Difference between pages "Zero Configuration Networking" and "Rootfs over encrypted lvm"

From Funtoo
(Difference between pages)
Jump to: navigation, search
 
(Better-initramfs)
 
Line 1: Line 1:
Zero Configuration Networking, also called Zeroconf or [[wikipedia:Bonjour_(software)|Bonjour]] ([http://developer.apple.com/softwarelicensing/agreements/bonjour.html Apple's trademark] for their Zero Configuration Networking implementation) is a suite of related technologies that allow networked devices to interoperate on a local network without requiring explicit configuration.
+
This howto describes how to setup LVM and rootfs with cryptoLUKS-encrypted drive. It is not meant to be a standalone installation guide, rather, it is meant to be read alongside the [[Funtoo Linux Installation]] Guide.  
  
== Requirements ==
+
== Prepare the hard drive and partitions ==
 +
This is an example partition scheme, you may want to choose differently.
 +
<code>/dev/sda1</code> used as <code>/boot</code>. <code>/dev/sda2</code> will be encrypted drive with LVM.
 +
* <code>/dev/sda1</code> -- <code>/boot</code> partition.
 +
* <code>/dev/sda2</code> -- BIOS boot partition (not needed for MBR - only needed if you are using GPT) This step required for GRUB2. For more info, see: [http://www.funtoo.org/Funtoo_Linux_Installation#Prepare_Hard_Disk] for more information on GPT and MBR.
 +
* <code>/dev/sda3</code> -- <code>/</code> partition, will be the drive with LUKS and LVM.
  
Zero Configuration Networking requires the following things to operate:
+
=== Wipe the hard drive ===
 +
{{Fancywarning|This action will destroy all data on the disk.}}
 +
<console>
 +
# ##i##gdisk /dev/sda
  
* A valid IP address, obtained either by:
+
Command: ##i##x ↵
** Static assignment
+
Expert command: ##i##z ↵
** DHCP
+
About to wipe out GPT on /dev/sda. Proceed?: ##i##y ↵
** Link-local Addressing (part of Zero Configuration Networking)
+
GPT data structures destroyed! You may now partition the disk using fdisk or other utilities.
* A means to address other devices by name, provided either by:
+
Blank out MBR?: ##i##y ↵
** DNS
+
</console>
** multicast DNS (mDNS -- part of Zero Configuration Networking)
+
  
== Service Discovery ==
+
{{Fancynote| You will get a message about reaching the end of the device when the <code>dd</code> command has finished. This behavior is intended.}}
  
On top of this, Zero Configuration Networking also provides a means to discover what services are available on each device. This is something that is provided exclusively by Zero Configuration Networking and is called Zeroconf Service Discovery.
+
== Encrypting the drive ==
 +
Read more about different cipher options here: [http://blog.wpkg.org/2009/04/23/cipher-benchmark-for-dm-crypt-luks/]
 +
<console>
 +
# ##i##cryptsetup --cipher aes-xts-plain64 luksFormat /dev/sda3
 +
# ##i##cryptsetup luksOpen /dev/sda3 dmcrypt_root
 +
</console>
  
== Configuration ==
+
There you'll be prompted to enter your password phrase for encrypted drive, type your paranoid password there.
  
In order to get these sort of networking services running, some configuration needs to happen initially.
+
= Create logical volumes =
 
+
<console>
== Link-local Addresses ==
+
# ##i##pvcreate /dev/mapper/dmcrypt_root
 +
# ##i##vgcreate vg /dev/mapper/dmcrypt_root
 +
# ##i##lvcreate -L10G --name root vg         
 +
# ##i##lvcreate -L2G --name swap vg
 +
# ##i##lvcreate -L5G --name portage vg
 +
# ##i##lvcreate -l 100%FREE -nhome vg
 +
</console>
 +
Feel free to specify your desired size by altering the numbers after the -L flag. For example, to make your portage dataset 20GB's, use the flag -L20G instead of -L5G.
  
{{Fancynote|It's only necessary to use link-local addressing if you have no other means of obtaining a valid IP address on your LAN. Typically, this is the case if you are setting up a small or ad-hoc network where no DHCP server has been configured.}}
+
= Create a filesystem on volumes =
 
+
To use link-local addressing, first set up the proper routes:
+
 
<console>
 
<console>
###i## route add default dev eth0 metric 99
+
# ##i##mkfs.ext2 /dev/sda1
###i## route add -net 169.254.0.0 netmask 255.255.0.0 dev eth0 metric 99
+
# ##i##mkswap /dev/mapper/vg-swap
 +
# ##i##mkfs.ext4 /dev/mapper/vg-root
 +
# ##i##mkfs.ext4 /dev/mapper/vg-portage
 +
# ##i##mkfs.ext4 /dev/mapper/vg-home
 
</console>
 
</console>
  
Then, use avahi-autoipd to discover a valid link-local IP address:
+
= Basic system setup =
 
<console>
 
<console>
###i## /usr/sbin/avahi-autoipd --daemonize --syslog --wait eth0
+
# ##i##swapon /dev/mapper/vg-swap
 +
# ##i##mkdir /mnt/funtoo
 +
# ##i##mount /dev/mapper/vg-root /mnt/funtoo
 +
# ##i##mkdir -p /mnt/funtoo/{boot,usr/portage,home}
 +
# ##i##mount /dev/sda1 /mnt/funtoo/boot
 +
# ##i##mount /dev/mapper/vg-portage /mnt/funtoo/usr/portage
 +
# ##i##mount /dev/mapper/vg-home /mnt/funtoo/home
 
</console>
 
</console>
 +
Now perform all the steps required for basic system install, please follow [http://docs.funtoo.org/wiki/Funtoo_Linux_Installation]
 +
don't forget to emerge the following before your install is finished:
  
Once a valid link-local IP address is found, eth0 will now have a 169.254.x.x address that can be used to communicate on the local LAN.
+
* '''cryptsetup'''
 +
* '''lvm2'''
 +
* '''a bootloader (grub recommended)'''
 +
* '''kernel sources '''
  
As an alternative, you can have dhcpcd built with <code>USE="zeroconf"</code>, and it will provide a link local address if no DHCP server is found.
+
= Editing the fstab =
 +
Fire up your favorite text editor to edit <code>/etc/fstab</code>. You want to put the following in the file:
 +
{{File
 +
|/etc/fstab|<pre>
 +
# <fs>                  <mountpoint>  <type>    <opts>                          <dump/pass>
 +
/dev/sda1              /boot        ext2      noauto,noatime                  1 2
 +
/dev/mapper/vg-swap    none          swap      sw                              0 0
 +
/dev/mapper/vg-root    /            ext4      noatime,nodiratime,defaults    0 1
 +
/dev/sr0                /mnt/cdrom    auto      noauto,ro                      0 0
 +
/dev/mapper/vg-portage  /usr/portage  ext4      noatime,nodiratime              0 0
 +
/dev/mapper/vg-home    /home        ext4      noatime,nodiratime              0 0
 +
</pre>}}
  
== Multicast DNS ==
+
= Kernel options =
 +
{{Fancynote|This part is particularly important: pay close attention.}}
 +
{{kernelop
 +
| <br> |<pre>
 +
General setup --->
 +
      [*] Initial RAM filesystem and RAM disk (initramfs/initrd) support
 +
</pre>}}
  
Multicast DNS, or mDNS, is a means by which individual machines can broadcast their DNS information to machines on the local LAN so that a DNS server is not required to address local devices by name. The ".local" domain is typically used for multicast DNS, so your laptop might be addressable by pinging "mylaptop.local", for example. mDNS is not necessary if you have some other means of addressing machines by name, such as unicast (regular) DNS. But many LANs do not have their own DNS server configured, in which case mDNS can be very handy.
+
{{kernelop
 +
| <br> |<pre>
 +
Device Drivers --->
 +
      Generic Driver Options --->
 +
      [*] Maintain a devtmpfs filesystem to mount at /dev
 +
</pre>}}
  
=== .local Hostname Suffix ===
+
{{kernelop
 
+
| <br> |<pre>
If you want to configure your Funtoo Linux system to be addressable on your LAN using a <tt>myhostname.local</tt> address, first ensure that you set your system's hostname in <tt>/etc/conf.d/hostname</tt>, and use ''only'' the non-qualified name, so don't add a <tt>.local</tt> yourself. Multicast DNS will automatically use that suffix. Here is a sample <tt>/etc/conf.d/hostname</tt> for a machine on my network that I can ping from other machines as <tt>antec.local</tt>:
+
Device Drivers --->
 +
      [*] Multiple devices driver support --->
 +
      <*>Device Mapper Support
 +
        <*> Crypt target support
 +
</pre>}}
  
{{File
+
{{kernelop
|/etc/conf.d/hostname|<pre>
+
| <br> |<pre>
hostname="antec"
+
Cryptographic API --->
 +
      <*> XTS support
 +
      -*-AES cipher algorithms
 
</pre>}}
 
</pre>}}
  
== Receiving mDNS ==
+
= Initramfs setup and configuration =
 +
== Better-initramfs ==
 +
'''Build your initramfs with [https://bitbucket.org/piotrkarbowski/better-initramfs better-initramfs] project.'''
  
The ebuild "nss-mdns" provides the necessary functionality for your Funtoo/Gentoo Linux machine to receive mDNS broadcasts, so that it can do things like ping mybox.local, or ssh mylaptop.local.
+
{{Fancynote| better-initramfs supports neither dynamic modules nor udev, so you should compile your kernel with built-in support for your block devices.}}
  
From the [http://0pointer.de/lennart/projects/nss-mdns/#overview nss-mdns] home page:
+
<console>
 +
# ##i##cd /opt
 +
# ##i##git clone git://github.com/slashbeast/better-initramfs.git
 +
# ##i##cd better-initramfs
 +
# ##i##less README.rst
 +
# ##i##bootstrap/bootstrap-all
 +
# ##i##make prepare
 +
# ##i##make image
 +
</console>
  
''nss-mdns is a plugin for the GNU Name Service Switch (NSS) functionality of the GNU C Library (glibc) providing host name resolution via Multicast DNS (aka Zeroconf, aka Apple Rendezvous, aka Apple Bonjour), effectively allowing name resolution by common Unix/Linux programs in the ad-hoc mDNS domain .local.
+
Copy resulting <code>initramfs.cpio.gz</code> to <code>/boot</code>:
 +
<console># ##i##cp output/initramfs.cpio.gz /boot</console>
  
''nss-mdns provides client functionality only, which means that you have to run a mDNS responder daemon seperately from nss-mdns if you want to register the local host name via mDNS. I recommend Avahi.
+
Alternatively, a pre-compiled binary initramfs is available at https://bitbucket.org/piotrkarbowski/better-initramfs/downloads
 
+
''nss-mdns is very lightweight (9 KByte stripped binary .so compiled with -DNDEBUG=1 -Os on i386, gcc 4.0), has no dependencies besides the glibc and requires only minimal configuration.
+
 
+
''By default nss-mdns tries to contact a running avahi-daemon for resolving host names and addresses and making use of its superior record cacheing. Optionally nss-mdns can be compiled with a mini mDNS stack that can be used to resolve host names without a local Avahi installation. Both Avahi support and this mini mDNS stack are optional, however at least one of them needs to be enabled. If both are enabled a connection to Avahi is tried first, and if that fails the mini mDNS stack is used.
+
 
<console>
 
<console>
###i## emerge -av nss-mdns
+
# ##i##wget https://bitbucket.org/piotrkarbowski/better-initramfs/downloads/release-x86_64-v0.7.2.tar.bz2
 +
# ##i##tar xf release-x86_64-v0.5.tar.bz2
 +
# ##i##cd release*
 +
# ##i##gzip initramfs.cpio
 +
# ##i##cp initramfs.cpio.gz /boot
 
</console>
 
</console>
  
Set up multicast route:
+
Remember, better-initramfs project is a work in progress, so you need to update from time to time. It can be done easily with <code>git</code>. Go to the better-initramfs source dir and follow:
 
<console>
 
<console>
###i## route add -net 224.0.0.0 netmask 240.0.0.0 dev eth0
+
# ##i##cd /opt/better-initramfs
 +
# ##i##git pull
 +
# ##i##less ChangeLog
 
</console>
 
</console>
 +
{{Note}}Please read the ChangeLog carefuly and perform necessary updates to <code>/etc/boot.conf</code>. Also, please backup the working <code>/boot/initramfs.cpio.gz</code> and <code>/etc/boot.conf</code> before updating better-initramfs.
  
Note: Adding <code>multicast="yes"</code> in <code>/etc/conf.d/netif.foo</code> (replace foo with your actual network interface name) will set up the multicast route automatically at startup.
+
== Genkernel ==
 +
Funtoo's genkernel capable to create initramfs for encrypted drive. Compile and install kernel and initramfs of your favorite kernel sources:
 +
<console>
 +
# ##i##genkernel --kernel-config=/path/to/your/custom-kernel-config --no-mrproper --makeopts=-j5 --install --lvm --luks all </console>
 +
 
 +
== Bootloader Configuration ==
 +
=== Grub2 configuration ===
 +
==== better-initramfs ====
 +
An example <code>/etc/boot.conf</code> for better-initramfs:
  
Now, it's necessary to modify <tt>/etc/nsswitch.conf</tt> so that your system will use multicast DNS for hostname lookup. In the example, we use the <tt>mdns_minimal</tt> and <tt>mdns</tt> words, which enable multicast DNS for IPv4 and IPv6. If you only want to enable IPv4-based multicast DNS, which is recommended for IPv4-only networks, use <tt>mdns4_minimal</tt> and <tt>mdns4</tt> instead. This will improve hostname lookup performance.
 
 
{{File
 
{{File
|/etc/nsswitch.conf|<pre>
+
|/etc/boot.conf|<pre>
hosts:      files mdns_minimal [NOTFOUND=return] dns mdns
+
boot {
 +
  generate grub
 +
  default "Funtoo Linux"
 +
  timeout 3
 +
}
 +
"Funtoo Linux" {
 +
  kernel vmlinuz[-v]
 +
  initrd /initramfs.cpio.gz
 +
  params += enc_root=/dev/sda3 lvm luks root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
 
</pre>}}
 
</pre>}}
  
== Sending Multicast DNS ==
+
Now, run <code>boot-update</code> to write the configuration files to <code>/boot/grub/grub.cfg</code>
  
Avahi-daemon handles the task of '''sending''' multicast DNS broadcasts, as well as service discovery broadcasts, on your local LAN. If you want other devices to be able to reach your Funtoo/Gentoo Linux machine via multicast DNS, and Zeroconf Service Discovery, you'll want to enable avahi-daemon. This will also improve the efficiency of performing multicast DNS lookups locally.
+
==== genkernel ====
 +
Configure the bootloader as described above, with correct kernel and initramfs images names. An example for genkernel and grub2. You will be editing <code>/etc/boot.conf</code>:
  
 +
{{File
 +
|/etc/boot.conf|<pre>
 +
boot {
 +
  generate grub
 +
  default "Funtoo Linux"
 +
  timeout 3
 +
}
 +
"Funtoo Linux" {
 +
  kernel kernel-genkernel-x86_64-3.13.0
 +
  initrd initramfs-genkernel-x86_64-3.13.0
 +
  params += crypt_root=/dev/sda3 dolvm real_root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
 +
</pre>}}
 +
 +
== Lilo configuration ==
 +
For oldschool geeks, an example for lilo bootloader. Emerge lilo with device-mapper support
 
<console>
 
<console>
###i## rc-update add avahi-daemon default
+
# ##i##echo 'sys-boot/lilo device-mapper' >> /etc/portage/package.use/lilo
###i## rc
+
# ##i##emerge lilo
 
</console>
 
</console>
  
Test:
+
Example <code>/etc/lilo.conf</code>:
 +
 
 +
{{File
 +
|/etc/lilo.conf|<pre>
 +
append="init=/linuxrc dolvm crypt_root=/dev/sda2 real_root=/dev/mapper/vg-root"
 +
boot=/dev/sda
 +
compact
 +
default=funtoo
 +
lba32
 +
prompt
 +
read-only
 +
timeout=50
 +
image=/boot/kernel-genkernel-x86_64-3.13.0
 +
initrd=/boot/initramfs-genkernel-x86_64-3.13.0
 +
label=funtoo
 +
</pre>}}
 +
 
 +
== Syslinux bootloader setup ==
 +
Syslinux is another advanced bootloader which you can find on all live CD's. Syslinux bootloader does not require additional BIOS boot partition. /dev/sda2 is the root partition.
 
<console>
 
<console>
###i## ping daniel-pc.local
+
# ##i##emerge syslinux
PING daniel-pc.local (10.0.1.11) 56(84) bytes of data.
+
# ##i##mkdir /boot/extlinux
64 bytes from Daniel-PC.local (10.0.1.11): icmp_req=1 ttl=128 time=3.73 ms
+
# ##i##extlinux --install /boot/extlinux
64 bytes from Daniel-PC.local (10.0.1.11): icmp_req=2 ttl=128 time=0.905 ms
+
# ##i##dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/mbr.bin of=/dev/sda
64 bytes from Daniel-PC.local (10.0.1.11): icmp_req=3 ttl=128 time=0.922 ms
+
- or -
64 bytes from Daniel-PC.local (10.0.1.11): icmp_req=4 ttl=128 time=0.827 ms
+
# ##i##sgdisk /dev/sda --attributes=1:set:2
 +
# ##i##dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/gptmbr.bin of=/dev/sda, for GPT partition
 
</console>
 
</console>
  
== Service Discovery ==
+
Example <code>/boot/extlinux/extlinux.conf</code>:
  
Get a list of services on the LAN:
+
{{File
 +
|/boot/extlinux/extlinux.conf|<pre>
 +
LABEL kernel1_bzImage-3.2.1
 +
MENU LABEL Funtoo Linux bzImage-3.2.1
 +
LINUX /bzImage-3.2.1
 +
INITRD /initramfs.cpio.gz
 +
APPEND rootfstype=ext4 luks enc_root=/dev/sda2 lvm root=/dev/mapper/vg-root
 +
</pre>}}
 +
 
 +
= Final steps =
 +
Umount everything, close encrypted drive and reboot
 
<console>
 
<console>
###i## avahi-browse -ac
+
# ##i##umount -l -v /mnt/funtoo/{dev, proc, home, usr/portage, boot}
 +
# ##i##vgchange -a n
 +
# ##i##cryptsetup luksClose /dev/sda2 dmcrypt_root
 
</console>
 
</console>
 +
After reboot you will get the following:
 +
<console>
 +
>>> better-initramfs started. Kernel version 2.6.35-gentoo-r10
 +
>>> Create all the symlinks to /bin/busybox.
 +
>>> Initiating /dev/dir
 +
>>> Getting LVM volumes up (if any)
 +
Reding all physical volumes. This make take awhile...
 +
No volume group found
 +
No volume group found
 +
>>> Opening encrypted partition and mapping to /dev/mapper/dmcrypt_root
 +
Enter passphrase fore /dev/sda2:
 +
</console>
 +
Type your password
  
== Resources ==
+
<console>
 +
>>> Again, getting LVM volumes up (if any, after map dmcrypt).
 +
  Reading all physical volumes.  This may take a while...
 +
  Found volume group "vg" using metadata type lvm2
 +
  4 logical volume(s) in volume group "vg" now active
 +
>>> Mounting rootfs to /newroot
 +
>>> Umounting /sys and /proc.
 +
>>> Switching root to /newroot and executing /sbin/init.
 +
INIT: version 2.88 booting
 +
Loading /libexec/rc/console/keymap
 +
  OpenRC 0.6.1 is starting up Funtoo Linux (x86_64)
 +
...boot messages omitted for clarity
 +
 
 +
orion login: oleg
 +
Password:
 +
Last login: Thu Oct 14 20:49:21 EEST 2010 on tty1
 +
oleg@orion ~ %
 +
</console>
  
* [http://developer.apple.com/library/mac/#qa/qa2004/qa1357.html Apple Technical Q&A QA1357]
+
= Additional links and information =
* [http://en.gentoo-wiki.com/wiki/Avahi Gentoo Wiki Avahi]
+
* [[gentoo-wiki:Root filesystem over LVM2, DM-Crypt and RAID|Root filesystem over LVM2, DM-Crypt, and RAID]]
* [http://www.ibiblio.org/pub/linux/docs/HOWTO/other-formats/html_single/Multicast-HOWTO.html#toc2 Multicast over TCP/IP HOWTO]
+
* [http://wiki.archlinux.org/index.php/System_Encryption_with_LUKS_for_dm-crypt System Encryption with LUKS for dm-crypt]
* [http://sitka.triumf.ca/pub/linux/multicast-FAQ Linux Multicast FAQ]
+
* [http://en.wikipedia.org/wiki/Logical_volume_management Wikipedia article on LVM]
* [http://www.multicastdns.org/ multicastdns.org]
+
* [https://wiki.archlinux.org/index.php/Dm-crypt_with_LUKS Arch Wiki article]
  
 
 
[[Category:HOWTO]]
 
[[Category:HOWTO]]
[[Category:Networking]]
 

Revision as of 21:34, 28 January 2014

This howto describes how to setup LVM and rootfs with cryptoLUKS-encrypted drive. It is not meant to be a standalone installation guide, rather, it is meant to be read alongside the Funtoo Linux Installation Guide.

Contents

Prepare the hard drive and partitions

This is an example partition scheme, you may want to choose differently. /dev/sda1 used as /boot. /dev/sda2 will be encrypted drive with LVM.

  • /dev/sda1 -- /boot partition.
  • /dev/sda2 -- BIOS boot partition (not needed for MBR - only needed if you are using GPT) This step required for GRUB2. For more info, see: [1] for more information on GPT and MBR.
  • /dev/sda3 -- / partition, will be the drive with LUKS and LVM.

Wipe the hard drive

Warning: This action will destroy all data on the disk.
# gdisk /dev/sda

Command: x ↵
Expert command: z ↵
About to wipe out GPT on /dev/sda. Proceed?: y ↵
GPT data structures destroyed! You may now partition the disk using fdisk or other utilities.
Blank out MBR?: y ↵
Note: You will get a message about reaching the end of the device when the dd command has finished. This behavior is intended.

Encrypting the drive

Read more about different cipher options here: [2]

# cryptsetup --cipher aes-xts-plain64 luksFormat /dev/sda3
# cryptsetup luksOpen /dev/sda3 dmcrypt_root

There you'll be prompted to enter your password phrase for encrypted drive, type your paranoid password there.

Create logical volumes

# pvcreate /dev/mapper/dmcrypt_root
# vgcreate vg /dev/mapper/dmcrypt_root
# lvcreate -L10G --name root vg           
# lvcreate -L2G --name swap vg
# lvcreate -L5G --name portage vg
# lvcreate -l 100%FREE -nhome vg

Feel free to specify your desired size by altering the numbers after the -L flag. For example, to make your portage dataset 20GB's, use the flag -L20G instead of -L5G.

Create a filesystem on volumes

# mkfs.ext2 /dev/sda1
# mkswap /dev/mapper/vg-swap
# mkfs.ext4 /dev/mapper/vg-root
# mkfs.ext4 /dev/mapper/vg-portage
# mkfs.ext4 /dev/mapper/vg-home

Basic system setup

# swapon /dev/mapper/vg-swap
# mkdir /mnt/funtoo
# mount /dev/mapper/vg-root /mnt/funtoo
# mkdir -p /mnt/funtoo/{boot,usr/portage,home}
# mount /dev/sda1 /mnt/funtoo/boot
# mount /dev/mapper/vg-portage /mnt/funtoo/usr/portage
# mount /dev/mapper/vg-home /mnt/funtoo/home

Now perform all the steps required for basic system install, please follow [3] don't forget to emerge the following before your install is finished:

  • cryptsetup
  • lvm2
  • a bootloader (grub recommended)
  • kernel sources

Editing the fstab

Fire up your favorite text editor to edit /etc/fstab. You want to put the following in the file:

# <fs>                  <mountpoint>  <type>    <opts>                          <dump/pass>
/dev/sda1               /boot         ext2      noauto,noatime                  1 2
/dev/mapper/vg-swap     none          swap      sw                              0 0
/dev/mapper/vg-root     /             ext4      noatime,nodiratime,defaults     0 1
/dev/sr0                /mnt/cdrom    auto      noauto,ro                       0 0
/dev/mapper/vg-portage  /usr/portage  ext4      noatime,nodiratime              0 0
/dev/mapper/vg-home     /home         ext4      noatime,nodiratime              0 0

Kernel options

Note: This part is particularly important: pay close attention.







Initramfs setup and configuration

Better-initramfs

Build your initramfs with better-initramfs project.

Note: better-initramfs supports neither dynamic modules nor udev, so you should compile your kernel with built-in support for your block devices.
# cd /opt
# git clone git://github.com/slashbeast/better-initramfs.git
# cd better-initramfs
# less README.rst
# bootstrap/bootstrap-all
# make prepare
# make image

Copy resulting initramfs.cpio.gz to /boot:

# cp output/initramfs.cpio.gz /boot

Alternatively, a pre-compiled binary initramfs is available at https://bitbucket.org/piotrkarbowski/better-initramfs/downloads

# wget https://bitbucket.org/piotrkarbowski/better-initramfs/downloads/release-x86_64-v0.7.2.tar.bz2
# tar xf release-x86_64-v0.5.tar.bz2
# cd release*
# gzip initramfs.cpio
# cp initramfs.cpio.gz /boot

Remember, better-initramfs project is a work in progress, so you need to update from time to time. It can be done easily with git. Go to the better-initramfs source dir and follow:

# cd /opt/better-initramfs
# git pull
# less ChangeLog

Note Note: Please read the ChangeLog carefuly and perform necessary updates to /etc/boot.conf. Also, please backup the working /boot/initramfs.cpio.gz and /etc/boot.conf before updating better-initramfs.

Genkernel

Funtoo's genkernel capable to create initramfs for encrypted drive. Compile and install kernel and initramfs of your favorite kernel sources:

# genkernel --kernel-config=/path/to/your/custom-kernel-config --no-mrproper --makeopts=-j5 --install --lvm --luks all 

Bootloader Configuration

Grub2 configuration

better-initramfs

An example /etc/boot.conf for better-initramfs:

boot {
  generate grub
  default "Funtoo Linux"
  timeout 3
}
"Funtoo Linux" {
  kernel vmlinuz[-v]
  initrd /initramfs.cpio.gz
  params += enc_root=/dev/sda3 lvm luks root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet

Now, run boot-update to write the configuration files to /boot/grub/grub.cfg

genkernel

Configure the bootloader as described above, with correct kernel and initramfs images names. An example for genkernel and grub2. You will be editing /etc/boot.conf:

boot {
  generate grub
  default "Funtoo Linux"
  timeout 3
}
"Funtoo Linux" {
  kernel kernel-genkernel-x86_64-3.13.0
  initrd initramfs-genkernel-x86_64-3.13.0
  params += crypt_root=/dev/sda3 dolvm real_root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet

Lilo configuration

For oldschool geeks, an example for lilo bootloader. Emerge lilo with device-mapper support

# echo 'sys-boot/lilo device-mapper' >> /etc/portage/package.use/lilo
# emerge lilo

Example /etc/lilo.conf:

append="init=/linuxrc dolvm crypt_root=/dev/sda2 real_root=/dev/mapper/vg-root"
boot=/dev/sda
compact
default=funtoo
lba32
prompt
read-only
timeout=50
image=/boot/kernel-genkernel-x86_64-3.13.0
initrd=/boot/initramfs-genkernel-x86_64-3.13.0
label=funtoo

Syslinux bootloader setup

Syslinux is another advanced bootloader which you can find on all live CD's. Syslinux bootloader does not require additional BIOS boot partition. /dev/sda2 is the root partition.

# emerge syslinux
# mkdir /boot/extlinux
# extlinux --install /boot/extlinux
# dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/mbr.bin of=/dev/sda
- or -
# sgdisk /dev/sda --attributes=1:set:2
# dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/gptmbr.bin of=/dev/sda, for GPT partition

Example /boot/extlinux/extlinux.conf:

LABEL kernel1_bzImage-3.2.1
MENU LABEL Funtoo Linux bzImage-3.2.1
LINUX /bzImage-3.2.1
INITRD /initramfs.cpio.gz
APPEND rootfstype=ext4 luks enc_root=/dev/sda2 lvm root=/dev/mapper/vg-root

Final steps

Umount everything, close encrypted drive and reboot

# umount -l -v /mnt/funtoo/{dev, proc, home, usr/portage, boot} 
# vgchange -a n
# cryptsetup luksClose /dev/sda2 dmcrypt_root

After reboot you will get the following:

>>> better-initramfs started. Kernel version 2.6.35-gentoo-r10
>>> Create all the symlinks to /bin/busybox.
>>> Initiating /dev/dir
>>> Getting LVM volumes up (if any)
Reding all physical volumes. This make take awhile...
No volume group found
No volume group found
>>> Opening encrypted partition and mapping to /dev/mapper/dmcrypt_root
Enter passphrase fore /dev/sda2:

Type your password

>>> Again, getting LVM volumes up (if any, after map dmcrypt).
  Reading all physical volumes.  This may take a while...
  Found volume group "vg" using metadata type lvm2
  4 logical volume(s) in volume group "vg" now active
>>> Mounting rootfs to /newroot
>>> Umounting /sys and /proc.
>>> Switching root to /newroot and executing /sbin/init.
INIT: version 2.88 booting
Loading /libexec/rc/console/keymap
  OpenRC 0.6.1 is starting up Funtoo Linux (x86_64)
...boot messages omitted for clarity
   
orion login: oleg
Password:
Last login: Thu Oct 14 20:49:21 EEST 2010 on tty1
oleg@orion ~ %

Additional links and information