Difference between revisions of "Rootfs over encrypted lvm"

From Funtoo
Jump to: navigation, search
(Bootloader Configuration)
m (fixed the --no-nvram option)
 
(32 intermediate revisions by one other user not shown)
Line 1: Line 1:
This howto describes how to setup LVM and rootfs with cryptoLUKS-encrypted drive. It is not meant to be a standalone installation guide, rather, it is meant to be read alongside the [[Funtoo Linux Installation]] Guide.  
+
This howto describes how to setup LVM, swap, and root with dmcrypt LUKS. It is a standalone installation walk through, based on the official installations finished product.  boot is not encrypted.
  
 
== Prepare the hard drive and partitions ==
 
== Prepare the hard drive and partitions ==
Line 58: Line 58:
  
 
== Encrypting the drive ==
 
== Encrypting the drive ==
Read more about different cipher options here: [http://blog.wpkg.org/2009/04/23/cipher-benchmark-for-dm-crypt-luks/]
+
*luks2 is not backwards compatible, and requires grub 9999 git latest. grub 2.04 does not support luks2 yet.  stick with luks1.
 
{{console|body=
 
{{console|body=
 
# ##i##cryptsetup luksFormat /dev/sdc3
 
# ##i##cryptsetup luksFormat /dev/sdc3
 
}}
 
}}
  
Or use SHA512 for increase security. Do NOT use SHA-1: LUKS disk encryption. As the cryptography expert Bruce Schneier already told in year 2005, do not use SHA-1 because its broken. See his article here: [http://www.schneier.com/blog/archives/2005/02/sha1_broken.html]
+
== Unlock the volume ==
 
+
Unlock the volume:
 
{{console|body=
 
{{console|body=
# ##i##cryptsetup --cipher twofish-xts-plain64 --hash sha512 --key-size 256 luksFormat /dev/sdc3
+
###i##cryptsetup luksOpen /dev/sdc3 dmcrypt_root
 
}}
 
}}
  
{{Warning|Support for ''twofish-xts-plain64'' is '''NOT''' in the default debian-kernel. You will need to configure and compile your own kernel if you choose this.}}
+
== Create logical volumes ==
 
 
== Initializes the volume ==
 
Initializes the volume, and sets an initial key or passphrase:
 
<console>
 
# ##i##cryptsetup luksOpen /dev/sdc3 dmcrypt_root
 
</console>
 
 
 
There you'll be prompted to enter your password phrase for encrypted drive, type your paranoid password there.
 
{{Fancywarning|The default keymap at boot time is '''us'''. If you enter your passphrase using a different keymap, you won't be able to unlock your crypt volume if the passphrase contains any characters that are located elsewere on your keyboard layout that with the us layout.}}
 
 
 
= Create logical volumes =
 
 
{{console|body=
 
{{console|body=
# ##i##pvcreate /dev/mapper/dmcrypt_root
+
###i## pvcreate /dev/mapper/dmcrypt_root
# ##i##vgcreate vg /dev/mapper/dmcrypt_root           
+
###i## vgcreate vg /dev/mapper/dmcrypt_root           
# ##i##lvcreate -L2G --name swap vg
+
###i## lvcreate -L2G --name swap vg
# ##i##lvcreate -l 100%FREE --name root vg  
+
###i## lvcreate -l 100%FREE --name root vg  
 
}}
 
}}
Feel free to specify your desired size by altering the numbers after the -L flag. For example, to make your portage dataset 20GB's, use the flag -L20G instead of -L5G.
 
{{Note|Please, notice that above mentioned partitioning scheme is an example and not a default recommendation, change it accordingly to desired scheme.}}
 
  
== Create a filesystem on volumes ==
+
=== Create a filesystem on volumes ===
 +
 
 
{{console|body=
 
{{console|body=
 
###i## mkfs.vfat -F 32 /dev/sdc2
 
###i## mkfs.vfat -F 32 /dev/sdc2
 
###i## fatlabel /dev/sdc2 "BOOT"
 
###i## fatlabel /dev/sdc2 "BOOT"
# ##i##mkswap /dev/mapper/vg-swap
+
###i## mkswap /dev/mapper/vg-swap
# ##i##mkfs.ext4 /dev/mapper/vg-root
+
###i## mkfs.ext4 /dev/mapper/vg-root
 
}}
 
}}
  
== Basic system setup ==
+
=== Mount your partitions ===
 +
 
 
{{console|body=
 
{{console|body=
# ##i##swapon /dev/mapper/vg-swap
+
###i## swapon /dev/mapper/vg-swap
# ##i##mkdir /mnt/funtoo
+
###i## mkdir /mnt/funtoo
# ##i##mount /dev/mapper/vg-root /mnt/funtoo
+
###i## mount /dev/mapper/vg-root /mnt/funtoo
# ##i##mkdir  /mnt/funtoo/boot
+
###i## mkdir  /mnt/funtoo/boot
# ##i##mount /dev/sdc2 /mnt/funtoo/boot
+
###i## mount /dev/sdc2 /mnt/funtoo/boot
 
}}
 
}}
  
Line 117: Line 106:
  
 
==Load Funtoo==
 
==Load Funtoo==
*expand your run tmpfs to be half of your ram:
+
=== mount ===
{{console|body=
 
###i## mount -t tmpfs tmpfs /run
 
}}
 
 
 
 
*mount up:
 
*mount up:
 
{{console|body=
 
{{console|body=
Line 127: Line 112:
 
mount --rbind /sys sys
 
mount --rbind /sys sys
 
mount --rbind /dev dev
 
mount --rbind /dev dev
mount --rbind /run run
 
 
}}
 
}}
  
 +
=== chroot ===
 
*chroot in:
 
*chroot in:
 
{{console|body=
 
{{console|body=
###i## cd /mnt/funtoo && env -i HOME=/root TERM=$TERM chroot . bash -l
+
###i## env -i HOME=/root TERM=$TERM $(which chroot) /mnt/funtoo bash -l
 
}}
 
}}
  
Line 139: Line 124:
 
*set cloudflare dns resolution for installing:
 
*set cloudflare dns resolution for installing:
 
*Set yo time zone:
 
*Set yo time zone:
 +
 
{{console|body=
 
{{console|body=
 
###i## passwd
 
###i## passwd
Line 146: Line 132:
 
}}
 
}}
  
 +
=== fstab ===
 
*Deploy your fstab:
 
*Deploy your fstab:
 +
 
{{console|body=
 
{{console|body=
 
###i## cat > /etc/fstab << "EOF"
 
###i## cat > /etc/fstab << "EOF"
Line 152: Line 140:
 
/dev/mapper/vg-swap none swap sw 0 0
 
/dev/mapper/vg-swap none swap sw 0 0
 
/dev/mapper/vg-root / ext4 noatime,nodiratime,defaults 0 1
 
/dev/mapper/vg-root / ext4 noatime,nodiratime,defaults 0 1
tmpfs /run tmpfs rw,nodev,nosuid 0 0
+
tmpfs /var/tmp/portage tmpfs uid=portage,gid=portage,mode=775,noatime 0 0
 +
#tmpfs /var/tmp/portage tmpfs size=2G,uid=portage,gid=portage,mode=775,noatime 0 0
 
EOF
 
EOF
 
}}
 
}}
  
 +
*Deploy your crypttab:
 +
 +
{{console|body=
 +
###i## echo "dmcrypt_root PARTLABEL=FUNTOO none luks,discard" >> /etc/crypttab
 +
}}
 +
 +
=== compile in ram ===
 
*compile in ram:
 
*compile in ram:
 
{{console|body=
 
{{console|body=
###i## echo 'PORTAGE_TMPDIR="/run"' > /etc/portage/make.conf
+
###i## mkdir /var/tmp/portage
 +
###i## chown portage:portage /var/tmp/portage
 +
###i## mount /var/tmp/portage
 +
}}
 +
 
 +
*Sync:
 +
{{console|body=
 +
###i## ego sync
 
}}
 
}}
  
Line 169: Line 172:
 
{{console|body=
 
{{console|body=
 
###i## cat > /etc/portage/package.use << "EOF"
 
###i## cat > /etc/portage/package.use << "EOF"
sys-kernel/debian-sources lvm luks
+
*/* device-mapper lvm luks
sys-kernel/debian-sources-lts lvm luks
 
sys-boot/grub device-mapper
 
sys-fs/lvm2 static-libs
 
sys-kernel/genkernel cryptsetup
 
dev-libs/openssl static-libs
 
dev-libs/json-c static-libs
 
app-crypt/argon2 static-libs
 
dev-libs/popt static-libs
 
sys-fs/cryptsetup static
 
dev-libs/libgpg-error static-libs
 
 
sys-kernel/linux-firmware initramfs
 
sys-kernel/linux-firmware initramfs
 
EOF
 
EOF
Line 185: Line 178:
  
 
*merge stuff:
 
*merge stuff:
 +
 
{{console|body=
 
{{console|body=
###i## ego sync && emerge grub haveged intel-microcode linux-firmware eix cryptsetup lvm2 debian-sources debian-sources-lts && emerge -vuND @world
+
###i## emerge grub haveged intel-microcode linux-firmware eix cryptsetup lvm2 debian-sources debian-sources-lts && emerge -vuND @world && emerge --depclean
 
}}
 
}}
  
== Bootloader Configuration ==
+
*add required services:
=== /etc/boot.conf ===
+
{{console|body=
 +
###i## rc-update add device-mapper sysinit
 +
###i## rc-update add dmcrypt sysinit
 +
###i## rc-update add haveged && rc-update add gpm && rc-update add busybox-ntpd
 +
}}
  
<pre>
+
*deploy dmtab:
boot {
+
{{console|body=
  generate grub
+
###i## dmsetup table >> /etc/dmtab
  default "Funtoo Linux"
+
}}
  timeout 3
 
}
 
"Funtoo Linux" {
 
  kernel vmlinuz[-v]
 
  initrd initramfs[-v]
 
  params += enc_root=PARTLABEL=FUNTOO lvm luks root=/dev/mapper/vg-root  rootfstype=auto resume=swap:/dev/mapper/vg-swap
 
}
 
</pre>
 
  
Now, run <code>ego boot update</code> to write the configuration files to <code>/boot/grub/grub.cfg</code>
+
=== Bootloader Configuration ===
  
=== Another Example ===
+
*deploy boot.conf
Configure the bootloader as described above, with correct kernel and initramfs images names. An example for grub2. You will be editing <code>/etc/boot.conf</code>:
+
{{warning|uuid is the only known working method of loading crypt_root. even /dev/sdc will not load it.}}
  
<pre>
+
{{console|body=
 +
###i## cat > /etc/boot.conf << "EOF"
 
boot {
 
boot {
 
   generate grub
 
   generate grub
Line 219: Line 210:
 
kernel kernel[-v]
 
kernel kernel[-v]
 
initrd initramfs[-v]
 
initrd initramfs[-v]
   params += crypt_root=PARTLABEL=FUNTOO dolvm real_root=/dev/mapper/vg-root rootfstype=ext4 resume=swap:/dev/mapper/vg-swap
+
   params += crypt_root=UUID=a5ca52dc-d00a-40f9-8666-31d9021de327 dolvm real_root=/dev/mapper/vg-root ro rootfstype=auto resume=swap:/dev/mapper/vg-swap quiet
 
}
 
}
</pre>
+
EOF
 +
}}
  
 
== GRUB ==
 
== GRUB ==
*Install grub in legacy mode:
+
*Install grub:
 
{{console|body=
 
{{console|body=
 
###i## grub-install --target=i386-pc /dev/sdc  
 
###i## grub-install --target=i386-pc /dev/sdc  
###i## ego boot update}}
+
###i## grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id="BOOT" --recheck --no-nvram /dev/sdc
 
+
###i## ego boot update
=== EFI from Legacy ===
 
*manually make efi directory:
 
*remount /dev/sdc2 to /boot/efi:
 
*install efi images:
 
{{console|body=
 
###i## mkdir /boot/efi
 
###i## mount /dev/sdc2 /boot/efi
 
###i## grub-install --target=x86_64-efi /boot/efi
 
 
}}
 
}}
=== EFI from EFI ===
 
  
{{console|body=
+
=== Final steps ===
###i##mount -o remount,rw /sys/firmware/efi/efivars
+
exit chroot, unmount, and close encrypted drive.
###i##grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id="Funtoo Linux [GRUB]" --recheck /dev/sda
 
###i##ego boot update
 
}}
 
  
== Final steps ==
 
exit chroot, unmount everything, close encrypted drive and reboot
 
 
{{console|body=
 
{{console|body=
 
###i## exit
 
###i## exit
###i## swapon
 
NAME          TYPE      SIZE USED PRIO
 
/home/swapfile file        4G  2M  -2
 
/dev/dm-1      partition  2G  0B  -3
 
 
###i## swapoff /dev/dm-1
 
###i## swapoff /dev/dm-1
 
###i## cd ..
 
###i## cd ..
# ##i##umount -l -v /mnt/funtoo/{dev, proc, home, usr/portage, boot}
 
 
###i## umount -lR funtoo
 
###i## umount -lR funtoo
# ##i##vgchange -a n
+
###i## vgchange -a n
# ##i##cryptsetup luksClose dmcrypt_root
+
###i## cryptsetup luksClose dmcrypt_root
 
}}
 
}}
After reboot you will get the following:
 
<console>
 
>>> better-initramfs started. Kernel version 2.6.35-gentoo-r10
 
>>> Create all the symlinks to /bin/busybox.
 
>>> Initiating /dev/dir
 
>>> Getting LVM volumes up (if any)
 
Reding all physical volumes. This make take awhile...
 
No volume group found
 
No volume group found
 
>>> Opening encrypted partition and mapping to /dev/mapper/dmcrypt_root
 
Enter passphrase fore /dev/sda2:
 
</console>
 
Type your password
 
 
<console>
 
>>> Again, getting LVM volumes up (if any, after map dmcrypt).
 
  Reading all physical volumes.  This may take a while...
 
  Found volume group "vg" using metadata type lvm2
 
  4 logical volume(s) in volume group "vg" now active
 
>>> Mounting rootfs to /newroot
 
>>> Umounting /sys and /proc.
 
>>> Switching root to /newroot and executing /sbin/init.
 
INIT: version 2.88 booting
 
Loading /libexec/rc/console/keymap
 
  OpenRC 0.6.1 is starting up Funtoo Linux (x86_64)
 
...boot messages omitted for clarity
 
 
 
orion login: oleg
 
Password:
 
Last login: Thu Oct 14 20:49:21 EEST 2010 on tty1
 
oleg@orion ~ %
 
</console>
 
  
 
==management==
 
==management==
Line 299: Line 240:
  
 
{{console|body=
 
{{console|body=
# ##i##cryptsetup luksChangeKey /dev/sda3
+
# ##i##cryptsetup luksChangeKey /dev/sdx3
 
}}
 
}}
  
 
You'll be prompted to enter in the existing passphrase first, then to enter in your new passphrase.
 
You'll be prompted to enter in the existing passphrase first, then to enter in your new passphrase.
 
You will not be asked to confirm your new passphrase, so be careful when running this operation.
 
You will not be asked to confirm your new passphrase, so be careful when running this operation.
 
  
 
== Additional links and information ==
 
== Additional links and information ==
 +
* [https://www.freedesktop.org/software/systemd/man/crypttab.html crypttab]
 
* [[gentoo-wiki:Root filesystem over LVM2, DM-Crypt and RAID|Root filesystem over LVM2, DM-Crypt, and RAID]]
 
* [[gentoo-wiki:Root filesystem over LVM2, DM-Crypt and RAID|Root filesystem over LVM2, DM-Crypt, and RAID]]
 
* [http://wiki.archlinux.org/index.php/System_Encryption_with_LUKS_for_dm-crypt System Encryption with LUKS for dm-crypt]
 
* [http://wiki.archlinux.org/index.php/System_Encryption_with_LUKS_for_dm-crypt System Encryption with LUKS for dm-crypt]
 +
* [https://wiki.archlinux.org/index.php/Dm-crypt/Encrypting_an_entire_system#LVM_on_LUKS arch encrypt entire system]
 
* [http://en.wikipedia.org/wiki/Logical_volume_management Wikipedia article on LVM]
 
* [http://en.wikipedia.org/wiki/Logical_volume_management Wikipedia article on LVM]
 
* [https://wiki.archlinux.org/index.php/Dm-crypt_with_LUKS Arch Wiki article]
 
* [https://wiki.archlinux.org/index.php/Dm-crypt_with_LUKS Arch Wiki article]
  
 
[[Category:HOWTO]]
 
[[Category:HOWTO]]

Latest revision as of 13:14, February 22, 2021

This howto describes how to setup LVM, swap, and root with dmcrypt LUKS. It is a standalone installation walk through, based on the official installations finished product. boot is not encrypted.

Prepare the hard drive and partitions

  • List the device to be partitioned, mine is on /dev/sdc
root # lsblk -o name,size,label,partlabel

Partition

root # cgdisk /dev/sdc

delete everything.

Command:  new ↵
First sector: 
Last sector: +1M ↵
Hex Code: EF02 ↵
Enter name: BIOS Boot ↵

scroll down to large chunk of free space:

Command: new ↵
First sector: 
Last sector: +128M ↵
Hex Code: EF00 ↵
Enter name: BOOT ↵

scroll down to large chunk of free space:

Command: new ↵
First sector: 
Last sector: 
Hex Code:  8304 ↵
Enter name: FUNTOO ↵
Disk Drive: /dev/sdc
                            Size: 62333952, 29.7 GiB

Part. #     Size        Partition Type            Partition Name
----------------------------------------------------------------
            1007.0 KiB  free space
   1        1024.0 KiB  BIOS boot partition	  BIOS Boot
   2        256.0 MiB   EFI System                BOOT
   3        29.5 GiB    Linux x86-64 root (/)     FUNTOO
Command: write ↵
Command: quit ↵

Encrypting the drive

  • luks2 is not backwards compatible, and requires grub 9999 git latest. grub 2.04 does not support luks2 yet. stick with luks1.
root # cryptsetup luksFormat /dev/sdc3

Unlock the volume

Unlock the volume:

root #cryptsetup luksOpen /dev/sdc3 dmcrypt_root

Create logical volumes

root # pvcreate /dev/mapper/dmcrypt_root
root # vgcreate vg /dev/mapper/dmcrypt_root          
root # lvcreate -L2G --name swap vg
root # lvcreate -l 100%FREE --name root vg

Create a filesystem on volumes

root # mkfs.vfat -F 32 /dev/sdc2
root # fatlabel /dev/sdc2 "BOOT"
root # mkswap /dev/mapper/vg-swap
root # mkfs.ext4 /dev/mapper/vg-root

Mount your partitions

root # swapon /dev/mapper/vg-swap
root # mkdir /mnt/funtoo
root # mount /dev/mapper/vg-root /mnt/funtoo
root # mkdir  /mnt/funtoo/boot
root # mount /dev/sdc2 /mnt/funtoo/boot

Get Funtoo Gnome

You can pull your Subarches gnome tarball if you wish:

root # cd /mnt/funtoo
root # wget https://build.funtoo.org/1.4-release-std/x86-64bit/generic_64/gnome-latest.tar.xz
root # tar --numeric-owner --xattrs --xattrs-include='*' -xpf *gnome* && rm -f *gnome*

Load Funtoo

mount

  • mount up:
root # cd /mnt/funtoo && mount -t proc none proc
mount --rbind /sys sys
mount --rbind /dev dev

chroot

  • chroot in:
root # env -i HOME=/root TERM=$TERM $(which chroot) /mnt/funtoo bash -l
  • Set yo password:
  • set yo hostname:
  • set cloudflare dns resolution for installing:
  • Set yo time zone:
root # passwd
root # echo 'hostname="crypto"' > /etc/conf.d/hostname
root # echo "nameserver 1.1.1.1" > /etc/resolv.conf
root # ln -sf /usr/share/zoneinfo/America/Detroit /etc/localtime

fstab

  • Deploy your fstab:
root # cat > /etc/fstab << "EOF"
LABEL=BOOT /boot vfat noauto,noatime 1 2
/dev/mapper/vg-swap none swap sw 0 0
/dev/mapper/vg-root / ext4 noatime,nodiratime,defaults 0 1
tmpfs /var/tmp/portage tmpfs uid=portage,gid=portage,mode=775,noatime 0 0
root #tmpfs /var/tmp/portage tmpfs size=2G,uid=portage,gid=portage,mode=775,noatime 0 0
EOF
  • Deploy your crypttab:
root # echo "dmcrypt_root PARTLABEL=FUNTOO none luks,discard" >> /etc/crypttab

compile in ram

  • compile in ram:
root # mkdir /var/tmp/portage
root # chown portage:portage /var/tmp/portage
root # mount /var/tmp/portage
  • Sync:
root # ego sync
  • Deploy your ego profile:
root # ego profile mix-in encrypted-root
  • Deploy your package.use file:
root # cat > /etc/portage/package.use << "EOF"
*/* device-mapper lvm luks
sys-kernel/linux-firmware initramfs
EOF
  • merge stuff:
root # emerge grub haveged intel-microcode linux-firmware eix cryptsetup lvm2 debian-sources debian-sources-lts && emerge -vuND @world && emerge --depclean
  • add required services:
root # rc-update add device-mapper sysinit
root # rc-update add dmcrypt sysinit
root # rc-update add haveged && rc-update add gpm && rc-update add busybox-ntpd
  • deploy dmtab:
root # dmsetup table >> /etc/dmtab

Bootloader Configuration

  • deploy boot.conf
   Warning

uuid is the only known working method of loading crypt_root. even /dev/sdc will not load it.

root # cat > /etc/boot.conf << "EOF"
boot {
  generate grub
  default "Funtoo Linux"
  timeout 3
}
"Funtoo Linux" {
	kernel kernel[-v]
	initrd initramfs[-v]
  params += crypt_root=UUID=a5ca52dc-d00a-40f9-8666-31d9021de327 dolvm real_root=/dev/mapper/vg-root ro rootfstype=auto resume=swap:/dev/mapper/vg-swap quiet
}
EOF

GRUB

  • Install grub:
root # grub-install --target=i386-pc /dev/sdc 
root # grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id="BOOT" --recheck --no-nvram /dev/sdc
root # ego boot update

Final steps

exit chroot, unmount, and close encrypted drive.

root # exit
root # swapoff /dev/dm-1
root # cd ..
root # umount -lR funtoo
root # vgchange -a n
root # cryptsetup luksClose dmcrypt_root

management

Change your LUKs-encrypted drive's passphrase

You may want to change your encrypted volume’s passphrase or password from time to time. To do so, run the following commands in the console as root:

root # cryptsetup luksChangeKey /dev/sdx3

You'll be prompted to enter in the existing passphrase first, then to enter in your new passphrase. You will not be asked to confirm your new passphrase, so be careful when running this operation.

Additional links and information