Difference between pages "Rootfs over encrypted lvm" and "Template:Fancynote/Doc"

From Funtoo
(Difference between pages)
Jump to: navigation, search
(Better-initramfs)
 
(Created page with "== Example and Usage == Example: <pre> {{Fancynote| Note }} </pre> Will produce: {{Fancynote| Note }} == See also == * Template:Fancywarning * Template:Fancytip * ...")
 
Line 1: Line 1:
This howto describes how to setup LVM and rootfs with cryptoLUKS-encrypted drive. It is not meant to be a standalone installation guide, rather, it is meant to be read alongside the [[Funtoo Linux Installation]] Guide.
+
== Example and Usage ==
 +
Example:
 +
<pre>
 +
{{Fancynote| Note }}
 +
</pre>
  
== Prepare the hard drive and partitions ==
+
Will produce:
This is an example partition scheme, you may want to choose differently.
+
{{Fancynote| Note }}
<code>/dev/sda1</code> used as <code>/boot</code>. <code>/dev/sda2</code> will be encrypted drive with LVM.
+
* <code>/dev/sda1</code> -- <code>/boot</code> partition.
+
* <code>/dev/sda2</code> -- BIOS boot partition (not needed for MBR - only needed if you are using GPT) This step required for GRUB2. For more info, see: [http://www.funtoo.org/Funtoo_Linux_Installation#Prepare_Hard_Disk] for more information on GPT and MBR.
+
* <code>/dev/sda3</code> -- <code>/</code> partition, will be the drive with LUKS and LVM.
+
  
=== Wipe the hard drive ===
+
== See also ==
{{Fancywarning|This action will destroy all data on the disk.}}
+
* [[Template:Fancywarning]]
<console>
+
* [[Template:Fancytip]]
# ##i##gdisk /dev/sda
+
* [[Template:Fancyimportant]]
  
Command: ##i##x ↵
+
<noinclude>[[Category:Template Documentation]]</noinclude>
Expert command: ##i##z ↵
+
About to wipe out GPT on /dev/sda. Proceed?: ##i##y ↵
+
GPT data structures destroyed! You may now partition the disk using fdisk or other utilities.
+
Blank out MBR?: ##i##y ↵
+
</console>
+
 
+
{{Fancynote| You will get a message about reaching the end of the device when the <code>dd</code> command has finished. This behavior is intended.}}
+
 
+
== Encrypting the drive ==
+
Read more about different cipher options here: [http://blog.wpkg.org/2009/04/23/cipher-benchmark-for-dm-crypt-luks/]
+
<console>
+
# ##i##cryptsetup --cipher aes-xts-plain64 luksFormat /dev/sda3
+
# ##i##cryptsetup luksOpen /dev/sda3 dmcrypt_root
+
</console>
+
 
+
There you'll be prompted to enter your password phrase for encrypted drive, type your paranoid password there.
+
 
+
= Create logical volumes =
+
<console>
+
# ##i##pvcreate /dev/mapper/dmcrypt_root
+
# ##i##vgcreate vg /dev/mapper/dmcrypt_root
+
# ##i##lvcreate -L10G --name root vg         
+
# ##i##lvcreate -L2G --name swap vg
+
# ##i##lvcreate -L5G --name portage vg
+
# ##i##lvcreate -l 100%FREE -nhome vg
+
</console>
+
Feel free to specify your desired size by altering the numbers after the -L flag. For example, to make your portage dataset 20GB's, use the flag -L20G instead of -L5G.
+
 
+
= Create a filesystem on volumes =
+
<console>
+
# ##i##mkfs.ext2 /dev/sda1
+
# ##i##mkswap /dev/mapper/vg-swap
+
# ##i##mkfs.ext4 /dev/mapper/vg-root
+
# ##i##mkfs.ext4 /dev/mapper/vg-portage
+
# ##i##mkfs.ext4 /dev/mapper/vg-home
+
</console>
+
 
+
= Basic system setup =
+
<console>
+
# ##i##swapon /dev/mapper/vg-swap
+
# ##i##mkdir /mnt/funtoo
+
# ##i##mount /dev/mapper/vg-root /mnt/funtoo
+
# ##i##mkdir -p /mnt/funtoo/{boot,usr/portage,home}
+
# ##i##mount /dev/sda1 /mnt/funtoo/boot
+
# ##i##mount /dev/mapper/vg-portage /mnt/funtoo/usr/portage
+
# ##i##mount /dev/mapper/vg-home /mnt/funtoo/home
+
</console>
+
Now perform all the steps required for basic system install, please follow [http://docs.funtoo.org/wiki/Funtoo_Linux_Installation]
+
don't forget to emerge the following before your install is finished:
+
 
+
* '''cryptsetup'''
+
* '''lvm2'''
+
* '''a bootloader (grub recommended)'''
+
* '''kernel sources '''
+
 
+
= Editing the fstab =
+
Fire up your favorite text editor to edit <code>/etc/fstab</code>. You want to put the following in the file:
+
{{File
+
|/etc/fstab|<pre>
+
# <fs>                  <mountpoint>  <type>    <opts>                          <dump/pass>
+
/dev/sda1              /boot        ext2      noauto,noatime                  1 2
+
/dev/mapper/vg-swap    none          swap      sw                              0 0
+
/dev/mapper/vg-root    /            ext4      noatime,nodiratime,defaults    0 1
+
/dev/sr0                /mnt/cdrom    auto      noauto,ro                      0 0
+
/dev/mapper/vg-portage  /usr/portage  ext4      noatime,nodiratime              0 0
+
/dev/mapper/vg-home    /home        ext4      noatime,nodiratime              0 0
+
</pre>}}
+
 
+
= Kernel options =
+
{{Fancynote|This part is particularly important: pay close attention.}}
+
{{kernelop
+
| <br> |<pre>
+
General setup --->
+
      [*] Initial RAM filesystem and RAM disk (initramfs/initrd) support
+
</pre>}}
+
 
+
{{kernelop
+
| <br> |<pre>
+
Device Drivers --->
+
      Generic Driver Options --->
+
      [*] Maintain a devtmpfs filesystem to mount at /dev
+
</pre>}}
+
 
+
{{kernelop
+
| <br> |<pre>
+
Device Drivers --->
+
      [*] Multiple devices driver support --->
+
      <*>Device Mapper Support
+
        <*> Crypt target support
+
</pre>}}
+
 
+
{{kernelop
+
| <br> |<pre>
+
Cryptographic API --->
+
      <*> XTS support
+
      -*-AES cipher algorithms
+
</pre>}}
+
 
+
= Initramfs setup and configuration =
+
== Better-initramfs ==
+
'''Build your initramfs with [https://bitbucket.org/piotrkarbowski/better-initramfs better-initramfs] project.'''
+
 
+
{{Fancynote| better-initramfs supports neither dynamic modules nor udev, so you should compile your kernel with built-in support for your block devices and file system support}}
+
 
+
<console>
+
# ##i##cd /opt
+
# ##i##git clone git://github.com/slashbeast/better-initramfs.git
+
# ##i##cd better-initramfs
+
# ##i##less README.rst
+
# ##i##bootstrap/bootstrap-all
+
# ##i##make prepare
+
# ##i##make image
+
</console>
+
 
+
Copy resulting <code>initramfs.cpio.gz</code> to <code>/boot</code>:
+
<console># ##i##cp output/initramfs.cpio.gz /boot</console>
+
 
+
Alternatively, a pre-compiled binary initramfs is available at https://bitbucket.org/piotrkarbowski/better-initramfs/downloads
+
<console>
+
# ##i##wget https://bitbucket.org/piotrkarbowski/better-initramfs/downloads/release-x86_64-v0.7.2.tar.bz2
+
# ##i##tar xf release-x86_64-v0.5.tar.bz2
+
# ##i##cd release*
+
# ##i##gzip initramfs.cpio
+
# ##i##cp initramfs.cpio.gz /boot
+
</console>
+
 
+
Remember, better-initramfs project is a work in progress, so you need to update from time to time. It can be done easily with <code>git</code>. Go to the better-initramfs source dir and follow:
+
<console>
+
# ##i##cd /opt/better-initramfs
+
# ##i##git pull
+
# ##i##less ChangeLog
+
</console>
+
{{Fancynote| Please read the ChangeLog carefuly and perform necessary updates to <code>/etc/boot.conf</code>. Also, please backup the working <code>/boot/initramfs.cpio.gz</code> and <code>/etc/boot.conf</code> before updating better-initramfs.}}
+
 
+
== Genkernel ==
+
Funtoo's genkernel capable to create initramfs for encrypted drive. Compile and install kernel and initramfs of your favorite kernel sources:
+
<console>
+
# ##i##genkernel --kernel-config=/path/to/your/custom-kernel-config --no-mrproper --makeopts=-j5 --install --lvm --luks all </console>
+
 
+
== Bootloader Configuration ==
+
=== Grub2 configuration ===
+
==== better-initramfs ====
+
An example <code>/etc/boot.conf</code> for better-initramfs:
+
 
+
{{File
+
|/etc/boot.conf|<pre>
+
boot {
+
  generate grub
+
  default "Funtoo Linux"
+
  timeout 3
+
}
+
"Funtoo Linux" {
+
  kernel vmlinuz[-v]
+
  initrd /initramfs.cpio.gz
+
  params += enc_root=/dev/sda3 lvm luks root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
+
</pre>}}
+
 
+
Now, run <code>boot-update</code> to write the configuration files to <code>/boot/grub/grub.cfg</code>
+
 
+
==== genkernel ====
+
Configure the bootloader as described above, with correct kernel and initramfs images names. An example for genkernel and grub2. You will be editing <code>/etc/boot.conf</code>:
+
 
+
{{File
+
|/etc/boot.conf|<pre>
+
boot {
+
  generate grub
+
  default "Funtoo Linux"
+
  timeout 3
+
}
+
"Funtoo Linux" {
+
  kernel kernel-genkernel-x86_64-3.13.0
+
  initrd initramfs-genkernel-x86_64-3.13.0
+
  params += crypt_root=/dev/sda3 dolvm real_root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
+
</pre>}}
+
 
+
== Lilo configuration ==
+
For oldschool geeks, an example for lilo bootloader. Emerge lilo with device-mapper support
+
<console>
+
# ##i##echo 'sys-boot/lilo device-mapper' >> /etc/portage/package.use/lilo
+
# ##i##emerge lilo
+
</console>
+
 
+
Example <code>/etc/lilo.conf</code>:
+
 
+
{{File
+
|/etc/lilo.conf|<pre>
+
append="init=/linuxrc dolvm crypt_root=/dev/sda2 real_root=/dev/mapper/vg-root"
+
boot=/dev/sda
+
compact
+
default=funtoo
+
lba32
+
prompt
+
read-only
+
timeout=50
+
image=/boot/kernel-genkernel-x86_64-3.13.0
+
initrd=/boot/initramfs-genkernel-x86_64-3.13.0
+
label=funtoo
+
</pre>}}
+
 
+
== Syslinux bootloader setup ==
+
Syslinux is another advanced bootloader which you can find on all live CD's. Syslinux bootloader does not require additional BIOS boot partition. /dev/sda2 is the root partition.
+
<console>
+
# ##i##emerge syslinux
+
# ##i##mkdir /boot/extlinux
+
# ##i##extlinux --install /boot/extlinux
+
# ##i##dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/mbr.bin of=/dev/sda
+
- or -
+
# ##i##sgdisk /dev/sda --attributes=1:set:2
+
# ##i##dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/gptmbr.bin of=/dev/sda, for GPT partition
+
</console>
+
 
+
Example <code>/boot/extlinux/extlinux.conf</code>:
+
 
+
{{File
+
|/boot/extlinux/extlinux.conf|<pre>
+
LABEL kernel1_bzImage-3.2.1
+
MENU LABEL Funtoo Linux bzImage-3.2.1
+
LINUX /bzImage-3.2.1
+
INITRD /initramfs.cpio.gz
+
APPEND rootfstype=ext4 luks enc_root=/dev/sda2 lvm root=/dev/mapper/vg-root
+
</pre>}}
+
 
+
= Final steps =
+
Umount everything, close encrypted drive and reboot
+
<console>
+
# ##i##umount -l -v /mnt/funtoo/{dev, proc, home, usr/portage, boot}
+
# ##i##vgchange -a n
+
# ##i##cryptsetup luksClose /dev/sda2 dmcrypt_root
+
</console>
+
After reboot you will get the following:
+
<console>
+
>>> better-initramfs started. Kernel version 2.6.35-gentoo-r10
+
>>> Create all the symlinks to /bin/busybox.
+
>>> Initiating /dev/dir
+
>>> Getting LVM volumes up (if any)
+
Reding all physical volumes. This make take awhile...
+
No volume group found
+
No volume group found
+
>>> Opening encrypted partition and mapping to /dev/mapper/dmcrypt_root
+
Enter passphrase fore /dev/sda2:
+
</console>
+
Type your password
+
 
+
<console>
+
>>> Again, getting LVM volumes up (if any, after map dmcrypt).
+
  Reading all physical volumes.  This may take a while...
+
  Found volume group "vg" using metadata type lvm2
+
  4 logical volume(s) in volume group "vg" now active
+
>>> Mounting rootfs to /newroot
+
>>> Umounting /sys and /proc.
+
>>> Switching root to /newroot and executing /sbin/init.
+
INIT: version 2.88 booting
+
Loading /libexec/rc/console/keymap
+
  OpenRC 0.6.1 is starting up Funtoo Linux (x86_64)
+
...boot messages omitted for clarity
+
 
+
orion login: oleg
+
Password:
+
Last login: Thu Oct 14 20:49:21 EEST 2010 on tty1
+
oleg@orion ~ %
+
</console>
+
 
+
= Additional links and information =
+
* [[gentoo-wiki:Root filesystem over LVM2, DM-Crypt and RAID|Root filesystem over LVM2, DM-Crypt, and RAID]]
+
* [http://wiki.archlinux.org/index.php/System_Encryption_with_LUKS_for_dm-crypt System Encryption with LUKS for dm-crypt]
+
* [http://en.wikipedia.org/wiki/Logical_volume_management Wikipedia article on LVM]
+
* [https://wiki.archlinux.org/index.php/Dm-crypt_with_LUKS Arch Wiki article]
+
 
+
[[Category:HOWTO]]
+

Latest revision as of 22:47, 28 January 2014

Example and Usage

Example:

{{Fancynote| Note }}

Will produce:

Note: Note

See also