Difference between revisions of "Rootfs over encrypted lvm"
(→Initramfs setup and configuration) |
(+raid-1 on GPT) |
||
| Line 151: | Line 151: | ||
Last login: Thu Oct 14 20:49:21 EEST 2010 on tty1 | Last login: Thu Oct 14 20:49:21 EEST 2010 on tty1 | ||
oleg@orion ~ %</pre> | oleg@orion ~ %</pre> | ||
| + | |||
| + | = Rootfs over encrypted lvm over raid-1 on GPT = | ||
| + | |||
| + | How to prepare the hard disk for GPT read [http://www.funtoo.org/en/funtoo/core/partition/ Funtoo GPT Partition and GRUB Boot Guide] | ||
| + | For example, installing a new system on /dev/sdb Be careful ;) I warned you! | ||
| + | |||
| + | <pre>[root@localhost ~]# gdisk -l /dev/sdb | ||
| + | GPT fdisk (gdisk) version 0.6.13 | ||
| + | |||
| + | Partition table scan: | ||
| + | MBR: protective | ||
| + | BSD: not present | ||
| + | APM: not present | ||
| + | GPT: present | ||
| + | |||
| + | Found valid GPT with protective MBR; using GPT. | ||
| + | Disk /dev/sdb: 625142448 sectors, 298.1 GiB | ||
| + | Logical sector size: 512 bytes | ||
| + | Disk identifier (GUID): 67AC0F92-E033-4B53-B6C5-D99DD8F49D90 | ||
| + | Partition table holds up to 128 entries | ||
| + | First usable sector is 34, last usable sector is 625142414 | ||
| + | Partitions will be aligned on 2048-sector boundaries | ||
| + | Total free space is 3038 sectors (1.5 MiB) | ||
| + | |||
| + | Number Start (sector) End (sector) Size Code Name | ||
| + | 1 2048 206847 100.0 MiB 0700 Linux/Windows data | ||
| + | 2 206848 207871 512.0 KiB EF02 BIOS boot partition | ||
| + | 3 208896 625142414 298.0 GiB FD00 Linux RAID | ||
| + | </pre> | ||
| + | |||
| + | If you plan to use a raid-1 for installing only one partichion (/dev/sdb3 in example) and, if successful, add to the mirror more so make | ||
| + | |||
| + | <pre>mdadm --create /dev/md0 --level=1 --raid-devices=2 missing /dev/sdb3</pre> | ||
| + | |||
| + | Or | ||
| + | |||
| + | <pre>mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sda3 /dev/sdb3</pre> | ||
| + | |||
| + | |||
| + | Encrypting the raid-1 | ||
| + | |||
| + | <pre>cryptsetup -c aes-xts-plain luksFormat /dev/md0 | ||
| + | cryptsetup luksOpen /dev/md0 dmcrypt_root</pre> | ||
| + | |||
| + | Further, all the same… The differences begin with the "Initramfs setup and configuration" | ||
| + | |||
| + | To activate the raid-1 during boot to perform: | ||
| + | <pre> echo "Activating RAID device." | ||
| + | if [ ! -e '/etc/mdadm.conf' ] | ||
| + | then | ||
| + | echo "DEVICE /dev/sda[0-9] /dev/sdb[0-9] /dev/md[0-9]" > /etc/mdadm.conf | ||
| + | mdadm --examine --scan --config=/etc/mdadm.conf >> /etc/mdadm.conf | ||
| + | mdadm --assemble --scan | ||
| + | fi</pre> | ||
| + | |||
| + | Use [http://github.com/init6/initramfs better-initramfs fork with raid-1 mdadm support] | ||
| + | <pre>git clone git://github.com/init6/initramfs.git</pre> | ||
| + | |||
| + | Grub2 configuration Importantly do not forget <pre>enc_root=/dev/md0</pre> | ||
| + | |||
= Additional links = | = Additional links = | ||
* [[gentoo-wiki:Root filesystem over LVM2, DM-Crypt and RAID|Root filesystem over LVM2, DM-Crypt, and RAID]] | * [[gentoo-wiki:Root filesystem over LVM2, DM-Crypt and RAID|Root filesystem over LVM2, DM-Crypt, and RAID]] | ||
* [http://wiki.archlinux.org/index.php/System_Encryption_with_LUKS_for_dm-crypt System Encryption with LUKS for dm-crypt] | * [http://wiki.archlinux.org/index.php/System_Encryption_with_LUKS_for_dm-crypt System Encryption with LUKS for dm-crypt] | ||
| + | * [http://en.gentoo-wiki.com/wiki/RAID/Software RAID/Software] | ||
| + | * [http://www.gentoo.org/doc/en/gentoo-x86+raid+lvm2-quickinstall.xml Gentoo Linux x86 with Software Raid and LVM2 Quick Install Guide] | ||
[[Category:HOWTO]] | [[Category:HOWTO]] | ||
Revision as of 19:02, 19 November 2010
This howto describes how to setup LVM and rootfs with cryptoLUKS-encrypted drive
Contents |
Prepare the hard drive and partitions
This is an example partition scheme, you may want to choose differently.
/dev/sda1 used as /boot. /dev/sda2 will be encrypted drive with LVM.
/dev/sda1 /dev/sda2 dd if=/dev/zero of=/dev/sda2 bs=100M dd if=/dev/urandom of=/dev/sda2 bs=100M
dd part is optional, only for security reason by overwriting the lingering data on the device with random data. It takes around 6 hours to complete for 200GB drive.
Note that you will get a message about reaching the end of the device. That's intentional and desired in this case so that this command works without knowing the size of your device.
Encrypting the drive
there you'll be prompted to enter your password phrase for encrypted drive, type your paranoid password there.
Create logical volumes
pvcreate /dev/mapper/dmcrypt_root vgcreate vg /dev/mapper/dmcrypt_root lvcreate -L10G -nroot vg lvcreate -L2G -nswap vg lvcreate -L5G -nportage vg lvcreate -l 100%FREE -nhome vg
Feel free to specify your desired size
Create a filesystem on volumes
mkfs.ext2 /dev/sda1 mkswap /dev/mapper/vg-swap mkfs.ext4 /dev/mapper/vg-root mkreiserfs /dev/mapper/vg-portage mkfs.xfs /dev/mapper/vg-home
Basic system setup
mkfs.ext2 /dev/sda1 mkswap /dev/mapper/vg-swap mkfs.ext4 /dev/mapper/vg-root mkreiserfs /dev/mapper/vg-portage mkfs.xfs /dev/mapper/vg-home swapon /dev/mapper/vg-swap mount /dev/maper/vg-root /mnt/gentoo mkdir /mnt/gentoo/boot mount /dev/sda1 /mnt/gentoo/boot
Now perform all the steps required for basic system install, please follow [1] don't forget to emerge next packages:
# emerge cryptsetup lvm2 grub foo-sources
Re-emerge busybox with "static" USE flag
Kernel options
Important, do not miss this part. Under General setup --->
[*] Initial RAM filesystem and RAM disk (initramfs/initrd) support
Under Device Drivers --->
[*] Multiple devices driver support <*>Device Mapper Support <*> Crypt target support
Under Cryptographic API --->
-*-AES cipher algorithms <*> XTS supprot (EXPERIMENTAL)
Initramfs setup and configuration
Build your initramfs with better-initramfs project.
# git clone git://github.com/slashbeast/better-initramfs.git # cd better-initramfs # less README.rst # make >>> New better-initramfs is not backward compatible, read ChangeLog file. >>> Preparing binary files... >>> Adding /bin/busybox... >>> Adding /sbin/cryptsetup... >>> Adding /sbin/lvm.static... >>> Building image... >>> initramfs.cpio.gz is ready.
Copy resulting initramfs.cpio.gz to /boot.
Remember, better-initramfs project is a work in progress, so you need to update from time to time. It can be done easily with git. Go to the better-initramfs source dir and follow:
# git pull # less ChangeLog # make
Please, read the ChangeLog carefuly and do necessary updates, to /etc/boot.conf, the example config below. Please, backup working initramfs.cpio.gz and /etc/boot.conf before updating initramfs.
Grub2 configuration
An example of /etc/boot.conf, which reflects partition setup
| Code: /etc/boot.conf |
boot {
generate grub
default "Funtoo Linux"
timeout 3
}
"Funtoo Linux" {
kernel bzImage[-v]
initrd /initramfs.cpio.gz
params += enc_root=/dev/sda2 lvm luks root=/dev/mapper/vg-root rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
}
|
| Code: /etc/fstab |
# <fs> <mountpoint> <type> <opts> <dump/pass> /dev/sda1 /boot ext2 noauto,noatime 1 2 /dev/mapper/vg-swap none swap sw 0 0 /dev/mapper/vg-root / ext4 noatime,nodiratime,defaults 0 1 /dev/sr0 /mnt/cdrom auto noauto,ro 0 0 /dev/mapper/vg-portage /usr/portage reiserfs noatime,nodiratime 0 0 /dev/mapper/vg-home /home xfs noatime,nodiratime,osyncisdsync 0 0 |
Final steps
Umount everything, close encrypted drive and reboot
umount /mnt/gentoo/proc (/dev, /home, /usr/portage, /boot) cryptsetup luksClose /dev/sda2 dmcrypt_root
After reboot you will get the following:
>>> better-initramfs started. Kernel version 2.6.35-gentoo-r10 >>> Create all the symlinks to /bin/busybox. >>> Initiating /dev/dir >>> Getting LVM volumes up (if any) Reding all physical volumes. This make take awhile... No volume group found No volume group found >>> Opening encrypted partition and mapping to /dev/mapper/dmcrypt_root Enter passphrase fore /dev/sda2:
Type you password
>>> Again, getting LVM volumes up (if any, after map dmcrypt). Reading all physical volumes. This may take a while... Found volume group "vg" using metadata type lvm2 4 logical volume(s) in volume group "vg" now active >>> Mounting rootfs to /newroot >>> Umounting /sys and /proc. >>> Switching root to /newroot and executing /sbin/init. INIT: version 2.88 booting Loading /libexec/rc/console/keymap OpenRC 0.6.1 is starting up Funtoo Linux (x86_64) ...boot messages omitted for clarity orion login: oleg Password: Last login: Thu Oct 14 20:49:21 EEST 2010 on tty1 oleg@orion ~ %
Rootfs over encrypted lvm over raid-1 on GPT
How to prepare the hard disk for GPT read Funtoo GPT Partition and GRUB Boot Guide For example, installing a new system on /dev/sdb Be careful ;) I warned you!
[root@localhost ~]# gdisk -l /dev/sdb GPT fdisk (gdisk) version 0.6.13 Partition table scan: MBR: protective BSD: not present APM: not present GPT: present Found valid GPT with protective MBR; using GPT. Disk /dev/sdb: 625142448 sectors, 298.1 GiB Logical sector size: 512 bytes Disk identifier (GUID): 67AC0F92-E033-4B53-B6C5-D99DD8F49D90 Partition table holds up to 128 entries First usable sector is 34, last usable sector is 625142414 Partitions will be aligned on 2048-sector boundaries Total free space is 3038 sectors (1.5 MiB) Number Start (sector) End (sector) Size Code Name 1 2048 206847 100.0 MiB 0700 Linux/Windows data 2 206848 207871 512.0 KiB EF02 BIOS boot partition 3 208896 625142414 298.0 GiB FD00 Linux RAID
If you plan to use a raid-1 for installing only one partichion (/dev/sdb3 in example) and, if successful, add to the mirror more so make
mdadm --create /dev/md0 --level=1 --raid-devices=2 missing /dev/sdb3
Or
mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sda3 /dev/sdb3
Encrypting the raid-1
cryptsetup -c aes-xts-plain luksFormat /dev/md0 cryptsetup luksOpen /dev/md0 dmcrypt_root
Further, all the same… The differences begin with the "Initramfs setup and configuration"
To activate the raid-1 during boot to perform:
echo "Activating RAID device." if [ ! -e '/etc/mdadm.conf' ] then echo "DEVICE /dev/sda[0-9] /dev/sdb[0-9] /dev/md[0-9]" > /etc/mdadm.conf mdadm --examine --scan --config=/etc/mdadm.conf >> /etc/mdadm.conf mdadm --assemble --scan fi
Use better-initramfs fork with raid-1 mdadm support
git clone git://github.com/init6/initramfs.gitGrub2 configuration Importantly do not forget
enc_root=/dev/md0
