Difference between revisions of "Rootfs over encrypted lvm"

Revision as of 14:33, December 24, 2020

This howto describes how to setup LVM, swap, and root with dmcrypt LUKS. It is a standalone installation walk through, based on the official installations finished product. boot is not encrypted.

Prepare the hard drive and partitions

List the device to be partitioned, mine is on /dev/sdc

root # lsblk -o name,size,label,partlabel

Partition

root # cgdisk /dev/sdc

delete everything.

Command:  new ↵
First sector: ↵
Last sector: +1M ↵
Hex Code: EF02 ↵
Enter name: BIOS Boot ↵

scroll down to large chunk of free space:

Command: new ↵
First sector: ↵
Last sector: +128M ↵
Hex Code: EF00 ↵
Enter name: BOOT ↵

scroll down to large chunk of free space:

Command: new ↵
First sector: ↵
Last sector: ↵
Hex Code:  8304 ↵
Enter name: FUNTOO ↵

Disk Drive: /dev/sdc
                            Size: 62333952, 29.7 GiB

Part. #     Size        Partition Type            Partition Name
----------------------------------------------------------------
            1007.0 KiB  free space
   1        1024.0 KiB  BIOS boot partition	  BIOS Boot
   2        256.0 MiB   EFI System                BOOT
   3        29.5 GiB    Linux x86-64 root (/)     FUNTOO

Command: write ↵
Command: quit ↵

Encrypting the drive

luks2 is not backwards compatible, and requires grub 9999 git latest. grub 2.04 does not support luks2 yet. stick with luks1.

root # cryptsetup luksFormat /dev/sdc3

Unlock the volume

Unlock the volume:

root #cryptsetup luksOpen /dev/sdc3 dmcrypt_root

Create logical volumes

root # pvcreate /dev/mapper/dmcrypt_root
root # vgcreate vg /dev/mapper/dmcrypt_root          
root # lvcreate -L2G --name swap vg
root # lvcreate -l 100%FREE --name root vg

Create a filesystem on volumes

root # mkfs.vfat -F 32 /dev/sdc2
root # fatlabel /dev/sdc2 "BOOT"
root # mkswap /dev/mapper/vg-swap
root # mkfs.ext4 /dev/mapper/vg-root

Mount your partitions

root # swapon /dev/mapper/vg-swap
root # mkdir /mnt/funtoo
root # mount /dev/mapper/vg-root /mnt/funtoo
root # mkdir  /mnt/funtoo/boot
root # mount /dev/sdc2 /mnt/funtoo/boot

Get Funtoo Gnome

You can pull your Subarches gnome tarball if you wish:

root # cd /mnt/funtoo
root # wget https://build.funtoo.org/1.4-release-std/x86-64bit/generic_64/gnome-latest.tar.xz
root # tar --numeric-owner --xattrs --xattrs-include='*' -xpf *gnome* && rm -f *gnome*

Load Funtoo

mount

mount up:

root # cd /mnt/funtoo && mount -t proc none proc
mount --rbind /sys sys
mount --rbind /dev dev

chroot

chroot in:

root # env -i HOME=/root TERM=$TERM $(which chroot) /mnt/funtoo bash -l

Set yo password:
set yo hostname:
set cloudflare dns resolution for installing:
Set yo time zone:

root # passwd
root # echo 'hostname="crypto"' > /etc/conf.d/hostname
root # echo "nameserver 1.1.1.1" > /etc/resolv.conf
root # ln -sf /usr/share/zoneinfo/America/Detroit /etc/localtime

fstab

Deploy your fstab:

root # cat > /etc/fstab << "EOF"
LABEL=BOOT /boot vfat noauto,noatime 1 2
/dev/mapper/vg-swap none swap sw 0 0
/dev/mapper/vg-root / ext4 noatime,nodiratime,defaults 0 1
tmpfs /var/tmp/portage tmpfs uid=portage,gid=portage,mode=775,noatime 0 0
root #tmpfs /var/tmp/portage tmpfs size=2G,uid=portage,gid=portage,mode=775,noatime 0 0
EOF

Deploy your crypttab:

root # echo "dmcrypt_root PARTLABEL=FUNTOO none luks,discard" >> /etc/crypttab

compile in ram

compile in ram:

root # mkdir /var/tmp/portage
root # chown portage:portage /var/tmp/portage
root # mount /var/tmp/portage

Sync:

root # ego sync

Deploy your ego profile:

root # ego profile mix-in encrypted-root

Deploy your package.use file:

root # cat > /etc/portage/package.use << "EOF"
*/* device-mapper lvm luks
sys-kernel/linux-firmware initramfs
EOF

merge stuff:

root # emerge grub haveged intel-microcode linux-firmware eix cryptsetup lvm2 debian-sources debian-sources-lts && emerge -vuND @world && emerge --depclean

add required services:

root # rc-update add device-mapper sysinit
root # rc-update add dmcrypt sysinit
root # rc-update add haveged && rc-update add gpm && rc-update add busybox-ntpd

deploy dmtab:

root # dmsetup table >> /etc/dmtab

Bootloader Configuration

deploy boot.conf

Warning

uuid is the only known working method of loading crypt_root. even /dev/sdc will not load it.

root # cat > /etc/boot.conf << "EOF"
boot {
  generate grub
  default "Funtoo Linux"
  timeout 3
}
"Funtoo Linux" {
	kernel kernel[-v]
	initrd initramfs[-v]
  params += crypt_root=UUID=a5ca52dc-d00a-40f9-8666-31d9021de327 dolvm real_root=/dev/mapper/vg-root ro rootfstype=auto resume=swap:/dev/mapper/vg-swap quiet
}
EOF

GRUB

Install grub:

root # grub-install --target=i386-pc /dev/sdc 
root # grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id="BOOT" --recheck -no-nvram /dev/sdc
root # ego boot update

Final steps

exit chroot, unmount, and close encrypted drive.

root # exit
root # swapoff /dev/dm-1
root # cd ..
root # umount -lR funtoo
root # vgchange -a n
root # cryptsetup luksClose dmcrypt_root

management

Change your LUKs-encrypted drive's passphrase

You may want to change your encrypted volume’s passphrase or password from time to time. To do so, run the following commands in the console as root:

root # cryptsetup luksChangeKey /dev/sdx3

You'll be prompted to enter in the existing passphrase first, then to enter in your new passphrase. You will not be asked to confirm your new passphrase, so be careful when running this operation.

Additional links and information

@@ Line 58: / Line 58: @@
 == Encrypting the drive ==
+*luks2 is not backwards compatible, and requires grub 9999 git latest.  grub 2.04 does not support luks2 yet.  stick with luks1.
 {{console|body=
-# ##i##cryptsetup luksFormat --type luks2 --label=FUNTOO /dev/sdc3
+# ##i##cryptsetup luksFormat /dev/sdc3
 }}
@@ Line 106: / Line 106: @@
 ==Load Funtoo==
-*expand your run tmpfs to be half of your ram:
-{{console|body=
-###i## mount -t tmpfs tmpfs /run
-}}
 === mount ===
 *mount up:
@@ Line 117: / Line 112: @@
 mount --rbind /sys sys
 mount --rbind /dev dev
-mount --rbind /run run
 }}
@@ Line 123: / Line 117: @@
 *chroot in:
 {{console|body=
-###i## cd /mnt/funtoo && env -i HOME=/root TERM=$TERM chroot . bash -l
+###i## env -i HOME=/root TERM=$TERM $(which chroot) /mnt/funtoo bash -l
 }}
@@ Line 146: / Line 140: @@
 /dev/mapper/vg-swap none swap sw 0 0
 /dev/mapper/vg-root / ext4 noatime,nodiratime,defaults 0 1
-tmpfs /run tmpfs rw,nodev,nosuid 0 0
+tmpfs /var/tmp/portage tmpfs uid=portage,gid=portage,mode=775,noatime 0 0
+#tmpfs /var/tmp/portage tmpfs size=2G,uid=portage,gid=portage,mode=775,noatime 0 0
 EOF
 }}
@@ Line 153: / Line 148: @@
 {{console|body=
-###i## echo "dmcrypt_root PARTLABEL=FUNTOO none luks" >> /etc/crypttab
+###i## echo "dmcrypt_root PARTLABEL=FUNTOO none luks,discard" >> /etc/crypttab
 }}
@@ Line 159: / Line 154: @@
 *compile in ram:
 {{console|body=
-###i## echo 'PORTAGE_TMPDIR="/run"' > /etc/portage/make.conf
+###i## mkdir /var/tmp/portage
+###i## chown portage:portage /var/tmp/portage
+###i## mount /var/tmp/portage
 }}
@@ Line 176: / Line 173: @@
 ###i## cat > /etc/portage/package.use << "EOF"
 */* device-mapper lvm luks
-sys-fs/lvm2 static-libs
-sys-kernel/genkernel cryptsetup
-dev-libs/openssl static-libs
-dev-libs/json-c static-libs
-app-crypt/argon2 static-libs
-dev-libs/popt static-libs
-sys-fs/cryptsetup static
-dev-libs/libgpg-error static-libs
 sys-kernel/linux-firmware initramfs
 EOF
@@ Line 196: / Line 185: @@
 *add required services:
 {{console|body=
-###i## rc-update add device-mapper boot
+###i## rc-update add device-mapper sysinit
-###i## rc-update add dmcrypt boot
+###i## rc-update add dmcrypt sysinit
-###i## rc-update add lvm boot
-###i## rc-update add lvmetad boot
 ###i## rc-update add haveged && rc-update add gpm && rc-update add busybox-ntpd
 }}
@@ Line 208: / Line 195: @@
 }}
-== Bootloader Configuration ==
+=== Bootloader Configuration ===
-=== /etc/boot.conf ===
+*deploy boot.conf
+{{warning|uuid is the only known working method of loading crypt_root.  even /dev/sdc will not load it.}}
-<pre>
+{{console|body=
+###i## cat > /etc/boot.conf << "EOF"
 boot {
    generate grub
@@ Line 220: / Line 210: @@
 	kernel kernel[-v]
 	initrd initramfs[-v]
-   params += crypt_root=LABEL=FUNTOO dolvm luks=yes real_root=/dev/mapper/vg-root ro rootfstype=ext4 resume=swap:/dev/mapper/vg-swap
+   params += crypt_root=UUID=a5ca52dc-d00a-40f9-8666-31d9021de327 dolvm real_root=/dev/mapper/vg-root ro rootfstype=auto resume=swap:/dev/mapper/vg-swap quiet
 }
-</pre>
+EOF
+}}
 == GRUB ==
-*Install grub in legacy mode:
+*Install grub:
 {{console|body=
 ###i## grub-install --target=i386-pc /dev/sdc
-###i## ego boot update}}
+###i## grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id="BOOT" --recheck -no-nvram /dev/sdc
+###i## ego boot update
-=== EFI from Legacy ===
-*manually make efi directory:
-*remount /dev/sdc2 to /boot/efi:
-*install efi images:
-{{console|body=
-###i## mkdir /boot/efi
-###i## mount /dev/sdc2 /boot/efi
-###i## grub-install --target=x86_64-efi /boot/efi
-}}
-=== EFI from EFI ===
-{{console|body=
-###i##mount -o remount,rw /sys/firmware/efi/efivars
-###i##grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id="Funtoo Linux [GRUB]" --recheck /dev/sdc
-###i##ego boot update
 }}