Difference between revisions of "Encrypted Root"

From Funtoo
Jump to: navigation, search
(Encrypt the drive)
m (Final steps)
 
(24 intermediate revisions by 3 users not shown)
Line 1: Line 1:
This howto describes how to setup a swapless encrypted root partition without llvm.
+
This document describes how to setup a swapless encrypted root partition without lvm.
 +
 
 +
{{warning|[[Rootfs_over_encrypted_lvm]] works, this page currently does not.  you may try to get this working at your own risk!}}
  
 
== Prepare the hard drive and partitions ==
 
== Prepare the hard drive and partitions ==
Line 59: Line 61:
 
== Encrypt the drive ==
 
== Encrypt the drive ==
 
{{console|body=
 
{{console|body=
# ##i##cryptsetup luksFormat /dev/sdc3
+
###i## cryptsetup luksFormat --type luks2 --label=FUNTOO /dev/sdc3
 
}}
 
}}
*enter your password
+
* YES not yes....
 +
*enter your password:
  
 
== Initialize the volume ==
 
== Initialize the volume ==
 
Initialize the volume:
 
Initialize the volume:
 +
 
{{console|body=
 
{{console|body=
# ##i##cryptsetup luksOpen /dev/sdc3 dmcrypt_root
+
###i## cryptsetup luksOpen /dev/sdc3 dmcrypt_root
 +
}}
 +
 
 +
== Create logical volumes ==
 +
{{console|body=
 +
###i## pvcreate /dev/mapper/dmcrypt_root
 +
###i## vgcreate vg /dev/mapper/dmcrypt_root         
 +
###i## lvcreate -l 100%FREE --name root vg
 
}}
 
}}
  
Line 73: Line 84:
 
###i## mkfs.vfat -F 32 /dev/sdc2
 
###i## mkfs.vfat -F 32 /dev/sdc2
 
###i## fatlabel /dev/sdc2 "BOOT"
 
###i## fatlabel /dev/sdc2 "BOOT"
# ##i##mkfs.ext4 /dev/sdc3
+
###i## mkfs.jfs /dev/mapper/vg-root
 
}}
 
}}
  
=== Basic system setup ===
+
=== Mount ===
 
{{console|body=
 
{{console|body=
# ##i##mkdir /mnt/funtoo
+
###i## mkdir /mnt/funtoo
# ##i##mount /dev/sdc3 /mnt/funtoo
+
###i## mount /dev/mapper/vg-root /mnt/funtoo
# ##i##mkdir  /mnt/funtoo/boot
+
###i## mkdir  /mnt/funtoo/boot
# ##i##mount /dev/sdc2 /mnt/funtoo/boot
+
###i## mount /dev/sdc2 /mnt/funtoo/boot
 
}}
 
}}
  
Line 113: Line 124:
  
 
*Set yo password:
 
*Set yo password:
*set yo hostname:
+
*Set yo hostname:
*set cloudflare dns resolution for installing:
+
*Set cloudflare dns resolution for installing:
 
*Set yo time zone:
 
*Set yo time zone:
 +
*Set yo clock:
 +
 
{{console|body=
 
{{console|body=
 
###i## passwd
 
###i## passwd
Line 121: Line 134:
 
###i## echo "nameserver 1.1.1.1" > /etc/resolv.conf
 
###i## echo "nameserver 1.1.1.1" > /etc/resolv.conf
 
###i## ln -sf /usr/share/zoneinfo/America/Detroit /etc/localtime
 
###i## ln -sf /usr/share/zoneinfo/America/Detroit /etc/localtime
 +
###i## rc-service busybox-ntpd restart
 
}}
 
}}
  
 +
=== load your fstab ===
 
*Deploy your fstab:
 
*Deploy your fstab:
 
{{console|body=
 
{{console|body=
 
###i## cat > /etc/fstab << "EOF"
 
###i## cat > /etc/fstab << "EOF"
 
LABEL=BOOT /boot vfat noauto,noatime 1 2
 
LABEL=BOOT /boot vfat noauto,noatime 1 2
/dev/mapper/vg-swap none swap sw 0 0
+
/dev/mapper/vg-root / jfs noatime,nodiratime,defaults 0 1
/dev/mapper/vg-root / ext4 noatime,nodiratime,defaults 0 1
 
 
tmpfs /run tmpfs rw,nodev,nosuid 0 0
 
tmpfs /run tmpfs rw,nodev,nosuid 0 0
 
EOF
 
EOF
 +
}}
 +
 +
*load your crypttab:
 +
{{console|body=
 +
###i## echo "dmcrypt_root LABEL=FUNTOO none luks" >> /etc/crypttab
 +
###i## dmsetup table >> /etc/dmtab
 
}}
 
}}
  
Line 138: Line 158:
 
}}
 
}}
  
*Deploy your ego profile:
+
*Sync & deploy your profile:
 
{{console|body=
 
{{console|body=
###i## ego profile mix-in encrypted-root
+
###i## ego sync && ego profile mix-in encrypted-root
 
}}
 
}}
  
Line 146: Line 166:
 
{{console|body=
 
{{console|body=
 
###i## cat > /etc/portage/package.use << "EOF"
 
###i## cat > /etc/portage/package.use << "EOF"
sys-kernel/debian-sources lvm luks
+
*/* lvm device-mapper
sys-kernel/debian-sources-lts lvm luks
 
sys-boot/grub device-mapper
 
sys-fs/lvm2 static-libs
 
sys-kernel/genkernel cryptsetup
 
dev-libs/openssl static-libs
 
dev-libs/json-c static-libs
 
app-crypt/argon2 static-libs
 
dev-libs/popt static-libs
 
sys-fs/cryptsetup static
 
dev-libs/libgpg-error static-libs
 
 
sys-kernel/linux-firmware initramfs
 
sys-kernel/linux-firmware initramfs
 
EOF
 
EOF
 
}}
 
}}
  
*merge stuff:
 
 
{{console|body=
 
{{console|body=
###i## ego sync && emerge grub haveged intel-microcode linux-firmware eix cryptsetup lvm2 debian-sources debian-sources-lts && emerge -vuND @world
+
###i## emerge jfsutils grub haveged intel-microcode linux-firmware eix cryptsetup lvm2 && emerge -vuND @world && emerge --depclean
 
}}
 
}}
  
*add required services:
+
*set services:
 
{{console|body=
 
{{console|body=
###i## rc-update add device-mapper sysinit
+
###i## rc-update del swap boot && rc-update add haveged && rc-update add busybox-ntpd && rc-update add gpm
###i## rc-update add dmcrypt sysinit
+
###i## rc-update add device-mapper boot
###i## rc-update add lvm sysinit
+
###i## rc-update add dmcrypt boot
 +
###i## rc-update add lvm boot
 +
###i## rc-update add lvmetad boot
 
}}
 
}}
  
Line 185: Line 196:
 
kernel kernel[-v]
 
kernel kernel[-v]
 
initrd initramfs[-v]
 
initrd initramfs[-v]
   params += cryptdevice=PARTLABEL=FUNTOO luks root=PARTLABEL=FUNTOO  rootfstype=auto
+
   params += crypt_root=LABEL=FUNTOO dolvm luks=yes real_root=/dev/mapper/vg-root ro rootfstype=jfs
}
 
</pre>
 
 
 
Now, run <code>ego boot update</code> to write the configuration files to <code>/boot/grub/grub.cfg</code>
 
 
 
=== Another Example ===
 
Configure the bootloader as described above, with correct kernel and initramfs images names. An example for grub2. You will be editing <code>/etc/boot.conf</code>:
 
 
 
<pre>
 
boot {
 
  generate grub
 
  default "Funtoo Linux"
 
  timeout 3
 
 
}
 
}
"Funtoo Linux" {
 
kernel kernel[-v]
 
initrd initramfs[-v]
 
  params += crypt_root=PARTLABEL=FUNTOO dolvm real_root=/dev/mapper/vg-root  rootfstype=ext4
 
 
</pre>
 
</pre>
  
Line 221: Line 215:
 
###i## grub-install --target=x86_64-efi /boot/efi
 
###i## grub-install --target=x86_64-efi /boot/efi
 
}}
 
}}
 +
 
=== EFI from EFI ===
 
=== EFI from EFI ===
 
 
{{console|body=
 
{{console|body=
 
###i##mount -o remount,rw /sys/firmware/efi/efivars
 
###i##mount -o remount,rw /sys/firmware/efi/efivars
Line 230: Line 224:
  
 
== Final steps ==
 
== Final steps ==
exit chroot, unmount everything, close encrypted drive and reboot
+
*exit chroot, unmount everything,and close encrypted root:
 
{{console|body=
 
{{console|body=
 
###i## exit
 
###i## exit
###i## swapon
 
NAME          TYPE      SIZE USED PRIO
 
/home/swapfile file        4G  2M  -2
 
/dev/dm-1      partition  2G  0B  -3
 
###i## swapoff /dev/dm-1
 
 
###i## cd ..
 
###i## cd ..
# ##i##umount -l -v /mnt/funtoo/{dev, proc, home, usr/portage, boot}
 
 
###i## umount -lR funtoo
 
###i## umount -lR funtoo
# ##i##vgchange -a n
+
###i## vgchange -a n
# ##i##cryptsetup luksClose dmcrypt_root
+
###i## cryptsetup luksClose dmcrypt_root
 
}}
 
}}
After reboot you will get the following:
 
<console>
 
>>> better-initramfs started. Kernel version 2.6.35-gentoo-r10
 
>>> Create all the symlinks to /bin/busybox.
 
>>> Initiating /dev/dir
 
>>> Getting LVM volumes up (if any)
 
Reding all physical volumes. This make take awhile...
 
No volume group found
 
No volume group found
 
>>> Opening encrypted partition and mapping to /dev/mapper/dmcrypt_root
 
Enter passphrase fore /dev/sda2:
 
</console>
 
Type your password
 
 
<console>
 
>>> Again, getting LVM volumes up (if any, after map dmcrypt).
 
  Reading all physical volumes.  This may take a while...
 
  Found volume group "vg" using metadata type lvm2
 
  4 logical volume(s) in volume group "vg" now active
 
>>> Mounting rootfs to /newroot
 
>>> Umounting /sys and /proc.
 
>>> Switching root to /newroot and executing /sbin/init.
 
INIT: version 2.88 booting
 
Loading /libexec/rc/console/keymap
 
  OpenRC 0.6.1 is starting up Funtoo Linux (x86_64)
 
...boot messages omitted for clarity
 
 
 
orion login: oleg
 
Password:
 
Last login: Thu Oct 14 20:49:21 EEST 2010 on tty1
 
oleg@orion ~ %
 
</console>
 
  
 
==management==
 
==management==
Line 282: Line 238:
  
 
{{console|body=
 
{{console|body=
# ##i##cryptsetup luksChangeKey /dev/sda3
+
###i## cryptsetup luksChangeKey /dev/sda3
 
}}
 
}}
  
Line 288: Line 244:
 
You will not be asked to confirm your new passphrase, so be careful when running this operation.
 
You will not be asked to confirm your new passphrase, so be careful when running this operation.
  
 
+
== External Resources ==
== Additional links and information ==
 
 
* [[gentoo-wiki:Root filesystem over LVM2, DM-Crypt and RAID|Root filesystem over LVM2, DM-Crypt, and RAID]]
 
* [[gentoo-wiki:Root filesystem over LVM2, DM-Crypt and RAID|Root filesystem over LVM2, DM-Crypt, and RAID]]
 
* [http://wiki.archlinux.org/index.php/System_Encryption_with_LUKS_for_dm-crypt System Encryption with LUKS for dm-crypt]
 
* [http://wiki.archlinux.org/index.php/System_Encryption_with_LUKS_for_dm-crypt System Encryption with LUKS for dm-crypt]

Latest revision as of 07:17, December 3, 2020

This document describes how to setup a swapless encrypted root partition without lvm.

   Warning

Rootfs_over_encrypted_lvm works, this page currently does not. you may try to get this working at your own risk!

Prepare the hard drive and partitions

  • List the device to be partitioned, mine is on /dev/sdc
root # lsblk -o name,size,label,partlabel

Partition

root # cgdisk /dev/sdc

delete everything.

Command:  new ↵
First sector: 
Last sector: +1M ↵
Hex Code: EF02 ↵
Enter name: BIOS Boot ↵

scroll down to large chunk of free space:

Command: new ↵
First sector: 
Last sector: +128M ↵
Hex Code: EF00 ↵
Enter name: BOOT ↵

scroll down to large chunk of free space:

Command: new ↵
First sector: 
Last sector: 
Hex Code:  8304 ↵
Enter name: FUNTOO ↵
Disk Drive: /dev/sdc
                            Size: 62333952, 29.7 GiB

Part. #     Size        Partition Type            Partition Name
----------------------------------------------------------------
            1007.0 KiB  free space
   1        1024.0 KiB  BIOS boot partition	  BIOS Boot
   2        256.0 MiB   EFI System                BOOT
   3        29.5 GiB    Linux x86-64 root (/)     FUNTOO
Command: write ↵
Command: quit ↵

Encrypt the drive

root # cryptsetup luksFormat --type luks2 --label=FUNTOO /dev/sdc3
  • YES not yes....
  • enter your password:

Initialize the volume

Initialize the volume:

root # cryptsetup luksOpen /dev/sdc3 dmcrypt_root

Create logical volumes

root # pvcreate /dev/mapper/dmcrypt_root
root # vgcreate vg /dev/mapper/dmcrypt_root          
root # lvcreate -l 100%FREE --name root vg

Create your filesystem

root # mkfs.vfat -F 32 /dev/sdc2
root # fatlabel /dev/sdc2 "BOOT"
root # mkfs.jfs /dev/mapper/vg-root

Mount

root # mkdir /mnt/funtoo
root # mount /dev/mapper/vg-root /mnt/funtoo
root # mkdir  /mnt/funtoo/boot
root # mount /dev/sdc2 /mnt/funtoo/boot

Get Funtoo Gnome

You can pull your Subarches gnome tarball if you wish:

root # cd /mnt/funtoo
root # wget https://build.funtoo.org/1.4-release-std/x86-64bit/generic_64/gnome-latest.tar.xz
root # tar --numeric-owner --xattrs --xattrs-include='*' -xpf *gnome* && rm -f *gnome*

Load Funtoo

  • expand your run tmpfs to be half of your ram:
root # mount -t tmpfs tmpfs /run
  • mount up:
root # cd /mnt/funtoo && mount -t proc none proc
mount --rbind /sys sys
mount --rbind /dev dev
mount --rbind /run run
  • chroot in:
root # cd /mnt/funtoo && env -i HOME=/root TERM=$TERM chroot . bash -l
  • Set yo password:
  • Set yo hostname:
  • Set cloudflare dns resolution for installing:
  • Set yo time zone:
  • Set yo clock:
root # passwd
root # echo 'hostname="crypto"' > /etc/conf.d/hostname
root # echo "nameserver 1.1.1.1" > /etc/resolv.conf
root # ln -sf /usr/share/zoneinfo/America/Detroit /etc/localtime
root # rc-service busybox-ntpd restart

load your fstab

  • Deploy your fstab:
root # cat > /etc/fstab << "EOF"
LABEL=BOOT /boot vfat noauto,noatime 1 2
/dev/mapper/vg-root / jfs noatime,nodiratime,defaults 0 1
tmpfs /run tmpfs rw,nodev,nosuid 0 0
EOF
  • load your crypttab:
root # echo "dmcrypt_root LABEL=FUNTOO none luks" >> /etc/crypttab
root # dmsetup table >> /etc/dmtab
  • compile in ram:
root # echo 'PORTAGE_TMPDIR="/run"' > /etc/portage/make.conf
  • Sync & deploy your profile:
root # ego sync && ego profile mix-in encrypted-root
  • Deploy your package.use file:
root # cat > /etc/portage/package.use << "EOF"
*/* lvm device-mapper
sys-kernel/linux-firmware initramfs
EOF
root # emerge jfsutils grub haveged intel-microcode linux-firmware eix cryptsetup lvm2 && emerge -vuND @world && emerge --depclean
  • set services:
root # rc-update del swap boot && rc-update add haveged && rc-update add busybox-ntpd && rc-update add gpm
root # rc-update add device-mapper boot
root # rc-update add dmcrypt boot
root # rc-update add lvm boot
root # rc-update add lvmetad boot

Bootloader Configuration

/etc/boot.conf

boot {
  generate grub
  default "Funtoo Linux"
  timeout 3
}
"Funtoo Linux" {
	kernel kernel[-v]
	initrd initramfs[-v]
  params += crypt_root=LABEL=FUNTOO dolvm luks=yes real_root=/dev/mapper/vg-root ro rootfstype=jfs
}

GRUB

  • Install grub in legacy mode:
root # grub-install --target=i386-pc /dev/sdc 
root # ego boot update

EFI from Legacy

  • manually make efi directory:
  • remount /dev/sdc2 to /boot/efi:
  • install efi images:
root # mkdir /boot/efi
root # mount /dev/sdc2 /boot/efi
root # grub-install --target=x86_64-efi /boot/efi

EFI from EFI

root #mount -o remount,rw /sys/firmware/efi/efivars
root #grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id="Funtoo Linux [GRUB]" --recheck /dev/sda
root #ego boot update

Final steps

  • exit chroot, unmount everything,and close encrypted root:
root # exit
root # cd ..
root # umount -lR funtoo
root # vgchange -a n
root # cryptsetup luksClose dmcrypt_root

management

Change your LUKs-encrypted drive's passphrase

You may want to change your encrypted volume’s passphrase or password from time to time. To do so, run the following commands in the console as root:

root # cryptsetup luksChangeKey /dev/sda3

You'll be prompted to enter in the existing passphrase first, then to enter in your new passphrase. You will not be asked to confirm your new passphrase, so be careful when running this operation.

External Resources