Difference between revisions of "Rootfs over encrypted lvm"

From Funtoo
Jump to navigation Jump to search
m (declutter, add some undead usb services, move the grub configuration much much closer to a known working line.... this SHOULD be the first working configuration since the 2018 edits... now that we have a working system, we can refine the process.)
m (→‎Install a bootloader: - Fix error caused by wiki markup misinterpreting pipe char)
(21 intermediate revisions by 4 users not shown)
Line 1: Line 1:
This howto describes how to setup LVM, swap, and root with dmcrypt LUKS. It is a standalone installation walk through, based on the official installations finished product.  boot is not encrypted.
This howto describes how to setup LVM, swap, and root with dmcrypt LUKS. It is a standalone installation walk through, based on the official installations finished product.  boot is not encrypted.
{{warning| You may try this installation method at your own risk! Please note: this guide is outside of the official installation documentation and cannot be supported. If you choose to use this, we assume you know what you are doing and you are on your own.}}


== Prepare the hard drive and partitions ==
== Prepare the hard drive and partitions ==
*List the device to be partitioned, mine is on /dev/sdc
*Before you begin, make sure you are partitioning the correct drive. For the rest of this tutorial, we will be using /dev/sdX as a placeholder.
{{console|body=
{{console|body=
###i## lsblk -o name,size,label,partlabel
###i## lsblk
NAME          MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
sda            8:0    0  1.8T  0 disk
├─sda1          8:1    0  512M  0 part
├─sda2          8:2    0    8G  0 part [SWAP]
└─sda3          8:3    0  1.8T  0 part
  ├─main-root 254:0    0  500G  0 lvm  /
  └─main-data 254:1    0  1.3T  0 lvm  /home
}}
}}


==Partition==
==Partition==
=== MBR [BIOS] Partitioning ===
{{Note|Use this method if you are booting using your BIOS, and if your Funtoo LiveCD initial boot menu was light blue. If you're going to use the UEFI/GPT disk format, then please proceed to the next section.}}
{{console|body=
{{console|body=
###i## cgdisk /dev/sdc}}
###i## fdisk /dev/sdX
}}


delete everything.
Within {{c|fdisk}}, follow these steps:
 
'''Empty the partition table''':


{{console|body=
{{console|body=
Command: ##i## new ↵
Command (m for help): ##i##o
First sector: ##i##↵
Last sector: ##i##+1M ↵
Hex Code: ##i##EF02 ↵
Enter name: ##i##BIOS Boot
}}
}}


scroll down to large chunk of free space:
'''Create boot partition''':
 
{{console|body=
{{console|body=
Command: ##i##new
Command (m for help): ##i##n ↵
Partition type (default p): ##i##↵
Partition number (1-4, default 1): ##i##↵
First sector: ##i##↵
First sector: ##i##↵
Last sector: ##i##+128M ↵
Last sector: ##i##+128M ↵
Hex Code: ##i##EF00 ↵
Enter name: ##i##BOOT ↵
}}
}}


scroll down to large chunk of free space:
'''Create partition which will be encrypted with LUKS''':
 
{{console|body=
{{console|body=
Command: ##i##new
Command (m for help): ##i##n ↵
Partition type (default p): ##i##↵
Partition number (2-4, default 2): ##i##↵
First sector: ##i##↵
First sector: ##i##↵
Last sector: ##i##↵
Last sector: ##i##↵
Hex Code: ##i## 8304 ↵
Enter name: ##i##FUNTOO ↵
}}
}}
'''Verify the partition table''':


{{console|body=
{{console|body=
Command (m for help): ##i##p


                              Disk Drive: /dev/sdc
Disk /dev/sdX: 298.1 GiB, 320072933376 bytes, 625142448 sectors
                            Size: 62333952, 29.7 GiB
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x82abc9a6


Part. #     Size        Partition Type            Partition Name
Device    Boot     Start      End   Blocks Id System
----------------------------------------------------------------
/dev/sdX1          2048   264191   131072  83 Linux
            1007.0 KiB  free space
/dev/sdX2        4458496 625142447 312439128  83 Linux
   1        1024.0 KiB BIOS boot partition   BIOS Boot
  2        256.0 MiB  EFI System               BOOT
   3        29.5 GiB   Linux x86-64 root (/)    FUNTOO
}}
}}


'''Write the partition table to disk''':
{{console|body=Command (m for help): ##i##w}}
Your new MBR partition table will now be written to your system disk.
=== UEFI Partitioning ===
{{Note|Use this method if you are interested in booting using UEFI, and if your Funtoo LiveCD initial boot menu was black and white, or the system booted without a boot menu. If it was light blue, this method will not work. Instead, use the instructions in the previous section then skip this section, or reboot LiveCD in UEFI mode first.}}
{{console|body=###i## gdisk /dev/sdX}}
Within {{c|gdisk}}, follow these steps:
'''Empty the partition table''':
{{console|body=
{{console|body=
Command: ##i##write
Command: ##i##o
Command: ##i##quit
This option deletes all partitions and creates a new protective MBR.
Proceed? (Y/N): ##i##y
}}
}}


== Encrypting the drive ==
'''Create boot partition''':


{{console|body=
{{console|body=
# ##i##cryptsetup luksFormat --label=FUNTOO /dev/sdc3
Command: ##i##n ↵
Partition Number: ##i##1 ↵
First sector: ##i##↵
Last sector: ##i##+128M ↵
Hex Code: ##i##EF00 ↵
}}
}}


== Unlock the volume ==
'''Create partition which will be encrypted with LUKS''':
Unlock the volume:
 
{{console|body=
{{console|body=
###i##cryptsetup luksOpen /dev/sdc3 dmcrypt_root
Command: ##i##n ↵
Partition Number: ##i##2 ↵
First sector: ##i##↵
Last sector: ##i##↵##!i## (for rest of disk)
Hex Code: ##i##
}}
}}


== Create logical volumes ==
'''(Optional) Create disk labels''':
{{console|body=
{{console|body=
###i## pvcreate /dev/mapper/dmcrypt_root
Command: ##i##c ↵
###i## vgcreate vg /dev/mapper/dmcrypt_root         
Partition Number: ##i##1
###i## lvcreate -L2G --name swap vg
Enter name: ##i##BOOT
###i## lvcreate -l 100%FREE --name root vg
Command: ##i##c ↵
Partition Number: ##i##2
Enter name: ##i##ROOT
}}
}}


=== Create a filesystem on volumes ===
'''Write Partition Table To Disk''':


{{console|body=
{{console|body=
###i## mkfs.vfat -F 32 /dev/sdc2
Command: ##i##w ↵
###i## fatlabel /dev/sdc2 "BOOT"
Do you want to proceed? (Y/N): ##i##Y ↵
###i## mkswap /dev/mapper/vg-swap
###i## mkfs.ext4 /dev/mapper/vg-root
}}
}}
The partition table will now be written to the disk and {{c|gdisk}} will close.


=== Mount your partitions ===
==Create and mount filesystems.==
'''Create /boot filesystem '''
====For BIOS systems====
{{console|body=# ##i##mkfs.ext2 /dev/sdX1}}
 
====For UEFI systems====
{{console|body=# ##i##mkfs.vfat -F 32 /dev/sdX1}}
 
'''Create LUKS encrypted volume'''
{{Note| Cryptsetup now defaults to LUKS2, which is unsupported by stable versions of grub. This is why we are not encrypting /boot.}}
{{Warning| The debian-sources kernel in current stage3 tarballs does not allow for passwords in excess of 63 characters.}}


{{console|body=
{{console|body=
###i## swapon /dev/mapper/vg-swap
# ##i##cryptsetup luksFormat /dev/sdX2
###i## mkdir /mnt/funtoo
###i## mount /dev/mapper/vg-root /mnt/funtoo
###i## mkdir  /mnt/funtoo/boot
###i## mount /dev/sdc2 /mnt/funtoo/boot
}}
}}


==Get Funtoo Gnome==
'''Open newly created LUKS volume'''
You can pull your [[Subarches]] gnome tarball if you wish:
{{console|body=# ##i##cryptsetup open --type luks2 /dev/sdX2 root}}
 
'''Create LVM volumes for / and swap'''
{{console|body=# ##i##pvcreate /dev/mapper/root}}
{{console|body=# ##i##vgcreate vg /dev/mapper/root}}
{{Note|Replace "16G" with the amount of swap you would like to make available.}}
{{console|body=# ##i##lvcreate -L16G --name swap vg}}
{{console|body=# ##i##lvcreate -l 100%FREE --name root vg}}
{{Note|The "-l 100%FREE" option above will use the remainder of the disk for your root partition. If you would prefer to create separate for /home or /var (for example), you can instead continue to use the "-LXXG" option for fixed sizes.}}
 
'''Create filesystems on LVM volumes'''
{{console|body=# ##i##mkswap /dev/mapper/vg-swap}}
{{console|body=# ##i##mkfs.ext4 /dev/mapper/vg-root}}


{{console|body=
'''Create directories for chroot'''
###i## cd /mnt/funtoo
{{console|body=# ##i##mkdir -p /mnt/funtoo}}
###i## wget https://build.funtoo.org/1.4-release-std/x86-64bit/generic_64/gnome-latest.tar.xz
###i## tar --numeric-owner --xattrs --xattrs-include='*' -xpf *gnome* && rm -f *gnome*
}}


==Load Funtoo==
==Mount filesystems==
*expand your run tmpfs to be half of your ram:
{{console|body=# ##i##mount /dev/mapper/vg-root /mnt/funtoo}}
{{console|body=
{{console|body=# ##i##mkdir /mnt/funtoo/boot}}
###i## mount -t tmpfs tmpfs /run
{{console|body=# ##i##mount /dev/sdX1 /mnt/funtoo/boot}}
}}
{{console|body=# ##i##mkdir /mnt/funtoo/proc}}
{{console|body=# ##i##mount -t proc none /mnt/funtoo/proc}}
{{console|body=# ##i##mkdir /mnt/funtoo/dev}}
{{console|body=# ##i##mount --rbind /dev /mnt/funtoo/dev}}
{{console|body=# ##i##mkdir /mnt/funtoo/sys}}
{{console|body=# ##i##mount --rbind /sys /mnt/funtoo/sys}}


*mount up:
==Set the date==
{{console|body=
{{Note|See the official Funtoo docs on [https://www.funtoo.org/Install/Setting_the_Date setting the date].}}
###i## cd /mnt/funtoo && mount -t proc none proc
mount --rbind /sys sys
mount --rbind /dev dev
mount --rbind /run run
}}


*chroot in:
==Install the Funtoo starge tarball of your choice==
{{console|body=
{{Note|These instructions will be using the ''intel-haswell'' minimal stage3. You should adjust them accordingly}}
###i## cd /mnt/funtoo && env -i HOME=/root TERM=$TERM chroot . bash -l
}}


*Set yo password:
{{console|body=# ##i##cd /mnt/funtoo}}
*set yo hostname:
{{console|body=# ##i##wget https://build.funtoo.org/1.4-release-std/x86-64bit/intel64-haswell/2021-03-10/stage3-intel64-haswell-1.4-release-std-2021-03-10.tar.xz}}
*set cloudflare dns resolution for installing:
{{console|body=# ##i##tar --numeric-owner --xattrs --xattrs-include='*' -xpf stage3-intel64-haswell-1.4-release-std-2021-03-10.tar.xz && rm -f stage3-intel64-haswell-1.4-release-std-2021-03-10.tar.xz}}
*Set yo time zone:


{{console|body=
==Chroot into your new system==
###i## passwd
{{console|body=# ##i##env -i HOME=/root TERM=$TERM $(which chroot) /mnt/funtoo bash -l}}
###i## echo 'hostname="crypto"' > /etc/conf.d/hostname
###i## echo "nameserver 1.1.1.1" > /etc/resolv.conf
###i## ln -sf /usr/share/zoneinfo/America/Detroit /etc/localtime
}}


*Deploy your fstab:
==Configure your system==
'''Set a new root password'''
{{console|body=# ##i##passwd}}


{{console|body=
'''Set hostname'''
###i## cat > /etc/fstab << "EOF"
{{console|body=# ##i##echo 'hostname="yourdesiredhostname"' > /etc/conf.d/hostname}}
LABEL=BOOT /boot vfat noauto,noatime 1 2
/dev/mapper/vg-swap none swap sw 0 0
/dev/mapper/vg-root / ext4 noatime,nodiratime,defaults 0 1
tmpfs /run tmpfs rw,nodev,nosuid 0 0
EOF
}}


*Deploy your crypttab:
'''Set up DNS resolution'''
{{Note|We are using the Cloudflare DNS server address here. Feel free to use your own.}}
{{console|body=# ##i##echo "nameserver 1.1.1.1" > /etc/resolv.conf}}


{{console|body=
'''Set your timezone'''
###i## echo "dmcrypt_root PARTLABEL=FUNTOO none luks,discard" >> /etc/crypttab
{{console|body=# ##i##ln -sf /usr/share/zoneinfo/$(tzselect) /etc/localtime}}
}}


*compile in ram:
'''Note your filesystem information'''
{{console|body=# ##i##blkid}}
{{console|body=
{{console|body=
###i## echo 'PORTAGE_TMPDIR="/run"' > /etc/portage/make.conf
/dev/sdX1: UUID="6453-0C55" TYPE="vfat" PARTLABEL="efi" PARTUUID="4e195c4b-f88c-4205-b9df-79a879704b2f"
}}
/dev/sdX2: UUID="aafe709b-82e7-448f-a2cb-36adc3787dc3" TYPE="crypto_LUKS" PARTLABEL="system" PARTUUID="93d0cf9b-0b95-4d8b-919f-48cd1774996f"
/dev/mapper/root: UUID="hvz79n-I2VE-nR1c-0hDQ-PVkR-3GRb-rnuJ9C" TYPE="LVM2_member"
/dev/mapper/vg-swap: UUID="a9188bc3-7def-422b-990d-9de431825779" TYPE="swap"
/dev/mapper/vg-root: UUID="2eaf45e6-d33b-4155-b4ca-63a2fdbfb896" TYPE="ext4"}}


*Sync:
'''Configure /etc/fstab'''
{{console|body=
{{Note|The UUID parameter is set to the UUID of your boot partition as found from the blkid command above.}}
###i## ego sync
{{console|body=# ##i##cat > /etc/fstab << 'EOF'
}}
UUID=6453-0C55 /boot vfat noauto,noatime 1 2
/dev/mapper/vg-swap none swap sw 0 0
/dev/mapper/vg-root / ext4 noatime,nodiratime,defaults 0 1
EOF}}


*Deploy your ego profile:
'''Create /etc/crypttab'''
{{console|body=
{{Note|The UUID parameter is set to the UUID of /dev/sdX2 as found from the blkid command above.}}
###i## ego profile mix-in encrypted-root
{{console|body=# ##i##echo "root UUID=aafe709b-82e7-448f-a2cb-36adc3787dc3 none luks,discard" >> /etc/crypttab}}
}}


*Deploy your package.use file:
'''Create /etc/dmtab'''
{{console|body=
{{console|body=# ##i##dmsetup table >> /etc/dmtab}}
###i## cat > /etc/portage/package.use << "EOF"
sys-kernel/debian-sources lvm luks
sys-kernel/debian-sources-lts lvm luks
sys-boot/grub device-mapper
sys-fs/lvm2 static-libs
sys-kernel/genkernel cryptsetup
dev-libs/openssl static-libs
dev-libs/json-c static-libs
app-crypt/argon2 static-libs
dev-libs/popt static-libs
sys-fs/cryptsetup static
dev-libs/libgpg-error static-libs
sys-kernel/linux-firmware initramfs
EOF
}}


*merge stuff:
==Portage==
'''Download the portage tree'''
{{console|body=# ##i##ego sync}}


{{console|body=
'''Change your ego profile to include encrypted root support'''
###i## emerge grub haveged intel-microcode linux-firmware eix cryptsetup lvm2 debian-sources debian-sources-lts && emerge -vuND @world
{{console|body=# ##i##epro mix-in encrypted-root}}
}}


*add required services:
'''Edit package USE-flags'''
{{console|body=
{{console|body=# ##i##cat > /etc/portage/package.use <<'EOF'
###i## rc-update add device-mapper sysinit
*/* device-mapper lvm luks
###i## rc-update add dmcrypt sysinit
sys-kernel/linux-firmware initramfs
###i## rc-update add lvm sysinit
sys-fs/cryptsetup -dynamic
###i## rc-update add haveged && rc-update add gpm && rc-update add busybox-ntpd
EOF}}
}}


*deploy dmtab:
'''Install necessary packages'''
{{console|body=
{{console|body=# ##i##emerge grub haveged intel-microcode linux-firmware cryptsetup lvm2 genkernel iucode_tool}}
###i## dmsetup table >> /etc/dmtab
}}


== Bootloader Configuration ==
'''Configure services to start at boot'''
=== /etc/boot.conf ===
{{console|body=# ##i##rc-update add device-mapper sysinit}}
{{warning|the bootloader configuration is untested with partlabel, but known working under uuid.}}
{{console|body=# ##i##rc-update add dmcrypt sysinit}}
{{console|body=# ##i##rc-update add lvmetad sysinit}}
{{console|body=# ##i##rc-update add haveged default}}
{{console|body=# ##i##rc-update add busybox-ntpd default}}


<pre>
==Install a bootloader==
'''Configure /etc/boot.conf'''
{{Note|The UUID parameter is set to the UUID of /dev/sdX2 as found from the blkid command above.}}
{{console|body=# ##i##cat > /etc/boot.conf <<'EOF'
boot {
boot {
  generate grub
    generate grub
  default "Funtoo Linux"
    default "Funtoo Linux"
  timeout 3
    timeout 3
}
}
"Funtoo Linux" {
"Funtoo Linux" {
kernel kernel[-v]
    kernel kernel[-v]
initrd initramfs[-v]
    initrd initramfs[-v]
  params += crypt_root=PARTLABEL=FUNTOO dolvm luks=yes real_root=/dev/mapper/vg-root ro rootfstype=ext4 resume=swap:/dev/mapper/vg-swap
    params += crypt_root=UUID=aafe709b-82e7-448f-a2cb-36adc3787dc3 dolvm real_root=/dev/mapper/vg-root ro rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
}
}
</pre>
EOF}}
 
{{console|body=
###i## ego boot update
}}


== GRUB ==
'''Install GRUB'''
*Install grub in legacy mode:
====For BIOS systems====
{{console|body=
{{console|body=# ##i##grub-install --target=i386-pc --no-floppy /dev/sdX}}
###i## grub-install --target=i386-pc /dev/sdc
{{console|body=# ##i##ego boot update}}
###i## ego boot update}}


=== EFI from Legacy ===
====For UEFI systems====
{{console|body=# ##i##mount -o remount,rw /sys/firmware/efi/efivars}}
{{Note|For 32 bit systems, the following command should be changed to:
{{console|body=# ##i##grub-install --target=i386-efi --efi-directory=/boot --bootloader-id="Funtoo Linux" --recheck /dev/sdX}}}}
{{console|body=# ##i##grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id="Funtoo Linux" --recheck /dev/sdX}}
{{console|body=# ##i##ego boot update}}


*manually make efi directory:
'''Patch genkernel to include LUKS2 support'''
*remount /dev/sdc2 to /boot/efi:
{{console|body=# ##i##sed '/MODULES_CRYPT/ s/\"$/ af_alg algif_skcipher\"/' -i /usr/share/genkernel/arch/$(arch)/modules_load}}
*install efi images:
{{console|body=
###i## mkdir /boot/efi
###i## mount /dev/sdc2 /boot/efi
###i## grub-install --target=x86_64-efi /boot/efi
}}


=== EFI from EFI ===
'''Generate a new initramfs'''
{{console|body=# ##i##genkernel --clean --luks --lvm --disklabel --ramdisk-modules --fullname=$(ls /boot/initramfs-* {{!}} tail -c +17) initramfs}}


{{console|body=
==Finishing installation==
###i##mount -o remount,rw /sys/firmware/efi/efivars
From this point, you should be able to finish following the [https://www.funtoo.org/Install/Network official Funtoo Linux install instructions]
###i##grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id="Funtoo Linux [GRUB]" --recheck /dev/sdc
###i##ego boot update
}}
 
=== Final steps ===
exit chroot, unmount, and close encrypted drive.
 
{{console|body=
###i## exit
###i## swapoff /dev/dm-1
###i## cd ..
###i## umount -lR funtoo
###i## vgchange -a n
###i## cryptsetup luksClose dmcrypt_root
}}


==management==
==Managing your LUKS volume==
=== Change your LUKs-encrypted drive's passphrase ===
'''Change your LUKs-encrypted drive's passphrase'''
You may want to change your encrypted volume’s passphrase or password from time to time. To do so, run the following commands in the console as root:
You may want to change your encrypted volume’s passphrase or password from time to time. To do so, run the following commands in the console as root:



Revision as of 15:08, May 7, 2021

This howto describes how to setup LVM, swap, and root with dmcrypt LUKS. It is a standalone installation walk through, based on the official installations finished product. boot is not encrypted.

   Warning
You may try this installation method at your own risk! Please note: this guide is outside of the official installation documentation and cannot be supported. If you choose to use this, we assume you know what you are doing and you are on your own.

Prepare the hard drive and partitions

  • Before you begin, make sure you are partitioning the correct drive. For the rest of this tutorial, we will be using /dev/sdX as a placeholder.
root # lsblk
NAME          MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
sda             8:0    0  1.8T  0 disk 
├─sda1          8:1    0  512M  0 part 
├─sda2          8:2    0    8G  0 part [SWAP]
└─sda3          8:3    0  1.8T  0 part 
  ├─main-root 254:0    0  500G  0 lvm  /
  └─main-data 254:1    0  1.3T  0 lvm  /home

Partition

MBR [BIOS] Partitioning

   Note

Use this method if you are booting using your BIOS, and if your Funtoo LiveCD initial boot menu was light blue. If you're going to use the UEFI/GPT disk format, then please proceed to the next section.

root # fdisk /dev/sdX

Within fdisk, follow these steps:

Empty the partition table:

Command (m for help): o ↵

Create boot partition:

Command (m for help): n ↵
Partition type (default p): 
Partition number (1-4, default 1): 
First sector: 
Last sector: +128M ↵

Create partition which will be encrypted with LUKS:

Command (m for help): n ↵
Partition type (default p): 
Partition number (2-4, default 2): 
First sector: 
Last sector: 

Verify the partition table:

Command (m for help): p

Disk /dev/sdX: 298.1 GiB, 320072933376 bytes, 625142448 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x82abc9a6

Device    Boot     Start       End    Blocks  Id System
/dev/sdX1           2048    264191    131072  83 Linux
/dev/sdX2        4458496 625142447 312439128  83 Linux

Write the partition table to disk:

Command (m for help): w

Your new MBR partition table will now be written to your system disk.

UEFI Partitioning

   Note

Use this method if you are interested in booting using UEFI, and if your Funtoo LiveCD initial boot menu was black and white, or the system booted without a boot menu. If it was light blue, this method will not work. Instead, use the instructions in the previous section then skip this section, or reboot LiveCD in UEFI mode first.

root # gdisk /dev/sdX

Within gdisk, follow these steps:

Empty the partition table:

Command: o ↵
This option deletes all partitions and creates a new protective MBR.
Proceed? (Y/N): y ↵

Create boot partition:

Command: n ↵
Partition Number: 1 ↵
First sector: 
Last sector: +128M ↵
Hex Code: EF00 ↵

Create partition which will be encrypted with LUKS:

Command: n ↵
Partition Number: 2 ↵
First sector: 
Last sector:  (for rest of disk)
Hex Code: 

(Optional) Create disk labels:

Command: c ↵
Partition Number: 1
Enter name: BOOT 
Command: c ↵
Partition Number: 2
Enter name: ROOT

Write Partition Table To Disk:

Command: w ↵
Do you want to proceed? (Y/N): Y ↵

The partition table will now be written to the disk and gdisk will close.

Create and mount filesystems.

Create /boot filesystem

For BIOS systems

root # mkfs.ext2 /dev/sdX1

For UEFI systems

root # mkfs.vfat -F 32 /dev/sdX1

Create LUKS encrypted volume

   Note
Cryptsetup now defaults to LUKS2, which is unsupported by stable versions of grub. This is why we are not encrypting /boot.
   Warning
The debian-sources kernel in current stage3 tarballs does not allow for passwords in excess of 63 characters.
root # cryptsetup luksFormat /dev/sdX2

Open newly created LUKS volume

root # cryptsetup open --type luks2 /dev/sdX2 root

Create LVM volumes for / and swap

root # pvcreate /dev/mapper/root
root # vgcreate vg /dev/mapper/root
   Note

Replace "16G" with the amount of swap you would like to make available.

root # lvcreate -L16G --name swap vg
root # lvcreate -l 100%FREE --name root vg
   Note

The "-l 100%FREE" option above will use the remainder of the disk for your root partition. If you would prefer to create separate for /home or /var (for example), you can instead continue to use the "-LXXG" option for fixed sizes.

Create filesystems on LVM volumes

root # mkswap /dev/mapper/vg-swap
root # mkfs.ext4 /dev/mapper/vg-root

Create directories for chroot

root # mkdir -p /mnt/funtoo

Mount filesystems

root # mount /dev/mapper/vg-root /mnt/funtoo
root # mkdir /mnt/funtoo/boot
root # mount /dev/sdX1 /mnt/funtoo/boot
root # mkdir /mnt/funtoo/proc
root # mount -t proc none /mnt/funtoo/proc
root # mkdir /mnt/funtoo/dev
root # mount --rbind /dev /mnt/funtoo/dev
root # mkdir /mnt/funtoo/sys
root # mount --rbind /sys /mnt/funtoo/sys

Set the date

   Note

See the official Funtoo docs on setting the date.

Install the Funtoo starge tarball of your choice

   Note

These instructions will be using the intel-haswell minimal stage3. You should adjust them accordingly

root # cd /mnt/funtoo
root # wget https://build.funtoo.org/1.4-release-std/x86-64bit/intel64-haswell/2021-03-10/stage3-intel64-haswell-1.4-release-std-2021-03-10.tar.xz
root # tar --numeric-owner --xattrs --xattrs-include='*' -xpf stage3-intel64-haswell-1.4-release-std-2021-03-10.tar.xz && rm -f stage3-intel64-haswell-1.4-release-std-2021-03-10.tar.xz

Chroot into your new system

root # env -i HOME=/root TERM=$TERM $(which chroot) /mnt/funtoo bash -l

Configure your system

Set a new root password

root # passwd

Set hostname

root # echo 'hostname="yourdesiredhostname"' > /etc/conf.d/hostname

Set up DNS resolution

   Note

We are using the Cloudflare DNS server address here. Feel free to use your own.

root # echo "nameserver 1.1.1.1" > /etc/resolv.conf

Set your timezone

root # ln -sf /usr/share/zoneinfo/$(tzselect) /etc/localtime

Note your filesystem information

root # blkid
/dev/sdX1: UUID="6453-0C55" TYPE="vfat" PARTLABEL="efi" PARTUUID="4e195c4b-f88c-4205-b9df-79a879704b2f"
/dev/sdX2: UUID="aafe709b-82e7-448f-a2cb-36adc3787dc3" TYPE="crypto_LUKS" PARTLABEL="system" PARTUUID="93d0cf9b-0b95-4d8b-919f-48cd1774996f"
/dev/mapper/root: UUID="hvz79n-I2VE-nR1c-0hDQ-PVkR-3GRb-rnuJ9C" TYPE="LVM2_member"
/dev/mapper/vg-swap: UUID="a9188bc3-7def-422b-990d-9de431825779" TYPE="swap"
/dev/mapper/vg-root: UUID="2eaf45e6-d33b-4155-b4ca-63a2fdbfb896" TYPE="ext4"

Configure /etc/fstab

   Note

The UUID parameter is set to the UUID of your boot partition as found from the blkid command above.

root # cat > /etc/fstab << 'EOF'
UUID=6453-0C55 /boot vfat noauto,noatime 1 2
/dev/mapper/vg-swap none swap sw 0 0
/dev/mapper/vg-root / ext4 noatime,nodiratime,defaults 0 1
EOF

Create /etc/crypttab

   Note

The UUID parameter is set to the UUID of /dev/sdX2 as found from the blkid command above.

root # echo "root UUID=aafe709b-82e7-448f-a2cb-36adc3787dc3 none luks,discard" >> /etc/crypttab

Create /etc/dmtab

root # dmsetup table >> /etc/dmtab

Portage

Download the portage tree

root # ego sync

Change your ego profile to include encrypted root support

root # epro mix-in encrypted-root

Edit package USE-flags

root # cat > /etc/portage/package.use <<'EOF'
*/* device-mapper lvm luks
sys-kernel/linux-firmware initramfs
sys-fs/cryptsetup -dynamic
EOF

Install necessary packages

root # emerge grub haveged intel-microcode linux-firmware cryptsetup lvm2 genkernel iucode_tool

Configure services to start at boot

root # rc-update add device-mapper sysinit
root # rc-update add dmcrypt sysinit
root # rc-update add lvmetad sysinit
root # rc-update add haveged default
root # rc-update add busybox-ntpd default

Install a bootloader

Configure /etc/boot.conf

   Note

The UUID parameter is set to the UUID of /dev/sdX2 as found from the blkid command above.

root # cat > /etc/boot.conf <<'EOF'
boot {
    generate grub
    default "Funtoo Linux"
    timeout 3
}
"Funtoo Linux" {
    kernel kernel[-v]
    initrd initramfs[-v]
    params += crypt_root=UUID=aafe709b-82e7-448f-a2cb-36adc3787dc3 dolvm real_root=/dev/mapper/vg-root ro rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
}
EOF

Install GRUB

For BIOS systems

root # grub-install --target=i386-pc --no-floppy /dev/sdX
root # ego boot update

For UEFI systems

root # mount -o remount,rw /sys/firmware/efi/efivars
   Note

For 32 bit systems, the following command should be changed to:

root # grub-install --target=i386-efi --efi-directory=/boot --bootloader-id="Funtoo Linux" --recheck /dev/sdX
root # grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id="Funtoo Linux" --recheck /dev/sdX
root # ego boot update

Patch genkernel to include LUKS2 support

root # sed '/MODULES_CRYPT/ s/\"$/ af_alg algif_skcipher\"/' -i /usr/share/genkernel/arch/$(arch)/modules_load

Generate a new initramfs

root # genkernel --clean --luks --lvm --disklabel --ramdisk-modules --fullname=$(ls /boot/initramfs-* | tail -c +17) initramfs

Finishing installation

From this point, you should be able to finish following the official Funtoo Linux install instructions

Managing your LUKS volume

Change your LUKs-encrypted drive's passphrase You may want to change your encrypted volume’s passphrase or password from time to time. To do so, run the following commands in the console as root:

root # cryptsetup luksChangeKey /dev/sdx3

You'll be prompted to enter in the existing passphrase first, then to enter in your new passphrase. You will not be asked to confirm your new passphrase, so be careful when running this operation.

Additional links and information