Difference between revisions of "Rootfs over encrypted lvm"
(→Bootloader Configuration: warn that partuuid, partlabel, luks2 label, and /dev/sdc absolutely will not load the encrypted root partition.) |
|||
(31 intermediate revisions by the same user not shown) | |||
Line 1: | Line 1: | ||
This howto describes how to setup LVM and | This howto describes how to setup LVM, swap, and root with dmcrypt LUKS. It is a standalone installation walk through, based on the official installations finished product. boot is not encrypted. | ||
== Prepare the hard drive and partitions == | == Prepare the hard drive and partitions == | ||
Line 58: | Line 58: | ||
== Encrypting the drive == | == Encrypting the drive == | ||
*luks2 is not backwards compatible, and requires grub 9999 git latest. grub 2.04 does not support luks2 yet. stick with luks1. | |||
{{console|body= | {{console|body= | ||
# ##i##cryptsetup luksFormat /dev/sdc3 | # ##i##cryptsetup luksFormat /dev/sdc3 | ||
}} | }} | ||
== Unlock the volume == | |||
Unlock the volume: | |||
{{console|body= | {{console|body= | ||
# ##i##cryptsetup | ###i##cryptsetup luksOpen /dev/sdc3 dmcrypt_root | ||
}} | }} | ||
== Create logical volumes == | |||
= | |||
= Create logical volumes = | |||
{{console|body= | {{console|body= | ||
# ##i##pvcreate /dev/mapper/dmcrypt_root | ###i## pvcreate /dev/mapper/dmcrypt_root | ||
# ##i##vgcreate vg /dev/mapper/dmcrypt_root | ###i## vgcreate vg /dev/mapper/dmcrypt_root | ||
# ##i##lvcreate -L2G --name swap vg | ###i## lvcreate -L2G --name swap vg | ||
# ##i##lvcreate -l 100%FREE --name root vg | ###i## lvcreate -l 100%FREE --name root vg | ||
}} | }} | ||
== Create a filesystem on volumes == | === Create a filesystem on volumes === | ||
{{console|body= | {{console|body= | ||
###i## mkfs.vfat -F 32 /dev/sdc2 | ###i## mkfs.vfat -F 32 /dev/sdc2 | ||
###i## fatlabel /dev/sdc2 "BOOT" | ###i## fatlabel /dev/sdc2 "BOOT" | ||
# ##i##mkswap /dev/mapper/vg-swap | ###i## mkswap /dev/mapper/vg-swap | ||
# ##i##mkfs.ext4 /dev/mapper/vg-root | ###i## mkfs.ext4 /dev/mapper/vg-root | ||
}} | }} | ||
== | === Mount your partitions === | ||
{{console|body= | {{console|body= | ||
# ##i##swapon /dev/mapper/vg-swap | ###i## swapon /dev/mapper/vg-swap | ||
# ##i##mkdir /mnt/funtoo | ###i## mkdir /mnt/funtoo | ||
# ##i##mount /dev/mapper/vg-root /mnt/funtoo | ###i## mount /dev/mapper/vg-root /mnt/funtoo | ||
# ##i##mkdir /mnt/funtoo/boot | ###i## mkdir /mnt/funtoo/boot | ||
# ##i##mount /dev/sdc2 /mnt/funtoo/boot | ###i## mount /dev/sdc2 /mnt/funtoo/boot | ||
}} | }} | ||
Line 117: | Line 106: | ||
==Load Funtoo== | ==Load Funtoo== | ||
=== mount === | |||
*mount up: | *mount up: | ||
{{console|body= | {{console|body= | ||
Line 127: | Line 112: | ||
mount --rbind /sys sys | mount --rbind /sys sys | ||
mount --rbind /dev dev | mount --rbind /dev dev | ||
}} | }} | ||
=== chroot === | |||
*chroot in: | *chroot in: | ||
{{console|body= | {{console|body= | ||
###i## | ###i## env -i HOME=/root TERM=$TERM $(which chroot) /mnt/funtoo bash -l | ||
}} | }} | ||
Line 139: | Line 124: | ||
*set cloudflare dns resolution for installing: | *set cloudflare dns resolution for installing: | ||
*Set yo time zone: | *Set yo time zone: | ||
{{console|body= | {{console|body= | ||
###i## passwd | ###i## passwd | ||
Line 146: | Line 132: | ||
}} | }} | ||
=== fstab === | |||
*Deploy your fstab: | *Deploy your fstab: | ||
{{console|body= | {{console|body= | ||
###i## cat > /etc/fstab << "EOF" | ###i## cat > /etc/fstab << "EOF" | ||
Line 152: | Line 140: | ||
/dev/mapper/vg-swap none swap sw 0 0 | /dev/mapper/vg-swap none swap sw 0 0 | ||
/dev/mapper/vg-root / ext4 noatime,nodiratime,defaults 0 1 | /dev/mapper/vg-root / ext4 noatime,nodiratime,defaults 0 1 | ||
tmpfs / | tmpfs /var/tmp/portage tmpfs uid=portage,gid=portage,mode=775,noatime 0 0 | ||
#tmpfs /var/tmp/portage tmpfs size=2G,uid=portage,gid=portage,mode=775,noatime 0 0 | |||
EOF | EOF | ||
}} | }} | ||
*Deploy your crypttab: | |||
{{console|body= | |||
###i## echo "dmcrypt_root PARTLABEL=FUNTOO none luks,discard" >> /etc/crypttab | |||
}} | |||
=== compile in ram === | |||
*compile in ram: | *compile in ram: | ||
{{console|body= | {{console|body= | ||
###i## | ###i## mkdir /var/tmp/portage | ||
###i## chown portage:portage /var/tmp/portage | |||
###i## mount /var/tmp/portage | |||
}} | |||
*Sync: | |||
{{console|body= | |||
###i## ego sync | |||
}} | }} | ||
Line 169: | Line 172: | ||
{{console|body= | {{console|body= | ||
###i## cat > /etc/portage/package.use << "EOF" | ###i## cat > /etc/portage/package.use << "EOF" | ||
*/* device-mapper lvm luks | |||
sys-kernel/linux-firmware initramfs | sys-kernel/linux-firmware initramfs | ||
EOF | EOF | ||
Line 185: | Line 178: | ||
*merge stuff: | *merge stuff: | ||
{{console|body= | {{console|body= | ||
###i## | ###i## emerge grub haveged intel-microcode linux-firmware eix cryptsetup lvm2 debian-sources debian-sources-lts && emerge -vuND @world && emerge --depclean | ||
}} | }} | ||
= | *add required services: | ||
{{console|body= | |||
###i## rc-update add device-mapper sysinit | |||
###i## rc-update add dmcrypt sysinit | |||
###i## rc-update add haveged && rc-update add gpm && rc-update add busybox-ntpd | |||
}} | |||
*deploy dmtab: | |||
{{console|body= | |||
###i## dmsetup table >> /etc/dmtab | |||
}} | |||
} | |||
=== Bootloader Configuration === | |||
*deploy boot.conf | |||
{{warning|uuid is the only known working method of loading crypt_root. even /dev/sdc will not load it.}} | |||
< | {{console|body= | ||
###i## cat > /etc/boot.conf << "EOF" | |||
boot { | boot { | ||
generate grub | generate grub | ||
Line 219: | Line 210: | ||
kernel kernel[-v] | kernel kernel[-v] | ||
initrd initramfs[-v] | initrd initramfs[-v] | ||
params += crypt_root= | params += crypt_root=UUID=a5ca52dc-d00a-40f9-8666-31d9021de327 dolvm real_root=/dev/mapper/vg-root ro rootfstype=auto resume=swap:/dev/mapper/vg-swap quiet | ||
} | } | ||
EOF | |||
}} | |||
== GRUB == | == GRUB == | ||
*Install grub | *Install grub: | ||
{{console|body= | {{console|body= | ||
###i## grub-install --target=i386-pc /dev/sdc | ###i## grub-install --target=i386-pc /dev/sdc | ||
###i## | ###i## grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id="BOOT" --recheck -no-nvram /dev/sdc | ||
###i## ego boot update | |||
= | |||
###i## | |||
}} | }} | ||
=== Final steps === | |||
exit chroot, unmount, and close encrypted drive. | |||
{{console|body= | {{console|body= | ||
###i## exit | ###i## exit | ||
###i## swapoff /dev/dm-1 | ###i## swapoff /dev/dm-1 | ||
###i## cd .. | ###i## cd .. | ||
###i## umount -lR funtoo | ###i## umount -lR funtoo | ||
# ##i##vgchange -a n | ###i## vgchange -a n | ||
# ##i##cryptsetup luksClose dmcrypt_root | ###i## cryptsetup luksClose dmcrypt_root | ||
}} | }} | ||
==management== | ==management== | ||
Line 299: | Line 240: | ||
{{console|body= | {{console|body= | ||
# ##i##cryptsetup luksChangeKey /dev/ | # ##i##cryptsetup luksChangeKey /dev/sdx3 | ||
}} | }} | ||
You'll be prompted to enter in the existing passphrase first, then to enter in your new passphrase. | You'll be prompted to enter in the existing passphrase first, then to enter in your new passphrase. | ||
You will not be asked to confirm your new passphrase, so be careful when running this operation. | You will not be asked to confirm your new passphrase, so be careful when running this operation. | ||
== Additional links and information == | == Additional links and information == | ||
* [https://www.freedesktop.org/software/systemd/man/crypttab.html crypttab] | |||
* [[gentoo-wiki:Root filesystem over LVM2, DM-Crypt and RAID|Root filesystem over LVM2, DM-Crypt, and RAID]] | * [[gentoo-wiki:Root filesystem over LVM2, DM-Crypt and RAID|Root filesystem over LVM2, DM-Crypt, and RAID]] | ||
* [http://wiki.archlinux.org/index.php/System_Encryption_with_LUKS_for_dm-crypt System Encryption with LUKS for dm-crypt] | * [http://wiki.archlinux.org/index.php/System_Encryption_with_LUKS_for_dm-crypt System Encryption with LUKS for dm-crypt] | ||
* [https://wiki.archlinux.org/index.php/Dm-crypt/Encrypting_an_entire_system#LVM_on_LUKS arch encrypt entire system] | |||
* [http://en.wikipedia.org/wiki/Logical_volume_management Wikipedia article on LVM] | * [http://en.wikipedia.org/wiki/Logical_volume_management Wikipedia article on LVM] | ||
* [https://wiki.archlinux.org/index.php/Dm-crypt_with_LUKS Arch Wiki article] | * [https://wiki.archlinux.org/index.php/Dm-crypt_with_LUKS Arch Wiki article] | ||
[[Category:HOWTO]] | [[Category:HOWTO]] |
Revision as of 14:33, December 24, 2020
This howto describes how to setup LVM, swap, and root with dmcrypt LUKS. It is a standalone installation walk through, based on the official installations finished product. boot is not encrypted.
Prepare the hard drive and partitions
- List the device to be partitioned, mine is on /dev/sdc
root # lsblk -o name,size,label,partlabel
Partition
root # cgdisk /dev/sdc
delete everything.
Command: new ↵ First sector: ↵ Last sector: +1M ↵ Hex Code: EF02 ↵ Enter name: BIOS Boot ↵
scroll down to large chunk of free space:
Command: new ↵ First sector: ↵ Last sector: +128M ↵ Hex Code: EF00 ↵ Enter name: BOOT ↵
scroll down to large chunk of free space:
Command: new ↵ First sector: ↵ Last sector: ↵ Hex Code: 8304 ↵ Enter name: FUNTOO ↵
Disk Drive: /dev/sdc Size: 62333952, 29.7 GiB Part. # Size Partition Type Partition Name ---------------------------------------------------------------- 1007.0 KiB free space 1 1024.0 KiB BIOS boot partition BIOS Boot 2 256.0 MiB EFI System BOOT 3 29.5 GiB Linux x86-64 root (/) FUNTOO
Command: write ↵ Command: quit ↵
Encrypting the drive
- luks2 is not backwards compatible, and requires grub 9999 git latest. grub 2.04 does not support luks2 yet. stick with luks1.
root # cryptsetup luksFormat /dev/sdc3
Unlock the volume
Unlock the volume:
root #cryptsetup luksOpen /dev/sdc3 dmcrypt_root
Create logical volumes
root # pvcreate /dev/mapper/dmcrypt_root root # vgcreate vg /dev/mapper/dmcrypt_root root # lvcreate -L2G --name swap vg root # lvcreate -l 100%FREE --name root vg
Create a filesystem on volumes
root # mkfs.vfat -F 32 /dev/sdc2 root # fatlabel /dev/sdc2 "BOOT" root # mkswap /dev/mapper/vg-swap root # mkfs.ext4 /dev/mapper/vg-root
Mount your partitions
root # swapon /dev/mapper/vg-swap root # mkdir /mnt/funtoo root # mount /dev/mapper/vg-root /mnt/funtoo root # mkdir /mnt/funtoo/boot root # mount /dev/sdc2 /mnt/funtoo/boot
Get Funtoo Gnome
You can pull your Subarches gnome tarball if you wish:
root # cd /mnt/funtoo root # wget https://build.funtoo.org/1.4-release-std/x86-64bit/generic_64/gnome-latest.tar.xz root # tar --numeric-owner --xattrs --xattrs-include='*' -xpf *gnome* && rm -f *gnome*
Load Funtoo
mount
- mount up:
root # cd /mnt/funtoo && mount -t proc none proc mount --rbind /sys sys mount --rbind /dev dev
chroot
- chroot in:
root # env -i HOME=/root TERM=$TERM $(which chroot) /mnt/funtoo bash -l
- Set yo password:
- set yo hostname:
- set cloudflare dns resolution for installing:
- Set yo time zone:
root # passwd root # echo 'hostname="crypto"' > /etc/conf.d/hostname root # echo "nameserver 1.1.1.1" > /etc/resolv.conf root # ln -sf /usr/share/zoneinfo/America/Detroit /etc/localtime
fstab
- Deploy your fstab:
root # cat > /etc/fstab << "EOF" LABEL=BOOT /boot vfat noauto,noatime 1 2 /dev/mapper/vg-swap none swap sw 0 0 /dev/mapper/vg-root / ext4 noatime,nodiratime,defaults 0 1 tmpfs /var/tmp/portage tmpfs uid=portage,gid=portage,mode=775,noatime 0 0 root #tmpfs /var/tmp/portage tmpfs size=2G,uid=portage,gid=portage,mode=775,noatime 0 0 EOF
- Deploy your crypttab:
root # echo "dmcrypt_root PARTLABEL=FUNTOO none luks,discard" >> /etc/crypttab
compile in ram
- compile in ram:
root # mkdir /var/tmp/portage root # chown portage:portage /var/tmp/portage root # mount /var/tmp/portage
- Sync:
root # ego sync
- Deploy your ego profile:
root # ego profile mix-in encrypted-root
- Deploy your package.use file:
root # cat > /etc/portage/package.use << "EOF" */* device-mapper lvm luks sys-kernel/linux-firmware initramfs EOF
- merge stuff:
root # emerge grub haveged intel-microcode linux-firmware eix cryptsetup lvm2 debian-sources debian-sources-lts && emerge -vuND @world && emerge --depclean
- add required services:
root # rc-update add device-mapper sysinit root # rc-update add dmcrypt sysinit root # rc-update add haveged && rc-update add gpm && rc-update add busybox-ntpd
- deploy dmtab:
root # dmsetup table >> /etc/dmtab
Bootloader Configuration
- deploy boot.conf
uuid is the only known working method of loading crypt_root. even /dev/sdc will not load it.
root # cat > /etc/boot.conf << "EOF" boot { generate grub default "Funtoo Linux" timeout 3 } "Funtoo Linux" { kernel kernel[-v] initrd initramfs[-v] params += crypt_root=UUID=a5ca52dc-d00a-40f9-8666-31d9021de327 dolvm real_root=/dev/mapper/vg-root ro rootfstype=auto resume=swap:/dev/mapper/vg-swap quiet } EOF
GRUB
- Install grub:
root # grub-install --target=i386-pc /dev/sdc root # grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id="BOOT" --recheck -no-nvram /dev/sdc root # ego boot update
Final steps
exit chroot, unmount, and close encrypted drive.
root # exit root # swapoff /dev/dm-1 root # cd .. root # umount -lR funtoo root # vgchange -a n root # cryptsetup luksClose dmcrypt_root
management
Change your LUKs-encrypted drive's passphrase
You may want to change your encrypted volume’s passphrase or password from time to time. To do so, run the following commands in the console as root:
root # cryptsetup luksChangeKey /dev/sdx3
You'll be prompted to enter in the existing passphrase first, then to enter in your new passphrase. You will not be asked to confirm your new passphrase, so be careful when running this operation.