Difference between revisions of "Rootfs over encrypted lvm"

From Funtoo
Jump to navigation Jump to search
(8 intermediate revisions by 4 users not shown)
Line 34: Line 34:
# ##i##cryptsetup --cipher twofish-xts-plain64 --hash sha512 --key-size 256 luksFormat /dev/sda3
# ##i##cryptsetup --cipher twofish-xts-plain64 --hash sha512 --key-size 256 luksFormat /dev/sda3
</console>
</console>
{{Warning|Support for ''twofish-xts-plain64'' is '''NOT''' in the default debian-kernel. You will need to configure and compile your own kernel if you choose this.}}
== Change your LUKs-encrypted drive's passphrase ==
You may want to change your encrypted volume’s passphrase or password from time to time. To do so, run the following commands in the console as root:
<console>
# ##i##cryptsetup luksChangeKey /dev/sda3
</console>
You'll be prompted to enter in the existing passphrase first, then to enter in your new passphrase. You will not be asked to confirm your new passphrase, so be careful when running this operation.


== Initializes the volume ==
== Initializes the volume ==
Line 53: Line 65:
</console>
</console>
Feel free to specify your desired size by altering the numbers after the -L flag. For example, to make your portage dataset 20GB's, use the flag -L20G instead of -L5G.
Feel free to specify your desired size by altering the numbers after the -L flag. For example, to make your portage dataset 20GB's, use the flag -L20G instead of -L5G.
{{fancynote| Please, notice that above mentioned partitioning scheme is an example and not a default recommendation, change it accordingly to desired scheme.}}
{{Note|Please, notice that above mentioned partitioning scheme is an example and not a default recommendation, change it accordingly to desired scheme.}}


= Create a filesystem on volumes =
= Create a filesystem on volumes =
Line 74: Line 86:
# ##i##mount /dev/mapper/vg-home /mnt/funtoo/home
# ##i##mount /dev/mapper/vg-home /mnt/funtoo/home
</console>
</console>
Now perform all the steps required for basic system install, please follow [http://docs.funtoo.org/wiki/Funtoo_Linux_Installation]
Now perform all the steps required for basic system install, please follow the [[Funtoo Linux Installation]] Guide, but don't forget to emerge the following before your install is finished:
don't forget to emerge the following before your install is finished:


* '''cryptsetup'''
* '''cryptsetup'''
Line 96: Line 107:


== Kernel options ==
== Kernel options ==
{{fancynote| This part is particularly important: pay close attention. }}<br>
{{Note|This part is particularly important: pay close attention. }}<br>
Note: If you are using debian-sources as included in mid-May 2015 and later Funtoo stages, you do <em>not</em> need to rebuild the kernel. The following instructions are for other kernels that you may choose to install.
Note: If you are using debian-sources as included in mid-May 2015 and later Funtoo stages, you do <em>not</em> need to rebuild the kernel. The following instructions are for other kernels that you may choose to install.
{{kernelop
{{kernelop
Line 129: Line 140:
= Initramfs setup and configuration =
= Initramfs setup and configuration =
== Better-initramfs ==
== Better-initramfs ==
{{fancynote| As of August 2016, better-initramfs is not required with debian-sources as included in current Funtoo stages. Unless you are doing something not with debian-sources as comes with the Funtoo stage, you can safely skip to the section on editing <code>/etc/boot.conf</code>.}}
{{Note|As of August 2016, better-initramfs is not required with debian-sources as included in current Funtoo stages. Unless you are doing something not with debian-sources as comes with the Funtoo stage, you can safely skip to the section on editing <code>/etc/boot.conf</code>.}}
'''Build your initramfs with [https://bitbucket.org/piotrkarbowski/better-initramfs better-initramfs] project.'''
'''Build your initramfs with [https://bitbucket.org/piotrkarbowski/better-initramfs better-initramfs] project.'''


{{fancynote| better-initramfs supports neither dynamic modules nor udev, so you should compile your kernel with built-in support for your block devices and file system support.}}
{{Note|better-initramfs supports neither dynamic modules nor udev, so you should compile your kernel with built-in support for your block devices and file system support.}}


<console>
<console>
# ##i##cd /opt
# ##i##cd /opt
# ##i##git clone git://github.com/slashbeast/better-initramfs.git
# ##i##git clone https://bitbucket.org/piotrkarbowski/better-initramfs.git
# ##i##cd better-initramfs
# ##i##cd better-initramfs
# ##i##less README.rst
# ##i##less README.rst
Line 162: Line 173:
# ##i##less ChangeLog
# ##i##less ChangeLog
</console>
</console>
{{fancynote| Please read the ChangeLog carefuly and perform necessary updates to <code>/etc/boot.conf</code>. Also, please backup the working <code>/boot/initramfs.cpio.gz</code> and <code>/etc/boot.conf</code> before updating better-initramfs.}}
{{Note|Please read the ChangeLog carefuly and perform necessary updates to <code>/etc/boot.conf</code>. Also, please backup the working <code>/boot/initramfs.cpio.gz</code> and <code>/etc/boot.conf</code> before updating better-initramfs.}}
Alternatively and much faster is to install better-initramfs-bin package, recently added to Funtoo's portage tree:
Alternatively and much faster is to install better-initramfs-bin package, recently added to Funtoo's portage tree:
<console>
<console>
Line 265: Line 276:
# ##i##umount -l -v /mnt/funtoo/{dev, proc, home, usr/portage, boot}  
# ##i##umount -l -v /mnt/funtoo/{dev, proc, home, usr/portage, boot}  
# ##i##vgchange -a n
# ##i##vgchange -a n
# ##i##cryptsetup luksClose /dev/sda2 dmcrypt_root
# ##i##cryptsetup luksClose dmcrypt_root
</console>
</console>
After reboot you will get the following:
After reboot you will get the following:

Revision as of 00:16, November 23, 2018

This howto describes how to setup LVM and rootfs with cryptoLUKS-encrypted drive. It is not meant to be a standalone installation guide, rather, it is meant to be read alongside the Funtoo Linux Installation Guide.

Prepare the hard drive and partitions

This is an example (and simple) partition scheme. You may want to choose differently.

  • /dev/sda1 -- /boot partition.
  • /dev/sda2 -- BIOS boot partition (Note: this is only required if booting via EFI, or for booting with GRUB2. For more info, see: [1] for more information on GPT and MBR.)
  • /dev/sda3 -- / partition, will be the drive with LUKS and LVM.

With UEFI:

  • /dev/sda1 -- /boot
  • /dev/sda2 -- / partition

Wipe the hard drive

root # gdisk /dev/sda

Command: x ↵
Expert command: z ↵
About to wipe out GPT on /dev/sda. Proceed?: y ↵
GPT data structures destroyed! You may now partition the disk using fdisk or other utilities.
Blank out MBR?: y ↵
   Warning

This action will destroy all data on the disk.

Encrypting the drive

Read more about different cipher options here: [2]

root # cryptsetup --cipher aes-xts-plain64 luksFormat /dev/sda3

Or use SHA512 for increase security. Do NOT use SHA-1: LUKS disk encryption. As the cryptography expert Bruce Schneier already told in year 2005, do not use SHA-1 because its broken. See his article here: [3]

root # cryptsetup --cipher twofish-xts-plain64 --hash sha512 --key-size 256 luksFormat /dev/sda3
   Warning

Support for twofish-xts-plain64 is NOT in the default debian-kernel. You will need to configure and compile your own kernel if you choose this.

Change your LUKs-encrypted drive's passphrase

You may want to change your encrypted volume’s passphrase or password from time to time. To do so, run the following commands in the console as root:

root # cryptsetup luksChangeKey /dev/sda3

You'll be prompted to enter in the existing passphrase first, then to enter in your new passphrase. You will not be asked to confirm your new passphrase, so be careful when running this operation.


Initializes the volume

Initializes the volume, and sets an initial key or passphrase:

root # cryptsetup luksOpen /dev/sda3 dmcrypt_root

There you'll be prompted to enter your password phrase for encrypted drive, type your paranoid password there.

   Warning

The default keymap at boot time is us. If you enter your passphrase using a different keymap, you won't be able to unlock your crypt volume if the passphrase contains any characters that are located elsewere on your keyboard layout that with the us layout.

Create logical volumes

root # pvcreate /dev/mapper/dmcrypt_root
root # vgcreate vg /dev/mapper/dmcrypt_root
root # lvcreate -L10G --name root vg           
root # lvcreate -L2G --name swap vg
root # lvcreate -L5G --name portage vg
root # lvcreate -l 100%FREE -nhome vg

Feel free to specify your desired size by altering the numbers after the -L flag. For example, to make your portage dataset 20GB's, use the flag -L20G instead of -L5G.

   Note

Please, notice that above mentioned partitioning scheme is an example and not a default recommendation, change it accordingly to desired scheme.

Create a filesystem on volumes

root # mkfs.ext2 /dev/sda1
root # mkswap /dev/mapper/vg-swap
root # mkfs.ext4 /dev/mapper/vg-root
root # mkfs.ext4 /dev/mapper/vg-portage
root # mkfs.ext4 /dev/mapper/vg-home

Basic system setup

root # swapon /dev/mapper/vg-swap
root # mkdir /mnt/funtoo
root # mount /dev/mapper/vg-root /mnt/funtoo
root # mkdir -p /mnt/funtoo/{boot,usr/portage,home}
root # mount /dev/sda1 /mnt/funtoo/boot
root # mount /dev/mapper/vg-portage /mnt/funtoo/usr/portage
root # mount /dev/mapper/vg-home /mnt/funtoo/home

Now perform all the steps required for basic system install, please follow the Funtoo Linux Installation Guide, but don't forget to emerge the following before your install is finished:

  • cryptsetup
  • lvm2
  • a bootloader (grub recommended)
  • kernel sources

Editing the fstab

Fire up your favorite text editor to edit /etc/fstab. You want to put the following in the file:

   /etc/fstab
# <fs>                  <mountpoint>  <type>    <opts>                          <dump/pass>
/dev/sda1               /boot         ext2      noauto,noatime                  1 2
/dev/mapper/vg-swap     none          swap      sw                              0 0
/dev/mapper/vg-root     /             ext4      noatime,nodiratime,defaults     0 1
/dev/sr0                /mnt/cdrom    auto      noauto,ro                       0 0
/dev/mapper/vg-portage  /usr/portage  ext4      noatime,nodiratime              0 0
/dev/mapper/vg-home     /home         ext4      noatime,nodiratime              0 0

Kernel options

   Note

This part is particularly important: pay close attention.


Note: If you are using debian-sources as included in mid-May 2015 and later Funtoo stages, you do not need to rebuild the kernel. The following instructions are for other kernels that you may choose to install.

General setup --->
      [*] Initial RAM filesystem and RAM disk (initramfs/initrd) support
Device Drivers --->
      Generic Driver Options ---> 
      [*] Maintain a devtmpfs filesystem to mount at /dev
Device Drivers --->
      [*] Multiple devices driver support --->
      <*>Device Mapper Support
        <*> Crypt target support
Cryptographic API --->
      <*> XTS support
      -*-AES cipher algorithms

Initramfs setup and configuration

Better-initramfs

   Note

As of August 2016, better-initramfs is not required with debian-sources as included in current Funtoo stages. Unless you are doing something not with debian-sources as comes with the Funtoo stage, you can safely skip to the section on editing /etc/boot.conf.

Build your initramfs with better-initramfs project.

   Note

better-initramfs supports neither dynamic modules nor udev, so you should compile your kernel with built-in support for your block devices and file system support.

root # cd /opt
root # git clone https://bitbucket.org/piotrkarbowski/better-initramfs.git
root # cd better-initramfs
root # less README.rst
root # bootstrap/bootstrap-all
root # make prepare
root # make image

Copy resulting initramfs.cpio.gz to /boot:

root # cp output/initramfs.cpio.gz /boot

Alternatively, a pre-compiled binary initramfs is available at https://bitbucket.org/piotrkarbowski/better-initramfs/downloads

root # wget https://bitbucket.org/piotrkarbowski/better-initramfs/downloads/release-x86_64-v0.7.2.tar.bz2
root # tar xf release-x86_64-v0.5.tar.bz2
root # cd release*
root # gzip initramfs.cpio
root # cp initramfs.cpio.gz /boot

Remember, better-initramfs project is a work in progress, so you need to update from time to time. It can be done easily with git. Go to the better-initramfs source dir and follow:

root # cd /opt/better-initramfs
root # git pull
root # less ChangeLog
   Note

Please read the ChangeLog carefuly and perform necessary updates to /etc/boot.conf. Also, please backup the working /boot/initramfs.cpio.gz and /etc/boot.conf before updating better-initramfs.

Alternatively and much faster is to install better-initramfs-bin package, recently added to Funtoo's portage tree:

root # emerge better-initramfs-bin

Genkernel

Funtoo's genkernel capable to create initramfs for encrypted drive. Compile and install kernel and initramfs of your favorite kernel sources:

root # genkernel --kernel-config=/path/to/your/custom-kernel-config --no-mrproper --makeopts=-j5 --install --lvm --luks all 

Bootloader Configuration

Grub2 configuration

Emerge Grub2 with device-mapper support

root # echo 'sys-boot/grub device-mapper' >> /etc/portage/package.use/grub
root # emerge grub

better-initramfs

An example /etc/boot.conf for better-initramfs:

boot {
  generate grub
  default "Funtoo Linux"
  timeout 3
}
"Funtoo Linux" {
  kernel vmlinuz[-v]
  initrd /initramfs.cpio.gz
  params += enc_root=/dev/sda3 lvm luks root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
}

Now, run boot-update to write the configuration files to /boot/grub/grub.cfg

genkernel

Configure the bootloader as described above, with correct kernel and initramfs images names. An example for genkernel and grub2. You will be editing /etc/boot.conf:

boot {
  generate grub
  default "Funtoo Linux"
  timeout 3
}
"Funtoo Linux" {
  kernel kernel-genkernel-x86_64-3.13.0
  initrd initramfs-genkernel-x86_64-3.13.0
  params += crypt_root=/dev/sda3 dolvm real_root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
}

Lilo configuration

For oldschool geeks, an example for lilo bootloader. Emerge lilo with device-mapper support

root # echo 'sys-boot/lilo device-mapper' >> /etc/portage/package.use/lilo
root # emerge lilo

Example /etc/lilo.conf for genkernel:

append="init=/linuxrc dolvm crypt_root=/dev/sda2 real_root=/dev/mapper/vg-root"
boot=/dev/sda
compact
default=funtoo
lba32
prompt
read-only
timeout=50
image=/boot/kernel-genkernel-x86_64-3.13.0
initrd=/boot/initramfs-genkernel-x86_64-3.13.0
label=funtoo

Syslinux bootloader setup

Syslinux is another advanced bootloader which you can find on all live CD's. Syslinux bootloader does not require additional BIOS boot partition. /dev/sda2 is the root partition.

root # emerge syslinux
root # mkdir /boot/extlinux
root # extlinux --install /boot/extlinux
root # dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/mbr.bin of=/dev/sda
- or -
root # sgdisk /dev/sda --attributes=1:set:2
root # dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/gptmbr.bin of=/dev/sda, for GPT partition

Example /boot/extlinux/extlinux.conf for better-initramfs:

LABEL kernel1_bzImage-3.2.1
MENU LABEL Funtoo Linux bzImage-3.2.1
LINUX /bzImage-3.2.1
INITRD /initramfs.cpio.gz
APPEND rootfstype=ext4 luks enc_root=/dev/sda2 lvm root=/dev/mapper/vg-root

Final steps

Umount everything, close encrypted drive and reboot

root # umount -l -v /mnt/funtoo/{dev, proc, home, usr/portage, boot} 
root # vgchange -a n
root # cryptsetup luksClose dmcrypt_root

After reboot you will get the following:

>>> better-initramfs started. Kernel version 2.6.35-gentoo-r10
>>> Create all the symlinks to /bin/busybox.
>>> Initiating /dev/dir
>>> Getting LVM volumes up (if any)
Reding all physical volumes. This make take awhile...
No volume group found
No volume group found
>>> Opening encrypted partition and mapping to /dev/mapper/dmcrypt_root
Enter passphrase fore /dev/sda2:

Type your password

>>> Again, getting LVM volumes up (if any, after map dmcrypt).
  Reading all physical volumes.  This may take a while...
  Found volume group "vg" using metadata type lvm2
  4 logical volume(s) in volume group "vg" now active
>>> Mounting rootfs to /newroot
>>> Umounting /sys and /proc.
>>> Switching root to /newroot and executing /sbin/init.
INIT: version 2.88 booting
Loading /libexec/rc/console/keymap
  OpenRC 0.6.1 is starting up Funtoo Linux (x86_64)
...boot messages omitted for clarity
   
orion login: oleg
Password:
Last login: Thu Oct 14 20:49:21 EEST 2010 on tty1
oleg@orion ~ %

Additional links and information