Streaming,Today's hard-hitting big Match will held involving by Manchester United vs Saint-Etienne Soccer Live that's Streaming Live online today from site.
Get instant access to the widest sports coverage on the net direct from any location. Watch over 4500 plus HD TV Channel on Worldwide.Crystal clear coverage is essential so you don's miss any part of the location.The High Definition (HD) TV. It's the best on the net.You can easily watch your favorite sports on online TV on PC. Soccer Live will be the main fight of hurling.Fight of the century tonight,watch online this event Manchester United vs Saint-Etienne Live hurling live streaming HD video TV channel on online. Download and install it and enjoy all the pleasures of the sporting world comfortably.


text:
Deluxe Carpet Steam Cleaning is the number one service provider for Carpet Cleaning Craigieburn. Our cleaning technicians are well-versed in completer carpet cleaning solutions and offer carpet stain removal services, carpet shampooing, carpet deodorizing, carpet sanitization, spot removal & treatment, carpet mold restoration, carpet flood restoration and more. ☎ 1800 138 179 same-day bookings for domestic and commercial properties. Value for money.
We provide 100% GUARANTEED Eco-Friendly Carpet Steam Cleaning, effective stain removal. Same Day Service!!! Deluxe Carpet Steam Cleaning offers the lowest prices and makes it easy for our customers to opt for carpet cleaning more often to keep their carpets in good shape.
Craigieburn's Best Carpet Steam Cleaning Specialists
Our Carpet Cleaning Specialists are the best in Craigieburn. Our cleaners are experts in cleaning.
- Double story home carpet steam cleaning
- Single Story Carpet Steam Cleaning
- Odor Removal
- Green & Eco-Friendly service
- Cater to all kinds of clients ranging from small households to big businesses
- A const carpet shampooing Craigieburn reductive approach to finish up with carpet cleaning for your satisfaction
- Flood Emergency Response team
- Comply with Australian National Standards
- Qualified professional
- High Rise Apartments Carpet Steam Cleaning
- Carpet Cleaners with an acute eye for detail
- Happy Customers all Over Craigieburn
- Over 10 years of experience in Carpet Cleaning
Need for Carpet Cleaning Services in Craigieburn?
Your carpet plays a vital role in defining the decor of your home/office. It is also that one piece of furnishing that attracts most of the dust, soil, and pollution. With all the foot traffic it has to bear, it is obvious that it requires a special kind of cleaning on a regular basis to maintain it properly. A dirty carpet leads to the growth of unwanted elements such as bacteria, fungi, mold and other contaminants.
All of these allergens are harmful enough to cause fatal health problems to you and your loved ones. Sneezing, coughing, red eyes, running nose, itchiness are some symptoms that indicate your carpet requires professional carpet cleaning Craigieburn. Cleaning methods used at home are not efficient enough for deep carpet cleaning and that is why you need professional experts to clean the carpets thoroughly.
Our Other Services
- Tile and Grout Cleaning Craigieburn
- Mattress Cleaning Craigieburn
- Duct Cleaning Craigieburn
- Upholstery Cleaning Craigieburn
Best Methods Carpet Cleanings
Carpet cleaning is not as easy as it seems. It way more than regular vacuuming. Vacuuming the carpets in order to clean them is not enough, and needs to be deep cleaned to remove pollutants and allergens settled inside the fiber of the carpet. And for that, the best methods are:
- Carpet Steam cleaning
- Carpet Dry cleaning
- Carpet Shampooing
We Offer:
Our Professional Carpet Cleaning Craigieburn Process involves:
- Carpet Steam Cleaning
- Carpet Dry Cleaning
- Wool Carpet Cleaning
- Carpet Dry Compound Cleaning
- Encapsulation Carpet Cleaning
- Pet Hair Removal from Carpet
- Carpet Shampooing
- Dry Foam Carpet Cleaning
- Carpet mold restoration
- Carpet Vacuuming
- Home Carpet Cleaning Services
- Carpet Stain Removal
- Carpet Fabric Protection – E-Gard
- No Carpet Shrinkage or Color Fade
- Eco-friendly non-harmful carpet cleaning chemicals
- No wet smell after carpet steam cleaning
- Carpet Healthguard™ Treatment
- Guaranteed Germs & Bacteria Removal
- Fast Carpet Drying after Steam cleaning
How We Perform Carpet Cleaning?
Our cleaners are trained in both carpet steam cleaning as well as carpet dry cleaning. The choice of method depends on the kind of fabric your carpet is made of, the extent of cleaning required, how tough stains are there, and how old the carpet is. After keen inspection our expert cleaners will choose one of these methods that are explained below:
Carpet Steam Cleaning Craigieburn
Our cleaning technicians have various eco-cleaning solutions that are designed for different types of carpet fabric.
- We first determine the carpet fabric to choose the right cleaning solution.
- Then our professionals use dry vacuuming that helps in getting rid of dry particles – soil, dust, food particles etc. In this step, the stains get loosened which are further treated with effective cleaning agents. These are tough on stains and mild on the fabric.
- Then the cleaners apply hot water extraction method, in which hot water is pressurized into carpet fiber and then is extracted along with pollutants and contaminants.
- Afterward, the carpet is quick-dried with the help of the latest equipment.
- Then the cleaner deodorizes the carpets for the removal of bad odors.
- Once the entire procedure is accomplished, the cleaners do the final inspection.
Carpet Dry Cleaning Craigieburn
At Deluxe Carpet Steam Cleaning, we understand the importance of using less moisture content and hastening the drying process. We use the latest technology where no moisture carpet cleaning is used for carpet cleaning and carpet stain removal. This leaves no moisture but only beautiful and clean carpets.
Carpet Shampooing Craigieburn
Carpet shampooing is another form of dry foam carpet cleaning.
- We pick the most appropriate cleaning solution after conducting a close scrutiny of the carpet fabric.
- Then we use the latest vacuum machines to get rid of dry dirt and contaminants.
- We use special low moisture washing techniques to wash the carpet and remove stains at this stage only.
- Once done, we use vacuums again to dry the carpet to make sure your carpet is ready to be used again in no time.
Our Experience in Carpet Cleaning Service
Being an Australian owned company, we have been providing its best services across all the suburbs of Craigieburn for the last 10 years. The only motto, we follow is to leave our clients happy and content with our services. We strive to serve you only best, thus offer our services round the clock. We also offer same day and emergency carpet cleaning services.
Why Book Deluxe Carpet Steam Cleaning?
Deluxe Carpet Steam Cleaning is a family-owned Australia business providing very cost-effective carpet cleaning Craigieburn. We give you many reasons to choose our carpet cleaners for your home or office. Some of these are:
- Experienced carpet cleaning
- Quick and prompt service
- Experienced and friendly staff
- No extra weekend charges
- Round the clock customer care
- Certified carpet cleaners
- Green & eco-friendly carpet cleaning solutions
- Services all across Craigieburn
- No Hidden Charges
- Cutting-edge equipment
- Special offers for senior citizens
- Free quotation
- Same day and emergency carpet cleaning available
What to expect from Deluxe Carpet Cleaning Craigieburn?
We deliver the following benefits:
- Clean & hygienic carpets
- Prolonged life of carpets
- Improved indoor air
- Contaminant-free carpets
- Better health fewer problems
- Shinier and brighter carpet
- Cost-saving on carpet replacement
- Complete peace of mind
- 100% satisfaction
Call Deluxe Carpet Steam Cleaning now on 1800 138 179 for a free quote and consultation!


text:
Free shipping in the USA (lower 48) when your order is over $89 (excluding gift certificates and sales tax, if applicable).
The Psalms of David, 1719 : is the source of the text for this product. Here is a listing of title related products.Also Recorded On CD: 633-CD
� 2020 Music44. All rights reserved.


text:
November 6 is always a day of special meaning to me. My first secretary (Kate) called it Independence Day.
It's the anniversary of my going into solo practice. Which, after many years, is still one of the best decisions of my life.
As most of you know, I started out with Humungous Neurology, but after a few years I got sick of endless partner meetings (AKA sociopath's roundtable), bizarre fluctuations in my allegedly fixed salary that no one could explain, office politics, and the utter bullshit that seems to come with a large medical practice. Accountants showing me charts of dollars earned vs. square footage of office space used per patient drove me nuts.
Most of the other docs at Humungous Neurology, Inc., told me I wouldn't make it on my own. That I'd be back soon. That there was no place in modern medicine for a solo doc.
But I left anyway. It was a gutsy move. I had a 1 year old. Mrs. Grumpy was pregnant with twins, and couldn't work. I hadn't run a business since age 12, when I sold used golf balls (I fished them out of a lake on a nearby course, and sold them from a card table to passing golfers). My dad helped me form a corporation, and connected me with a friendly accountant he knew.
Kate (who was here before Mary) and Annie came with me from Humungous Neurology, Inc. But my first receptionist was - my mom.
To add another item to the list of terrific things Mom has done, she became my first receptionist when Kate had to go out of town that first week. She patiently answered the phones and made notes in a scheduling book, while I frantically tried to get the phones and computers to work properly. I didn't see a single office patient that week due to a phone system meltdown (it traumatized me so much that I've never changed it since).
Kate left me after 4 years to take a job closer to her home. I was afraid I'd never replace her. I spent a sleepless night at home, and the next morning she introduced me to Mary, who she'd met working for another doctor in the building. She'd found her own awesome replacement in only one day. And Mary is still here, and still totally awesome.
Annie and I have now been together for a total of 14 years, and I can't imagine doing this without her.
I have no regrets about solo practice. It was a self-taught crash course in business: insurance, payroll, withholding taxes, purchasing supplies, etc. It certainly isn't for everyone. But when it's all said and done, I prefer this more than any group. Nobody argues with me about my choice of computers, or EMG machine, or ISP, or whatever. Nobody makes me look at Powerpoint presentations on lobby decor. And nobody shows me charts of dollars earned per square foot per patient.
I'm writing this to say "thank you" to those who have made it possible for me to be here: Annie, Kate, Mary, my parents, and (of course) Mrs. Grumpy. It takes a hell of a lot of patience (and too many other qualities to list) to put up with me.
And, of course, the patients. Without whom I'd have no practice or blog.
Thank you all so very much.


text:
Yawl Sailboats for Sale in Idaho
There are no Yawl Sailboats for sale in Idaho, but some other boats are listed below
It doesn't look like there are any Yawl Sailboats for sale in Idaho that match all of your boat search criteria, but included some other boats that are displayed above. Boat Paradise has a lot of boats listed for sale on but some brands/locations might be a rare find. You might get a better luck if you broaden your search.
Boats by Make
Boats by Type
Boats by Location
A1 Custom Trailers Albemarle Albury Brothers Alumacraft Aluminum Cruisers Inc Aquasport Baha Cruisers Baja Bass Tracker Bayliner Beneteau Bennington Berglund And Black Bertram Boston Whaler Caravelle Boats Carolina Boats Carver Catalina Celebrity Century Chaparral Chris-Craft Cobalt Cobia Contender Crest Pontoon Boats Crestliner Crownline De Viking Scheeps Donzi Doral Ebbtide Egg Harbor Everglades Boats Express Yachting Formula Fountain Four Winns Galaxy Glastron Grady-White Granger Performance Harris Flotebote Hatteras Hunter Hurricane Hydra-Sports Key West Larson Lowe Luhrs Mainship Mako Malibu Mariah Mastercraft Maxum Meridian Mirrocraft Monterey Parker Pearson Polar Boats Pro-Line Prokat Pursuit Rampage Ranger Regal Regulator Renken Rinker Robalo Sailfish Sea Doo Sea Fox Sea Ray Seaswirl Silverton Skeeter Sportcraft Stamas Starcraft Stingray Stratos Sun Tracker Sunbird Sunchaser Sweetwater Sylvan Thompson Tiara Topaz Triton Trojan Trophy Wellcraft Yamaha All Makes
Aft Cabin Boats Airboats Angler Boats Bass Boats Bay Boats Bluewater Fishing Boats Bowrider Boats Catamaran Powerboats Center Console Boats Classic Powerboats Commercial Boats Convertible Boats Cruiser Powerboats Cuddy Cabin Boats Deck Boats Dive Boats Downeast Boats Dual Console Boats Duck Boats Express Cruiser Boats Fishing Boats Fish and Ski Boats Flats Boats Flybridge Boats Freshwater Fishing Boats High Performance Boats Houseboats Jet Boats Jon Boats Mega Yachts Motoryachts Personal Watercraft Pilothouse Boats Pontoon Boats Runabout Boats Saltwater Fishing Boats Ski and Wakeboard Boats Skiff Boats Speed Boats Sport Fisherman Boats Submersible Boats Trawlers Walkaround Boats Weekender Boats YachtsClassic Sailboats Cruiser/Racer Sailboats Cutter Sailboats Ketch Sailboats Motorsailer Sailboats Multi-Hull Sailboats Racer Sailboats Sailing Catamarans Sloop Sailboats Yawl SailboatsCanoes Dinghy Boats Inflatable Boats Kayaks Pedal Boats Rowboats Tender Boats
Alabama Alaska Arizona Arkansas California Colorado Connecticut Delaware Florida Georgia Hawaii Idaho Illinois Indiana Iowa Kansas Kentucky Louisiana Maine Maryland Massachusetts Michigan Minnesota Mississippi Missouri Montana Nebraska Nevada New Hampshire New Jersey New Mexico New York North Carolina North Dakota Ohio Oklahoma Oregon Pennsylvania Rhode Island South Carolina South Dakota Tennessee Texas Utah Vermont Virginia Washington West Virginia Wisconsin WyomingAlberta British Columbia Manitoba New Brunswick Newfoundland Nova Scotia Ontario Prince Edward Island Quebec Saskatchewan


text:
Barry M Texture Nail Polishes: £3.99*
I'm not new to texture polishes, I reviewed one last year when I swatched the Mariah Carey collection for OPI. Barry M have bought the concept to the UK highstreet with their new collection of Textured Nail Polishes. They have a sort of gritty texture, almost like sand mixed in with nail polishes. They have a light bumpy matte texture almost like grains of sand suspended in a usual creme finish polish.
Atlantic Road is a soft pastel powder blue which reminds me a little of their mainline Blueberry ice cream. Kingsland Road is a very creamy light peachy pink and possibly my favourite from the bunch. Station Road is a bright yellow, which Im actually not overly keen on. It's fairly bright and doesn't really fit with the other pastely tones within then range. Ridley Road is a beautiful bright but still pastel mint green which is absolutely perfect for summer. They are easy to apply and are all opaque in less three coats.
Unlike the previous sand polishes I reviewed I think the texture works a lot better on these softer Ice Cream tones. They remind me of the beach and summer and the colours really compliment the finish. I can see myself wearing these at some point, especial the beautiful Kingsland Road! I think textured polishes are definitely one of those love them or hate them types of products. I have to admit these have grown on me considerably!


text:
Evening Gowns Sheer Neck Lace Flower Appliques Chiffon Floor Length Sash Sleeveless Elegant Prom DressesItem Code: BO5934
Market price::
US $302.26Factory price: US $153.00
- WEDDING VENUES : Beach / Destination
- SILHOUETTE : A-line
- HEMLINE / TRAIN : Floor-length
- NECKLINE : High Neck
- BODY SHAPE : Misses
- FABRIC : Chiffon
- SEASON : Summer
- SLEEVE LENGTH : Sleeveless
- EMBELLISHMENT : Appliques
- WAIST : Natural
- Rush Time : 6 work days
- Custom measurements : Custom measurements
Hot Sale 2015 Evening Dresses For Sale:
Hemline: Floor-Length
Image Type: Reference Images
Silhouette: A-line
Fabric: Chiffon
Embellishment: Appliques
Sleeve Length: Sleeveless
Neckline: High Neck
Feature: Custom Made
Short Description:
High Quality dresses fabric handcraft,Reasonable price,Fast Delivery,Perfect service!!!
Processing time:18-25 business days made for wedding dresses, 12-18 business days made for party dresses
MOQ: 1Piece
Package Size: 40.0 * 30.0 * 20.0 (cm) wedding dresses/30.0 * 20.0 * 10.0 (cm) Party dresses
Once shipped, we will update you tracking number on our website immediately, please check it in time.More items you buy,more discount you'll get;Both wholesale and retail are welcome!Competitive prices on our website will save you much.The price is just for the dress. Any other accessories in the picture, just like veil, jacket, etc. Is not included, and if you need one, please feel free to contact us.


text:
The purpose of screening is early diagnosis and treatment. Screening tests are administered to people without current symptoms, but who may be at high risk for certain diseases or conditions.
There are no current screening guidelines or tests available for pneumonia. Pneumonia is usually diagnosed when symptoms arise.
Revision Information
- Reviewer: David L. Horn, MD
- Review Date: 11/2016 -
- Update Date: 05/20/2015 -


text:
Story highlights
- A woman tells Atlanta police she was a personal assistant to Waffle House's CEO
- She accuses him of offensive sexually related acts in 9 years she worked for him
- Joseph Rogers Jr., the CEO, could not be reached for comment
A former personal assistant of Waffle House's CEO accused him of forcing her to "perform sexual services," among other degrading acts, during her nine years of working for him, according to an Atlanta police report.
Police blacked out the woman's name in the report, but gave a graphic account of her accusation, based on an interview that she gave Atlanta police on September 28. CNN obtained a copy of the police report Friday, as news of the allegations against Joseph Rogers Jr. spread around the media.
Efforts Friday by CNN to reach Rogers, whose father co-founded the Georgia-based 24-hour-diner chain were not successful. Similarly, CNN was unable to reach the man believed to be his lawyer.
Atlanta police did not elaborate on to what extent they've been able to verify the woman's claims, with Sgt. Gregory Lyon saying, "I can tell you that this is an open and ongoing investigation."
His accuser told police that, starting in 2003, she had worked out of Rogers' house as his assistant handling personal and work-related items.
Within months of her hiring, the woman said Rogers "on numerous occasions (tried) to force himself upon (her), attempted to have her perform oral sex on him (and) attempted to have sex with (her)," according to the police report.
She refused, but in 2003 and subsequent years, "Rogers required (his assistant) as a condition of her employment to masturbate him," the report said.
The police describe other allegations of sexually inappropriate acts as well, including Rogers making the woman buy pornography, frequently appearing naked in front of her, and touching her body and breasts.
The accuser "was forced to endure the harassment and demeaning treatment by Rogers because she was a single mother and needed her job to support herself and her son," according to police.
On June 29, after her son graduated high school and earned a scholarship to college, she put her resignation letter in Rogers' "sock drawer in an effort to spare Rogers' wife from pain and humiliation," police said.
It was not clear why the accuser took so long after she had left her job to contact police. No charges have been filed in the case.
Since the opening of its first restaurant in the Atlanta suburb of Avondale in 1955, Waffle House has become a culinary staple of the South with more than 1,500 restaurants that are open 24 hours a day, 365 days a year. It is known for its signature yellow signage, jukebox music and breakfast offerings.


text:
Boston Bruins spoil Toronto Maple Leafs' return to NHL playoffs
BOSTON, MA - MAY 1: Nathan Horton #18 of the Boston Bruins celebrates with teammate David Krejci #46 of the Boston Bruins after scoring a goal past James Reimer #34 of the Toronto Maple Leafs in the first period in Game One of the Eastern Conference Quarterfinals during the 2013 NHL Stanley Cup Playoffs on May 1, 2013 at TD Garden in Boston, Massachusetts.
Photograph by: (Photo by Jared Wickerham/Getty Images), Canada.com
BOSTON — David Krejci had a goal and two assists as the Boston Bruins spoiled Toronto's long-awaited return to the NHL playoffs, scoring four unanswered goals to defeat the sloppy Maple Leafs 4-1 on Wednesday night.
The Bruins went behind early but clawed their way back into the game before a capacity crowd of 17,565 in yellow-and-black at TD Garden — Boston's 154th straight sellout. The experienced Bruins turned the screws on the Leafs, who were not at their best, as the game wore on.
The Leafs, whose return to the post-season may be short-lived, were hanging on for stretches of the third period.
"I just thought we self-destructed … We know that this is going to take more than an ordinary effort and tonight our effort wasn't anywhere near close enough to put us in a competitive position," said Leafs head coach Randy Carlyle.
Fans may have partied early in Toronto but last call was reserved for Bruins fans on this night.
Wade Redden, Nathan Horton and Johnny Boychuk also scored for Boston on a night where video review ratified one Bruins goal and disallowed two more.
Krejci, meanwhile, registered his 13th career multi-point playoff game in his 60th appearance in the post-season.
James Van Riemsdyk scored for Toronto, whose big guns were silent.
The game pitted the fourth-seeded Bruins (28-14-6, 62 points) against the fifth-seeded Leafs (28-17-5, 57 points).
Their records this season may have been similar but the two teams have come from different hockey neighbourhoods.
It was Toronto's first appearance in the post-season since 2004 when the Leafs were beaten in six games by the Philadelphia Flyers in the Eastern Conference semifinals. The Bruins, who won the Stanley Cup in 2011, were eliminated in the first round by the Washington Capitals last season.
"I hope MapleLeafs fans enjoy their 1st playoff game in HD this evening," tweeted Prime Minister Stephen Harper.
Not so much. But perhaps not surprising given the jaw-dropping gap in post-season experience between the two.
Going into the game, 15 players on Toronto's current 25-man roster had never seen playoff action. Boston entered the series with 1,273 games of playoff experience on its roster, compared to just 206 for the Leafs.
The Boston roster boasts 22 Stanley Cup rings.
The puck dropped just hours after more developments in the Boston bombings investigation.
Three college friends of the surviving Boston Marathon bombing suspect now face charges: two with conspiring to obstruct justice and the third with making false statements.
Boston Strong was met by Toronto Tough on the night as Leafs coach Randy Carlyle dressed both Colton Orr and Frazer McLaren, who ranked No. 1 and 8 respectively in penalty minutes during the regular season. The two dropped the gloves a combined 25 times in 48 games.
Orr and McLaren saw limited action but did their best to initiate contact before and after the whistle, while Orr was ejected in the final minutes of the game after being involved in a scrum. The abrasive Leo Komarov may have won the pest award for the evening, looking to torment anyone in black and yellow. Komarov was less effective in the third, when he picked up an early misconduct.
The first period wasn't pretty, but grew in drama.
Toronto went ahead early on the power play as Van Riemsdyk tucked a puck into an open net at 1:54 after a Phil Kessel shot was tipped by Tyler Bozak and ended up behind the goal with Cody Franson. The defenceman tried to tuck it in but instead the puck went to Van Riemsdyk, who had endured plenty of punishment to retain his position in front of goal. The big Leafs forward then took advantage of an out-of-position Tuukka Rask.
Both teams performed poorly in the final days of the regular season — the Bruins lost seven of nine and the Leafs four of six — and there was sloppy play aplenty in the early going after the goal. Toronto seemed destined to be punished first, coughing up the puck in a variety of ways.
Bruins defenceman Andrew Ference administered some rough justice of his own, elbowing Mikhail Grabovski in the head by the boards. He went unpunished.
The 35-year-old Redden tied it up at 16:20, squeezing a shot at a tight angle from the edge of the faceoff circle through James Reimer. The Toronto goalie may have had his view of the shot impeded by defenceman Michael Kostka.
There was a turning point late in the period with Leafs captain Dion Phaneuf in the penalty box for slashing. Reimer did his bit, stopping one effort in spectacular fashion by making like a snow angel on his back in the crease. Van Riemsdyk raced up the ice and whipped a shot off the Boston crossbar.
The penalty was seven seconds from expiring when the Bruins fired back, with Horton tipping in a Redden shot at 19:48. Officials reviewed the goal, to see if Horton's stick was over the crossbar when it made contact with the puck, but the play stood.
Boston outshot Toronto 40-20, including 14-6 in the third period and 26-14 after 40 minutes.
Boston appeared to have profited from a Nazem Kadri turnover early in the second period but video review showed that Tyler Seguin's shot had hit the crossbar.
Toronto began to bottle the Bruins up in their own zone but failed to convert that into shots on goal. A Bozak breakaway was disrupted by a chasing Kaspars Daugavins at the last second.
Boston then took advantage of a Leaf change with Krejci beating Reimer on a low turnaround shot at 10:25 as the Bruins attackers were allowed to race into the Toronto defensive zone unmolested.
Boychuk made it 4-1 when he beat Reimer on the glove side with a slapshot from the blue-line at 15:44.
Boychuk flattened Grabovski at the boards at 3:45 of the third, sparking a melee that saw Orr take two minors and Ference one. Orr's choice of retaliation over discipline did not help the Toronto comeback cause.
A Patrice Bergeron goal was called off minutes later. Reimer had the puck between his legs, only to have the Bruin poke it through into the goal. But it was ruled the play was dead.
Bozak, the Leafs first-line centre, played after declaring himself fit from an upper-body injury, believed to be a shoulder, that had kept him out of the final two regular season games. As the Leafs' top faceoff man, with a 52.6 per cent win rate, Bozak was a welcome addition.
Boston's Bergeron led the league in faceoff percentage during the regular season, winning 62.1 per cent of his draws. Bozak was 27th overall.
Bozak won plenty of faceoffs, often in his defensive zone. But he seemed to be outmuscled a couple of times in open play, a suggestion he was not yet 100 per cent.
Boston has had the better of the regular-season matchup in recent years.
The Bruins are now 27-6-5 in their last 38 games against Toronto and 12-1-1 in their last 14 on home ice. They won three of four against the Leafs this season, but three of those games were decided by one goal with the other going to a shootout.
NOTES — It was the first playoff meeting between the two Original Six rivals since 1974, when Boston swept the series … Toronto's last post-season series win over Boston was in 1959 when the Leafs rallied to win in seven games.


text:
The latest shipping forecast.
15 days left to listen
3 minutes
See all episodes from Shipping Forecast
Discover the secrets of Radio 4's iconic forecast for the seas around the British Isles.
Do you know your Viking from your Lundy? Set sail on the open sea and test your knowledge


text:
Choose Vehicle:
Item# 831
Congratulations, FREE SHIPPING has been applied!
FREE SHIPPING - on orders of 2 or more!
Add 1 more Heatshield and get FREE Shipping!
Free shipping applies only to orders shipped to the contiguous U.S. via UPS ground.
*Quantities can be updated in cart
Don't see what you're looking for? Contact us!


text:
- 1 Why Encryption?
- 2 Why LUKS for dm-crypt?
- 3 Caveats
- 4 Getting started
- 5 Preparation
- 6 Arch Linux Installer (>2009.08)
- 7 Manually configuring LUKS
- 8 Encrypting swap partition
- 9 Encrypted swap with suspend-to-disk support
- 10 Storing the key externally (USB stick)
- 11 Backup the cryptheader
- 12 Encrypting a loopback filesystem
- 13 Encrypting a LVM setup
- 13.1 LVM with Arch Linux Installer (>2009.08)
- 13.2 Applying this to a non-root partition
- 13.3 LVM&dm-crypt manually (short version)
- 13.3.1 Notes
- 13.3.2 Partitioning scheme
- 13.3.3 The commands =
- 13.3.4 Install Arch Linux
- 13.3.5 Configuration
- 13.3.6 After reboot
- 13.4 / on lvm on luks
Why Encryption?
Encryption is useful for two (related) reasons. Firstly, it prevents anyone with physical access to your computer, and your hard drive in particular, from getting the data from it (unless they have your passphrase/key). Secondly, it allows you to wipe the data on your hard drive with far more confidence in the event of you selling or discarding your drive.
Basically, it supplements the access control mechanisms of the operating system (like file permissions) by making it harder to bypass the operating system by inserting a boot CD, for example. Encrypting the root partition prevents anyone from using this method to insert viruses or trojans onto your computer.
Note that we're not encrypting the boot partition - the bootloader needs to read that one!
ATTENTION: Having encrypted partitions does not protect you from all possible attacks. The encryption is only as good as your key management, and there are other ways to break into computers while they are running. Read the CAVEATS section below!
Why LUKS for dm-crypt?
There are either 3 or 4 rival disk encryption standards in Linux, depending on how you count them.
The old cryptoloop is deprecated: it's old, insecure and unreliable.
A much better version, loop-AES (http://loop-aes.sourceforge.net/), was created but, due to politics, never became favorable with the kernel developers. It's far more secure than either cryptoloop or straight device-mapper encryptions (and probably faster than any of the other 3 options), but is not user-friendly. It also requires non-standard kernel support, which ARCH's kernel26 doesn't have.
The standard device-mapper encryption (dm-crypt) is another choice.
LUKS essentially makes management of encrypted partitions easier. Without going into the hairy details (check out the LUKS home page if you're interested), it stores all the needed setup information on the disk itself. All you need then is the password, which can be in a separate file if you like. The Linux implementation uses dm-crypt and it can have up to eight different passwords, which can be changed or revoked easily. It is also supported by mkinitcpio in ARCH linux, which is nice.
Security (encryption)
Disk encryption is not the be-all and end-all of security. Why not? Well, for a start, it won't prevent people from hacking into a running computer (either over the network or at a console) if there is a security hole to exploited (and there invariably is). There are a dozen and one things you can (and should) do to secure your computer against this type of attack, but they are all outside the scope of this document.
What's more, even in situations this type of encryption is useful for (physical access to storage media), it isn't worth a thing if someone has your key. In other words, if someone finds out or guesses your passphrase, or gets access to your external key file if you're using one, they can unlock the encryption on the hard drive in exactly the same way that you can.
What does this mean for you? Well, if you use an external key file, keep the device it is on SAFE. Attach it to your keyring or whatever. If you use a passphrase, make it hard to guess. There are hundreds of documents all over the internet telling you how to come up with a secure passphrase; we're not going to go over it here. Note, however, that we use the term "passphrase": it doesn't have to be a single word.
Getting started
If you're not starting from an unused hard drive, BACK UP YOUR DATA! I cannot stress this enough. Ideally, you should be doing this regularly anyway, and it's particularly important with an encrypted hard drive. But beware: if you have unencrypted backups, is there any point in having an encrypted hard drive? Think about where you store your backups.
Note: if you want to have encrypted swap, read the section below about Encrypted Swap and decide how you want to set it up before you start the rest of this HOWTO.
Since Arch Linux 2009.08 the Arch installer provides a comfortable and easy way to configure dm_crypt (also in combination with LVM). Of course you can also do all the work manually. In either case it's recommended to overwrite the disk to wipe out former unencrypted content.
Repartitioning and formatting your drive will only remove the filesystem metadata and will mostly leave the actual data intact, allowing determined attackers to recover data using tools like Foremost. If your harddisk contained sensitive data from previous use, you might want to overwrite this data. Contrary to popular believe overwriting several times or using random data as source serves no purpose. Data won't be recoverable after being overwritten by zeros. [1]
To overwrite your disk with zeros you can use
# dd if=/dev/zero of=/dev/sda bs=1M
If you want to check for bad blocks while writing you can use badblocks. The badblocks command will check your disk for bad blocks while writing random data. The pseudorandom algorithm used by this command is faster (although "less random") than /dev/urandom, so it can be useful for large disks. frandom is a fast random generator you might want to use for large disk.
# badblocks -c 10240 -w -t random -s -v /dev/sda
This will test blocks in groups of 10240 (i.e. 10MB) at a time, writing over them with random data and showing progress as it goes.
However it should be noted that the pseudo random data generated by badblocks does not serve any other purpose than slowing down the wiping of your drive.
Arch Linux Installer (>2009.08)
Since Arch Linux 2009.08 the installer supports dm_crypt and LVM (and combination of both) out of the box.
Just run the installer as usual, i.e. follow the Official Arch Linux Install Guide or the Beginners' Guide. When you reach the "Prepare Hard Drive(s)" don't use "Auto-Prepare" but set up your partitions manually. Beware that you have to create a separate unencrypted /boot partition, or GRUB/LILO has no chance to load the operating system afterwards. The most important step towards an encrypted system is done in the "Manually Configure ..." step.
Configuring filesystems and mountpoints
At first select the device corresponding to your unencrypted /boot partition, choose e.g. ext2 as filesystem and select /boot as the mountpoint. For all other partitions you created and which you want to be encrypted select dm_crypt in the filesystem dialog. You should enter a label for the encrypted device, e.g. 'sda2crypt', or simply 'root'.
Here is an example listing how it may look like:
/dev/sda1 raw->ext2;yes;/boot;no_opts;no_label;no_params /dev/sda2 raw->dm_crypt;yes;no_mountpoint;no_opts;sda2crypt /dev/sda3 raw->dm_crypt;yes;no_mountpoint;no_opts;sda3crypt /dev/mapper/sda2crypt dm_crypt->ext3;yes;/;no_opts;no_label;no_params /dev/mapper/sda3crypt dm_crypt->ext3;yes;/home;no_opts;no_label;no_params
Note: you can also put a LVM inside the dm_crypt partition, or vice versa a dm_crypt partition inside a LVM volume. See Encrypting a LVM setup for details.
When you press 'DONE' the installer will create and mount the filesystem configuration automatically. You will be prompted for a LUKS passphrase 3 times (2x to set a new passphrase, 1x to unlock the device).
That's it with the dm_crypt specific part for so far. Select your desired packages and install the system. The installer should perform all steps necessary for configuring the boot and mount process of your new system. You can check the configuration afterwards and compare them to the one in the section about manual configuration. Especially the HOOKS section in mkinitcpio.conf is important for an encrypted root partition.
Further tweaks for USB keyfile authentication
When you're planning to use a keyfile on an USB stick instead of passphrase authentication you have to do some further tweaks in mkinitcpio.conf: To mount the USB device with your keyfile in the boot process add usb somewhere before encrypt in the HOOKS variable e.g.
HOOKS=" ... sata usb usbinput keymap encrypt filesystems ... "
And for a FAT formated USB stick add the following to the MODULES variable
MODULES=" ... nls_cp437 vfat ... "
After exiting the installer you can now create a keyfile onto USB stick your for authentication. This is for example done with the following commands. Check out section Generating the keyfile for further details.
# mkdir /mnt/usbstick # mount -t vfat /dev/sdb1 /mnt/usbstick # cd /mnt/usbstick # dd if=/dev/urandom of=mykeyfile bs=512 count=4 # cryptsetup luksAddKey /dev/sdaX /mnt/usbstick/mykeyfile
Manually configuring LUKS
As noted above it's recommended for security reasons to overwrite the partition before going any further.
At first set up your partitions as you want. Make sure you have a separate partition for /boot. If you think about it, this is absolutely necessary. If your /boot partition is encrypted, then your bootloader would not be able to read the kernel image and you would not get far.
# cfdisk /dev/sda
The following - indicative - partition layout will be used:
/dev/sda1 -> /boot /dev/sda2 -> swap /dev/sda3 -> / /dev/sda4 -> /home /dev/sda5 -> /tmp # especially useful if you don't want to encrypt the entire root (/) partition
Loading kernel modules
Note: this article will use XTS-AES as encryption algorithm because it was standardized as IEEE P1619 Standard for Cryptographic Protection of Data on Block-Oriented Storage Devices and it is quite secure, however the XTS mode is still flagged as "experimental" in the Linux kernel, so if you want something less secure but more proven, you should go with the CBC-ESSIV mode. The XTS mode is supported by Linux 2.6.24 upwards (ISO of Arch 2008.06 upwards).
Note: The XTS mode uses two keys of the same size, therefore available sizes (using XTS-AES) are 256 (128 * 2), 384 (192 * 2) and 512 (256 * 2).
Load the dm-crypt and the optimized AES module:
# modprobe dm-crypt # modprobe aes-i586
Note: x86_64 users can also try the "aes-x86_64" optimized module instead of "aes-i586".
Mapping partitions
Use this to create a password to unlock your encrypted partions with:
Create your new LUKS encrypted partitions:
# cryptsetup -c aes-xts-plain -y -s 512 luksFormat /dev/sda3 Enter passphrase: mypassword Verify passphrase: mypassword # cryptsetup -c aes-xts-plain -y -s 512 luksFormat /dev/sda4 Enter passphrase: myotherpassword Verify passphrase: myotherpassword # cryptsetup -c aes-xts-plain -y -s 512 luksFormat /dev/sda5 Enter passphrase: myotherpassword Verify passphrase: myotherpassword
Then open the newly created LUKS partitions:
# cryptsetup luksOpen /dev/sda3 root Enter any LUKS passphrase: mypassword key slot 0 unlocked. Command successful. # cryptsetup luksOpen /dev/sda4 home Enter any LUKS passphrase: myotherpassword key slot 0 unlocked. Command successful. # cryptsetup luksOpen /dev/sda5 tmp Enter any LUKS passphrase: myotherpassword key slot 0 unlocked. Command successful.
You can also do the following to create a keyfile instead of a passphrase. Of course you could put the keyfile everywhere you like, but most probably you'll want to put it onto an USB stick to unlock your encrypted partions. See the corresponding section below for further details on this.
To store the keyfile on an USB stick mount it and change to the directory
# mkdir /mnt/usbstick # mount -t vfat /dev/sdb1 /mnt/usbstick # cd /mnt/usbstick
As said above the keyfile can be of any content and size. We'll generate a random keyfile of 2048 bytes onto the USB stick:
# dd if=/dev/urandom of=mykeyfile bs=512 count=4
Create your new LUKS encrypted partitions:
# cryptsetup -c aes-xts-plain -s 512 -v luksFormat /dev/sda3 /mnt/usbstick/mykeyfile # cryptsetup -c aes-xts-plain -s 512 -v luksFormat /dev/sda4 /mnt/usbstick/mykeyfile # cryptsetup -c aes-xts-plain -s 512 -v luksFormat /dev/sda5 /mnt/usbstick/mykeyfile
Note: if you've already created the LUKS partitions e.g. with passphrase authentication, you can add a keyfile as further authentication method by using
# cryptsetup luksAddKey /dev/sdaX /mnt/usbstick/mykeyfile # replace X by 3,4,5
Then open the newly created LUKS partitions:
# cryptsetup -d /mnt/usbstick/mykeyfile luksOpen /dev/sda3 root key slot 0 unlocked. Command successful. # cryptsetup -d /mnt/usbstick/mykeyfile luksOpen /dev/sda4 home key slot 0 unlocked. Command successful. # cryptsetup -d /mnt/usbstick/mykeyfile luksOpen /dev/sda5 tmp key slot 0 unlocked. Command successful.
Now you should have a device called /dev/mapper/root, another one called /dev/mapper/home and another one called /dev/mapper/tmp. These are block devices like any other, but with a neat twist: whenever you write to them, the data is actually written to /dev/sda3, /dev/sda4 or /dev/sda5 respectively, but it is encrypted first! The only way to access the data on this encrypted partition is to re-create that /dev/mapper/root, /dev/mapper/home etc. device with cryptsetup each time you boot. With LUKS, you can use cryptsetup luksAddKey /dev/sda3 to add a new password or cryptsetup luksDelKey /dev/sda3 to revoke a password. Type cryptsetup -? or man cryptsetup (once you've booted your new Arch installation) for more info.
Note: With LUKS, if you enter the wrong password, it will reject it. You don't have to worry about it possibly destroying your data.
Note: You might also want to replace /var/tmp/ with a symbolic link to /tmp.
Note: If you've decided to go for option two for encrypted swap (see Encrypted Swap below), you should set up /dev/mapper/swap in a similar way as you've just set up /dev/mapper/home. See Encrypted Swap below for details.
Installing the system
Now that /dev/mapper/root and /dev/mapper/home are in place, we can enter the regular Arch setup script to install the system into the encrypted volumes.
# /arch/setup
Note: Most of the installation can be carried out normally. However, there are a few areas where it is important to make certain selections these are marked below.
Prepare hard drive
Skip the Partitioning and Auto-Prepare business and go straight to manually configuration. Instead of choosing the hardware devices (/dev/sdaX) directly you have to select the mapper devices created above: Choose /dev/mapper/root for your root and /dev/mapper/home as home partition respectively and format them with any filesystem you like. The same is valid for a swap partition which is set up like the home partition. Make sure you mount /dev/sda1 as the /boot partition or else the installer will not properly set up the bootloader.
Select and Install packages
Select and install the packages as usual, the base package contains all required programs.
Configure System
Note: encrypt hook is only needed if your root partition is a LUKS partition (or for a LUKS partition that needs to be mounted before root). If it is a swap or any other partition, all is taken care by rc.sysinit and /etc/crypttab file
Afterwards you can check the files presented to you by the installer, the most important one being /etc/mkinitcpio.conf. For detailed info on mkinitcpio (and its configuration) refer to Mkinitcpio.You have to make sure that your HOOKS looks somehow like this:
HOOKS="... encrypt ... filesystems ..."
It is important that the encrypt hook comes before the filesystems one. If you store your key on an external USB device (e.g. a USB stick), you need to add the USB hook too:
HOOKS="... usb encrypt ... filesystems ..."
For safety, add in usb before encrypt; not sure if they're run in the order they appear in mkinitcpio.conf or not. If you need support for foreign keymaps for your encryption password you have to specify the hook 'keyboard' as well. I suggest to put this in mkinitcpio.conf right before 'encrypt'.
If you have USB keyboard you need the "usbinput" hook in mkinitcpio.conf. Without it, no USB keyboard will work in early userspace.
Install Bootloader
GRUB: You have to make some small changes to the entries generated by the installer by replacing /dev/mapper/root with /dev/sda3. The corrected config looks like this:
# (0) Arch Linux title Arch Linux root (hd0,0) kernel /vmlinuz26 root=/dev/sda3 ro initrd /kernel26.img
For kernel >= 2.6.30:
# (0) Arch Linux title Arch Linux root (hd0,0) kernel /vmlinuz26 cryptdevice=/dev/sda3:root root=/dev/mapper/root ro initrd /kernel26.img
LILO: On Lilo, edit the Arch Linux section on /etc/lilo.conf and include a line for append option, over the initrd, with the "root=/dev/sda3" param. The append section make the same kernel line on grub. Also, you can ommit the root option, over the image option. The section look like this:
# Arch Linux lilo section image = /vmlinuz26 # root = /dev/sda3 label = Arch initrd = /kernel26.img append = "root=/dev/sda3" read-only
Note if you want to use a USB stick with a keyfile you have to append the cryptkey option. See the corresponding section below.
Exit Install
Now that the install is finished the only thing left to do is add entries to the /etc/crypttab file so you don't have to enter the passphrase for all encrypted partitions. This works only for non-root partitions e.g. /home, swap, etc.
# vi /mnt/etc/crypttab
Add the following line for the /home partition
home /dev/sda4 "myotherpassword"
You can also use a keyfile instead of a passphrase. If not already done, create a keyfile and add the key to the corresponding LUKS partition as described above. Then add the following information to the /etc/crypttab file for automounting:
home /dev/sda4 /path/of/your/keyfile
After rebooting you should now be presented with the text
A password is required to access the root filesystem:
followed by a prompt for any LUKS password. Type it in and everything should boot. Once you've logged in, have a look at your mounted partitions by typing mount. You should have /dev/mapper/root mounted at / and, if you set up a separate encrypted home partition, /dev/mapper/home mounted at /home. If you set up encrypted swap, swapon -s should have /dev/mapper/swap listed as your swap partition.
Note: eventually the text prompting for the password is mixed up with other boot messages. So the boot process may seem frozen at first glance, but it isn't, simply enter your password and press return.
Encrypting swap partition
Sensitive data stored in memory may be written to swap at any time. If you've gone to the trouble of encrypting your root and home partitions, you should encrypt your swap as well. There are two options here: random encryption on each boot (better security), or the same encryption each time. We won't cover the second option here, as it is pretty much identical to how you set up the /home partition above. Just replace all references to home with swap, and sda4 with sda2.
Arch Linux provides a convenient way for the first option, which uses dm-crypt directly without LUKS. If you're still in the archsetup process, just switch to a different virtual console (ALT+F2). If you've exited already, the new root will have been unmounted. Use mount /dev/mapper/root /mnt to mount it again.
Now add an entry to the cryptsetup file:
# echo swap /dev/sda2 SWAP "-c aes-xts-plain -h whirlpool -s 512" >> /mnt/etc/crypttab
Note: Recommended hash algorithms are "whirlpool" (patent free), "sha256", "sha384" or "sha512". Default is "ripemd160" (not recommended).
[why is it not recommended? only RIPEMD (128bit) was hacked RIPEMD-160 is still safe[2], isn't it? I heard wirlpool is at least twice as slow. ]
Note: Please take extra care to put the right partition here. The startup script won't ask before overwriting the provided device, destroying all data on it, unless it has a LUKS header, then it simply won't work. If you have been following these instructions closely, then in the section "Mapping Partitions" above you put a LUKS header on your swap partition. Erase it with something like the command below, replacing /dev/sda2 with the appropriate swap device:
# dd if=/dev/zero of=/dev/sda2
From now on, each time you boot, the partition will be encrypted automatically with a random key, and will then be formated with mkswap.
Now all you have to do is adjust the corresponding entry in /etc/fstab:
/dev/mapper/swap swap swap defaults 0 0
And you're done! Carry on with installation or, if you've already finished, umount /mnt.
Encrypted swap with suspend-to-disk support
To be able to resume after suspending the computer to disk (hibernate), it is required to keep the swap filesystem intact. Therefore, it is required to have a LUKS swap partition with a persistent key, which can be stored on the disk or input manually at startup. Because the resume takes place before the crypttab can be used, it is required to create a hook in mkinitcpio.conf to open the swap LUKS device before resuming.
If you want to use a partition which is currently used by the system, you have to disable it, first:
# swapoff /dev/<device>
To create the swap partition, follow steps similar to those described in mapping partitions above. Omit steps 1 and 2 if you don't intend to use a saved key file.
1. Generate a random key file in a safe place - encrypted root partition like my examples or secure USB stick.
# dd if=/dev/urandom bs=1 count=512 of=/etc/keys/swap.key
2. For security reasons, no user except root should have read-access to this file.
# chown root:root /etc/keys/swap.key # chmod go-rwx /etc/keys/swap.key
3. Format the partition you want to use as swap with cryptsetup, using the key stored previously. For performance reasons, you might want to use different ciphers with different key sizes. A benchmark can be found here.
# cryptsetup -c aes-xts-plain -s 256 -v luksFormat /dev/<device> /etc/keys/swap.key * as stated in discussion: the -h parameter to specify hash function is (in this case) ignored, also the default hash - ripemd - is not recommended (citation needed). use aes-xts-plain:whirlpool , or aes-xts-sha256 instead. * check result with # cryptsetup luksDump /dev/<device>(sda3)
If you don't use a saved key file, use this command:
# cryptsetup -c aes-xts-plain -s 256 -v luksFormat /dev/<device>
4. Open the partition in /dev/mapper using the key:
# cryptsetup luksOpen /dev/<device> swapDevice -d /etc/keys/swap.key
If you don't use a saved key file, use this command:
# cryptsetup luksOpen /dev/<device> swapDevice
5. Create a swap filesystem inside the mapped partition:
# mkswap /dev/mapper/swapDevice
Now you should have a LUKS swap partition which uses the key file stored in /etc/keys/swap.key or asks for the passphrase before mounting, depending on your choice. Make sure you remove any line in /etc/crypttab which uses this device. Now you have to create a hook to open the swap at boot time.
6. Create a file /lib/initcpio/hooks/openswap containing the open command:
# vim: set ft=sh: run_hook () { cryptsetup luksOpen /dev/<device> swapDevice -d /etc/keys/swap.key }
If you don't use a saved key file, openswap should instead contain:
# vim: set ft=sh: run_hook () { cryptsetup luksOpen /dev/<device> swapDevice }
7. Then create and edit the hook setup file /lib/initcpio/install/openswap as:
# vim: set ft=sh: install () { MODULES="" BINARIES="" add_file "/etc/keys/swap.key" FILES="" SCRIPT="openswap" } help () { cat<<HELPEOF This opens the swap encrypted partition /dev/<device> in /dev/mapper/swapDevice HELPEOF }
If you don't use a saved key file, remove unnecessary line add_file "/etc/keys/swap.key" from the file above.
8. Add the hook openswap in the HOOKS array in /etc/mkinitcpio.conf, before filesystem, but after encrypt which is mandatory as well.
9. Regenerate the boot image:
# mkinitcpio -p kernel26
10. Add the mapped partition to /etc/fstab:
/dev/mapper/swapDevice swap swap defaults 0 0
11. Set-up your system to resume from /dev/mapper/swapDevice. For example, if you use GRUB with kernel hibernation support, add "resume=/dev/mapper/swapDevice" to the kernel line in /boot/grub/menu.lst. A line with encrypted root and swap partitions can look like this:
kernel /vmlinuz26 cryptdevice=/dev/sda2:rootDevice root=/dev/mapper/rootDevice resume=/dev/mapper/swapDevice ro
At boot time, the openswap hook will open the swap partition so the kernel resume may use it. If you use special hooks for resuming from hibernation, make sure they stand after openswap in the HOOKS array. Please note that because of initrd opening swap there is no entry for swapDevice in /etc/crypttab needed in this case.
Storing the key externally (USB stick)
Preparation for permanent device names
For reading the file from an USB stick it's important to access it through a permanent device name. The numbering of the normal device names e.g. /dev/sdb1 is somewhat arbitrary and depends on how many storage devices are attached and in what order etc. So in order to assure that the encrypt HOOK in the initcpio finds your keyfile you have to use a permanent device name.
Quick method
A quick method (as opposed to setting up a udev rule) for doing so involves referencing your removable device by its label (or UUID). To find your label or UUID, plug in your USB drive and run
# ls -l /dev/disk/by-label/ lrwxrwxrwx 1 root root 10 12. Feb 10:11 Keys -> ../../sdb1
# ls -l /dev/disk/by-uuid/ lrwxrwxrwx 1 root root 10 12. Feb 10:11 4803-8A7B -> ../../sdb1
In this case I labeled the vfat partition on my USB drive as "Keys" so my device is always symlinked in /dev/disk/by-label/Keys, or If I had wanted to use the UUID I would find /dev/disk/by-uuid/4803-8A7B. This allows me to have a consistent naming of my USB devices regardless of the order they are plugged into the system. These device names can be used in the "cryptkey" kernel option or any where else. Filesystem UUIDs are stored in the filesystem itself, meaning that the UUID will be the same if you plug it into any other computer, and that a dd backup of it will always have the same UUID since dd does a bitwise copy.
Note: If you plan to store the keyfile between MBR and the 1st partition you cannot use this method, since it only allows access to the partitions (sdb1,sdb2,...) but not to the usb device (sdb) itself. Create a UDEV rule instead as described in the following section.
Using UDEV
Optionally you may choose to set up your stick with an udev rule. There's some documentation in the Arch wiki about that already, if you want more in-depth, structural info, read this guide. Here's quickly how it goes.
Get the serial number from your USB stick:
lsusb -v | grep -A 5 Vendor
Create a udev-rule for it:
echo 'KERNEL=="sd*", ATTRS{serial}=="$SERIAL", SYMLINK+="$SYMLINK%n"' > /etc/udev/rules.d/8-usbstick.rules
Replace $SYMLINK and $SERIAL with their respective values. %n will expand to the partition (just like sda is subdivided into sda1, sda2, ...). You do not need to go with the 'serial' attribute, if you have a custom rule of your own, you can put it in as well (e.g. using the vendor name).
Rescan your sysfs:
udevadm trigger
Now check the contents of dev:
ls /dev
It should show your device with your desired name.
Generating the keyfile
Optionally you can mount a tmpfs for storing the temporary keyfile.
# mkdir ./mytmpfs # mount tmpfs ./mytmpfs -t tmpfs -o size=32m # cd ./mytmpfs
The advantage is that it resides in RAM and not on a physical disk, so after unmounting your keyfile is securly gone. So copy your keyfile to some place you consider as secure before unmounting. If you are planning to store the keyfile as a plain file on your USB device, you can also simply execute the following command in the corresponding directory, e.g. /media/sdb1
The keyfile can be of arbitrary content and size. We'll generate a random temporary keyfile of 2048 bytes:
# dd if=/dev/urandom of=secretkey bs=512 count=4
If you stored your temporary keyfile on a physical storage, remember to not just (re)move the keyfile later on, but use something like
cp secretkey /destination/path shred --remove --zero secretkey
to securely overwrite it. (due to journaling filesystems etc this is also not 100% secure)
Add the temporary keyfile with cryptsetup:
# cryptsetup luksAddKey /dev/sda2 secretkey Enter any LUKS passphrase: key slot 0 unlocked. Command successful.
Storing the keyfile
To store the key file, you have two options. The first is less risky than the other, but perhaps a bit more secure (if you consider security by obscurity as more secure). In any case you have to do some further configuration, if not already done above
Configuration of initcpio
You have to add two extra modules in your /etc/mkinitcpio.conf, one for the stick's file system and one for the codepage. Further if you created a udev-rule you should tell mkinitcpio about it:
MODULES="ata_generic ata_piix nls_cp437 vfat" FILES="/etc/udev/rules.d/8-usbstick.rules"
In this example it's assumed, that you use a FAT formated stick. Replace those module names if you use another file system on your USB stick (e.g. ext2) or another codepage. Users running the stock Arch kernel should stick to the codepage mentioned here.
In addition insert the usb hook somewhere before the encrypt hook.
HOOKS="... usb encrypt ... filesystems ..."
Generate a new image (maybe you should take a copy of your old kernel26.img before):
mkinitcpio -g /boot/kernel26.img
Storing the key as plain (visible) file
Be sure to choose a plain name for your key - a bit of 'security through obscurity' is always nice ;-). Avoid using dots (hidden files) and similar characters - the encrypt hook will fail to find the keyfile during the boot process.
You have to add a kernel parameter in your menu.lst (grub), it should look something like this:
kernel /vmlinuz26 root=/dev/hda3 ro vga=791 cryptkey=/dev/usbstick:vfat:/secretkey
This assumes /dev/usbstick is the FAT partition of your choice. Replace it by /dev/disk/by-... or whatever your device is.
That's all, reboot and have fun!
Storing the key between MBR and 1st partition
We'll write the key directly between MBR and first partition.
WARNING: you should only follow this step if you know what you are doing - it can cause data loss and damage your partitions or MBR on the stick!
If you have a bootloader installed on your drive you have to adjust the values. E.g. Grub needs the first 16 sectors, you would have to replace seek=4 with seek=16; otherwise you would overwrite parts of your Grub installation. When in doubt, take a look at the first 64 sectors of your drive and decide on your own where to place your key.
Optional If you don't know if you've got enough free space before the first partition you can do
dd if=/dev/usbstick of=64sectors bs=512 count=64 # gives you copy of your first 64 sectors hexcurse 64sectors # determine free space xxd 64sectors | less # alternative hex viewer
Write your key to the disk:
dd if=secretkey of=/dev/usbstick bs=512 seek=4
If everything went fine you can now overwrite and delete your temporary secretkey as noted above. You should not simply use rm as the keyfile would only be unlinked from your filesystem and be left physically intact.
Now you have to add a kernel parameter in your menu.lst (Grub), it should look something like this:
kernel /vmlinuz26 root=/dev/hda3 ro vga=791 cryptkey=/dev/usbstick:2048:2048
Format for the cryptkey option:
OFFSET and SIZE match in this example, but this is coincidence - they can differ (and often will). An other possible example could be
kernel /vmlinuz26 root=/dev/hda3 ro vga=791 cryptkey=/dev/usbstick:8192:2048
That's all, reboot and have fun! And look if your partitions still work after that ;-).
Backup the cryptheader
When the header of your crypted partition was destroyed, you will not be able to decrypt your data. So creating a backup of the headers and storing them on another disk might be a good idea.
Attention: Many people recommend NOT to backup the cryptheader, even so it's a single point failure! In short, the problem is, that LUKS isn't aware of the duplicated cryptheader, which contains the masterkey which is used to encrypt all files on your partition. Of course this masterkey is encrypted with your passphrases or keyfiles. But if one of those gets compromised and you want to revoke it you have to do this on all copies of the cryptheader! I.e. if someone has got your cryptheader and one of your keys he can decrypt the masterkey and access all your data. Of course the same is true for all backups you create of your partions. So you decide if you are one of those paranoids brave enough to go without a backup for the sake of security or not. See also [3] for further details on this.
First you have to find out the payload offset of the crypted partition (replace sdaX with the corresponding partition)
cryptsetup luksDump /dev/sdaX | grep "Payload offset" Payload offset: 4040
Now that you know the value, you can backup the header with a simple dd command
dd if=/dev/sdaX of=./backup.img bs=512 count=4040
Note: you can also backup the header into a tmpfs/ramfs and encrypt it with gpg or whatever before writing it to a physical disk. Of course you can wrap your encrypted backup into another encryption layer and so on until you feel safe enough :-)
Be careful before restore: make sure that you chose the right partition (again replace sdaX with the corresponding partition). Restoring the wrong header or restoring to an unencrypted partition will cause data loss.
dd if=./backup.img of=/dev/sdX bs=512 count=4040
Encrypting a loopback filesystem
[This paragraph has been merged from another page; its consistency with the other paragraphs should be improved]
Preparation and mapping
So, let's start by creating an encrypted container!
dd if=/dev/zero of=/bigsecret bs=1M count=10 # you can also use if=/dev/urandom, if you're really paranoid
This will create the file 'bigsecret' with a size of 10 megabytes.
losetup /dev/loop0 /bigsecret
This will create the device node /dev/loop0, so that we can mount/use our container. (Note: if it gives you the error "/dev/loop0: No such file or directory", you need to first load the kernel module with modprobe loop)
cryptsetup luksFormat /dev/loop0
This will ask you for a password for your new container file. (Note: if you get an error like "Command failed: Failed to setup dm-crypt key mapping. Check kernel for support for the aes-cbc-essiv:sha256 cipher spec and verify that /dev/loop0 contains at least 133 sectors", then run modprobe dm-mod)
cryptsetup luksOpen /dev/loop0 secret
The encrypted container is now available through the devicefile /dev/mapper/secret. Now we are able to create a partition in the container:
mkfs.ext2 /dev/mapper/secret
and mount it...
mkdir /mnt/secret mount -t ext2 /dev/mapper/secret /mnt/secret
We can now use the container as if it was a normal partition! To unmount the container:
umount /mnt/secret cryptsetup luksClose secret losetup -d /dev/loop0 # free the loopdevice.
so, if you want to mount the container again, you just apply the following commands:
losetup /dev/loop0 /bigsecret cryptsetup luksOpen /dev/loop0 secret mount -t ext2 /dev/mapper/secret /mnt/secret
Pretty easy, huh?
Encrypt using a key-file
Let's first generate a 2048 Byte random keyfile :
dd if=/dev/urandom of=keyfile bs=1k count=2
We can now format our container using this key
cryptsetup luksFormat /dev/loop0 keyfile
or our partition :
cryptsetup luksFormat /dev/hda2 keyfile
Once formatted, we can now open the luks device using the key:
cryptsetup -d keyfile luksOpen /dev/loop0 container
You can now like before format the device /dev/mapper/container with your favorite filesystem and then mount it just as easily.
The keyfile is now the only key to your file. I personally advise to encrypt your keyfile using your private GPG key and storing an offsite secured copy of the file.
Resizing the loopback filesystem
First we should unmount the encrypted container:
umount /mnt/secret cryptsetup luksClose secret losetup -d /dev/loop0 # free the loopdevice.
After this we need to create a second file with the size of the data we want to add:
dd if=/dev/zero of=zeros bs=1M count=1024
You could use /dev/urandom instead of /dev/zero if you're paranoid, but /dev/zero should be faster on older computers. Next we need to add the created file to our container. Be careful to really use TWO ">", or you will override your current container!
cat zeros >> /bigsecret
Now we have to map the container to the loopdevice:
losetup /dev/loop0 /bigsecret cryptsetup luksOpen /dev/loop0 secret
After this we will resize the encrypted part of the container to the maximum size of the container file:
cryptsetup resize secret
Finally we can resize the filesystem. Here is an example for ext2/3/4:
e2fsck -f /dev/mapper/secret # Just doing a filesystem check, because it's a bad idea to resize a broken fs resize2fs /dev/mapper/secret
You can now mount your container again:
mount /dev/mapper/secret /mnt/secret
Encrypting a LVM setup
It's really easy to use encryption together with LVM. We are not going to cover the process of setting up LVM here as there is already a guide for that (Installing_with_Software_RAID_or_LVM).
The best method and easier method to follow for a laptop is to set up the LVM on top of the encrypted partition instead of the other way around. This link here is easy to follow and explains everything: Arch Linux: LVM on top of an encrypted partition
To use encryption on top of LVM, you have to first setup your lvm volumes and then use them as base for the encrypted partitions. That means in short that you have to setup lvm at first. Then follow this guide, but replace all occurrences of /dev/sdXy in the guide with its lvm counterpart. (eg: /dev/sda4 -> /dev/<volume group name>/home).
Don't forget to add the "lvm2" hook in /etc/mkinitcpio.conf before the "encrypt" hook. And you will have to change USELVM in /etc/rc.conf to yes.
LVM with Arch Linux Installer (>2009.08)
Since Arch Linux images 2009.08 LVM and dm_crypt is supported by the installer out of the box. This makes it very easy to configure your system for LVM on dm-crypt or vice versa. Actually the configuration is done exactly as without LVM, see the corresponding section above. It differs only in two aspects.
The partition and filesystem choice
Create a small, unencrypted boot partition and use the remaining space for a single partion which can later be split up into multiple logic volumes by LVM.
For a LVM-on-dm-crypt system set up the filesystems and mounting points for example like this:
/dev/sda1 raw->ext2;yes;/boot;no_opts;no_label;no_params /dev/sda2 raw->dm_crypt;yes;no_mountpoint;no_opts;sda2crypt;-c_aes-xts-plain_-y_-s_512 /dev/mapper/sda2crypt dm_crypt->lvm-vg;yes;no_mountpoint;no_opts;no_label;no_params /dev/mapper/sda2crypt+ lvm-pv->lvm-vg;yes;no_mountpoint;no_opts;cryptpool;no_params /dev/mapper/cryptpool lvm-vg(cryptpool)->lvm-lv;yes;no_mountpoint;no_opts;cryptroot;10000M|lvm-lv;yes;no_mountpoint;no_opts;crypthome;20000M /dev/mapper/cryptpool-cryptroot lvm-lv(cryptroot)->ext3;yes;/;no_opts;cryptroot;no_params /dev/mapper/cryptpool-crypthome lvm-lv(crypthome)->ext3;yes;/home;no_opts;cryptroot;no_params
The configuration stage
In /etc/rc.conf set USELVM="yes" In /etc/mkinitcpio.conf add lvm2 before encrypt in the HOOKS variable.
That's it for the LVM&dm_crypt specific part. The rest is done as usual.
Applying this to a non-root partition
You might get tempted to apply all this fancy stuff to a non-root partition. Arch does not support this out of the box, however, you can easily change the cryptdev and cryptname values in /lib/initcpio/hooks/encrypt (the first one to your /dev/sd* partition, the second to the name you want to attribute). That should be enough.
The big advantage is you can have everything automated, while setting up /etc/crypttab with an external key file (i.e. not on any internal HD partition) can be a pain - you need to make sure the USB/FireWire/... device gets mounted before the encrypted partition, which means you have to change fstab order (at least).
Of course, if the cryptsetup package gets upgraded, you will have to change this script again. However, this solution is to be preferred over hacking rc.sysinit or similar files. Unlike /etc/crypttab, only one partition is supported, but with some further hacking one should be able to have multiple partitions unlocked.
If you want to do this on a software RAID partition, there's one more thing you need to do. Just setting the /dev/mdX device in /lib/initcpio/hooks/encrypt is not enough; the encrypt hook will fail to find the key for some reason, and not prompt for a passphrase either. It looks like the RAID devices aren't brought up until after the encrypt hook is run. You can solve this by putting the RAID array in /boot/grub/menu.lst, like
kernel /boot/vmlinuz26 md=1,/dev/hda5,/dev/hdb5
If you set up your root partition as a RAID array you will notice the similarities with that setup ;-). Grub can handle multiple array definitions just fine:
kernel /boot/vmlinuz26 root=/dev/md0 ro md=0,/dev/sda1,/dev/sdb1 md=1,/dev/sda5,/dev/sdb5,/dev/sdc5
LVM&dm-crypt manually (short version)
If you're enough smart enough for this, you'll be smart enough to ignore/replace LVM-specific things if you don't want to use LVM.
Partitioning scheme
/dev/sda1 -> /boot /dev/sda2 -> LVM
The commands =
cryptsetup -d /dev/random -c aes-xts-plain -s 512 create lvm /dev/sda2 dd if=/dev/urandom of=/dev/mapper/lvm cryptsetup remove lvm lvm pvcreate /dev/sda2 lvm vgcreate lvm /dev/sda2 lvm lvcreate -L 10G -n root lvm lvm lvcreate -L 500M -n swap lvm lvm lvcreate -L 500M -n tmp lvm lvm lvcreate -l 100%FREE -n home lvm cryptsetup luksFormat -c aes-xts-plain -s 512 /dev/lvm/root cryptsetup luksOpen /dev/lvm/root root mkreiserfs /dev/mapper/root mount /dev/mapper/root /mnt dd if=/dev/zero of=/dev/sda1 bs=1M mkreiserfs /dev/sda1 mkdir /mnt/boot mount /dev/sda1 /mnt/boot mkdir -p -m 700 /mnt/etc/luks-keys dd if=/dev/random of=/mnt/etc/luks-keys/home bs=1 count=256
Install Arch Linux
Change USELVM="no" to USELVM="yes".
Put lvm2 encrypt before filesystems.
Change root=/dev/hda3 to root=/dev/lvm/root.
For kernel >= 2.6.30, you should change root=/dev/hda3 to:
cryptdevice=/dev/lvm/root:root root=/dev/mapper/root
/dev/mapper/root / reiserfs defaults 0 1 /dev/sda1 /boot reiserfs defaults 0 2 /dev/mapper/tmp /tmp tmpfs defaults 0 0 /dev/mapper/swap none swap sw 0 0
swap /dev/lvm/swap SWAP -c aes-xts-plain -h whirlpool -s 512 tmp /dev/lvm/tmp /dev/urandom -c aes-xts-plain -s 512
After reboot
The commands
cryptsetup luksFormat -c aes-xts-plain -s 512 /dev/lvm/home /etc/luks-keys/home cryptsetup luksOpen -d /etc/luks-keys/home /dev/lvm/home home mkreiserfs /dev/mapper/home mount /dev/mapper/home /home
home /dev/lvm/home /etc/luks-keys/home
/dev/mapper/home /home reiserfs defaults 0 0
/ on lvm on luks
Make sure your kernel commandline looks like this:
root=/dev/mapper/<volume-group>-<logical-volume> cryptdevice=/dev/<luks-part>:<volume-group>
for example:
root=/dev/mapper/vg-arch cryptdevice=/dev/sda4:vg
Or like this:
cryptdevice=/dev/<volume-group>/<logical-volume>:root root=/dev/mapper/root


text:
These are special cupcakes.
I suppose all cupcakes are pretty special. These are just a little extra special because they are more than just cupcakes. They are letting you know that Baked Perfection is expanding it's family by one little boy. That's right folks, Zack and I are having a baby boy. He is expected to join our family at the end of August and we can't be more excited. So far this pregnancy has been really easy and I am hoping it stays that way. When I told my doctor I never felt sick he said "You were born to breed!" I am not so sure about that, but am very thankful for a easy pregnancy.
I apologize for my lack of posts recently. I would like to say it is because of the pregnancy, but in all honestly my day job has taken over all my time and I have barely had a chance to bake. Things should get better in April and I will get back to regular posts.
Blue Velvet "It's a Boy!" Cupcakes
recipe from Lovin From the Oven
recipe makes 24 cupcakes
1 cup of butter softened
1 1/3 cups sugar
Blue food coloring
3 eggs
2 tsp vanilla extract
2 1/2 cups all purpose flour
1 1/2 teaspoons baking powder
1/4 teaspoon baking soda
1/2 teaspoon salt
1 cup buttermilk
In a large bowl, cream together butter and sugar. Once light and fluffy add your blue food coloring. Start with a small amount and increase to reach your desired shade of blue. Blend well with butter and sugar. Add in eggs, one at a time, beating well after each addition. Add in vanilla and beat well.
Combine the flour, baking powder, baking soda and salt in a separate bowl. Add 1/3 of the dry ingredients to the batter and beat until well combined. Add in 1/2 of the butter milk, beat until combined, followed by another 1/3 of the dry, then the remaining buttermilk and finally the remaining dry ingredients. The batter may look a bit lumpy after buttermilk is first added, but beat well and it will combine nicely.
Fill paper lined muffin cups two-thirds full and bake at 350 degrees for approx 20-25 minutes or until a toothpick inserted into the center comes out clean. Watch the cupcakes closely in the last few minutes of baking so that they do not over brown. Allow to cool for ten minutes before removing from pan, then transfer to a wire rack to finish cooling.
Cream Cheese Frosting
recipe by Baked Perfection
1 stick unsalted butter, room temperature
8 ounces cream cheese, room temperature
4 cups powdered sugar
1 teaspoon pure vanilla extract
pinch of salt
Beat butter and cream cheese with until fluffy, 2 to 3 minutes. Slowly add sugar, 1 cup at a time. Add salt and vanilla; mix until smooth.