Difference between revisions of "Rootfs over encrypted lvm"

From Funtoo
Jump to: navigation, search
(Encrypting the drive)
(added warning to notify users that this is outside the boundaries of the official installtion method and cannot be suppored.)
 
(109 intermediate revisions by 14 users not shown)
Line 1: Line 1:
This howto describes how to setup LVM and rootfs with cryptoLUKS-encrypted drive. It is not meant to be a standalone installation guide, rather, it is meant to be read alongside the [[Funtoo Linux Installation]] Guide.  
+
This howto describes how to setup LVM, swap, and root with dmcrypt LUKS. It is a standalone installation walk through, based on the official installations finished product.  boot is not encrypted.
 +
 
 +
{{warning| You may try this installation method at your own risk! Please note: this guide is outside of the official installation documentation and cannot be supported. If you choose to use this, we assume you know what you are doing and you are on your own.}}
  
 
== Prepare the hard drive and partitions ==
 
== Prepare the hard drive and partitions ==
This is an example partition scheme, you may want to choose differently.
+
*List the device to be partitioned, mine is on /dev/sdc
<code>/dev/sda1</code> used as <code>/boot</code>. <code>/dev/sda2</code> will be encrypted drive with LVM.
+
{{console|body=
* <code>/dev/sda1</code> -- <code>/boot</code> partition.
+
###i## lsblk -o name,size,label,partlabel
* <code>/dev/sda2</code> -- BIOS boot partition (not needed for MBR - only needed if you are using GPT) This step required for GRUB2. For more info, see: [http://www.funtoo.org/Funtoo_Linux_Installation#Prepare_Hard_Disk] for more information on GPT and MBR.
+
}}
* <code>/dev/sda3</code> -- <code>/</code> partition, will be the drive with LUKS and LVM.
+
 
 +
==Partition==
 +
{{console|body=
 +
###i## cgdisk /dev/sdc}}
 +
 
 +
delete everything.
 +
 
 +
{{console|body=
 +
Command: ##i## new ↵
 +
First sector: ##i##↵
 +
Last sector: ##i##+1M ↵
 +
Hex Code: ##i##EF02 ↵
 +
Enter name: ##i##BIOS Boot ↵
 +
}}
  
=== Wipe the hard drive ===
+
scroll down to large chunk of free space:
{{Fancywarning|This action will destroy all data on the disk.}}
+
{{console|body=
<console>
+
Command: ##i##new ↵
# ##i##gdisk /dev/sda
+
First sector: ##i##↵
 +
Last sector: ##i##+128M ↵
 +
Hex Code: ##i##EF00 ↵
 +
Enter name: ##i##BOOT ↵
 +
}}
  
Command: ##i##x
+
scroll down to large chunk of free space:
Expert command: ##i##z
+
{{console|body=
About to wipe out GPT on /dev/sda. Proceed?: ##i##y
+
Command: ##i##new
GPT data structures destroyed! You may now partition the disk using fdisk or other utilities.
+
First sector: ##i##↵
Blank out MBR?: ##i##y
+
Last sector: ##i##↵
</console>
+
Hex Code: ##i## 8304 ↵
 +
Enter name: ##i##FUNTOO
 +
}}
  
{{Note}} You will get a message about reaching the end of the device when the <code>dd</code> command has finished. This behavior is intended.
+
{{console|body=
 +
 
 +
                              Disk Drive: /dev/sdc
 +
                            Size: 62333952, 29.7 GiB
 +
 
 +
Part. #    Size        Partition Type            Partition Name
 +
----------------------------------------------------------------
 +
            1007.0 KiB  free space
 +
  1        1024.0 KiB  BIOS boot partition   BIOS Boot
 +
  2        256.0 MiB  EFI System                BOOT
 +
  3        29.5 GiB    Linux x86-64 root (/)    FUNTOO
 +
}}
 +
 
 +
{{console|body=
 +
Command: ##i##write ↵
 +
Command: ##i##quit ↵
 +
}}
  
 
== Encrypting the drive ==
 
== Encrypting the drive ==
Read more about different cipher options here: [[http://blog.wpkg.org/2009/04/23/cipher-benchmark-for-dm-crypt-luks/]]
+
*luks2 is not backwards compatible, and requires grub 9999 git latest. grub 2.04 does not support luks2 yet.  stick with luks1.
<console>
+
{{console|body=
# ##i##cryptsetup --cipher aes-xts-plain64 luksFormat /dev/sda3
+
# ##i##cryptsetup luksFormat /dev/sdc3
# ##i##cryptsetup luksOpen /dev/sda3 dmcrypt_root
+
}}
</console>
 
  
There you'll be prompted to enter your password phrase for encrypted drive, type your paranoid password there.
+
== Unlock the volume ==
 +
Unlock the volume:
 +
{{console|body=
 +
###i##cryptsetup luksOpen /dev/sdc3 dmcrypt_root
 +
}}
  
= Create logical volumes =
+
== Create logical volumes ==
<console>
+
{{console|body=
# ##i##pvcreate /dev/mapper/dmcrypt_root
+
###i## pvcreate /dev/mapper/dmcrypt_root
# ##i##vgcreate vg /dev/mapper/dmcrypt_root
+
###i## vgcreate vg /dev/mapper/dmcrypt_root        
# ##i##lvcreate -L10G --name root vg         
+
###i## lvcreate -L2G --name swap vg
# ##i##lvcreate -L2G --name swap vg
+
###i## lvcreate -l 100%FREE --name root vg  
# ##i##lvcreate -L5G --name portage vg
+
}}
# ##i##lvcreate -l 100%FREE -nhome vg
 
</console>
 
Feel free to specify your desired size by altering the numbers after the -L flag. For example, to make your portage dataset 20GB's, use the flag -L20G instead of -L5G.
 
  
= Create a filesystem on volumes =
+
=== Create a filesystem on volumes ===
<console>
 
# ##i##mkfs.ext2 /dev/sda1
 
# ##i##mkswap /dev/mapper/vg-swap
 
# ##i##mkfs.ext4 /dev/mapper/vg-root
 
# ##i##mkfs.ext4 /dev/mapper/vg-portage
 
# ##i##mkfs.ext4 /dev/mapper/vg-home
 
</console>
 
  
= Basic system setup =
+
{{console|body=
<console>
+
###i## mkfs.vfat -F 32 /dev/sdc2
# ##i##swapon /dev/mapper/vg-swap
+
###i## fatlabel /dev/sdc2 "BOOT"
# ##i##mkdir /mnt/funtoo
+
###i## mkswap /dev/mapper/vg-swap
# ##i##mount /dev/mapper/vg-root /mnt/funtoo
+
###i## mkfs.ext4 /dev/mapper/vg-root
# ##i##mkdir -p /mnt/funtoo/{boot,usr/portage,home}
+
}}
# ##i##mount /dev/sda1 /mnt/funtoo/boot
 
# ##i##mount /dev/mapper/vg-portage /mnt/funtoo/usr/portage
 
# ##i##mount /dev/mapper/vg-home /mnt/funtoo/home
 
</console>
 
Now perform all the steps required for basic system install, please follow [http://docs.funtoo.org/wiki/Funtoo_Linux_Installation]
 
don't forget to emerge the following before your install is finished:
 
  
* '''cryptsetup'''
+
=== Mount your partitions ===
* '''lvm2'''
 
* '''a bootloader (grub recommended)'''
 
* '''kernel sources '''
 
  
= Editing the fstab =
+
{{console|body=
Fire up your favorite text editor to edit <code>/etc/fstab</code>. You want to put the following in the file:
+
###i## swapon /dev/mapper/vg-swap
{{File
+
###i## mkdir /mnt/funtoo
|/etc/fstab|<pre>
+
###i## mount /dev/mapper/vg-root /mnt/funtoo
# <fs>                  <mountpoint>  <type>    <opts>                          <dump/pass>
+
###i## mkdir  /mnt/funtoo/boot
/dev/sda1              /boot        ext2      noauto,noatime                  1 2
+
###i## mount /dev/sdc2 /mnt/funtoo/boot
/dev/mapper/vg-swap     none          swap      sw                              0 0
+
}}
/dev/mapper/vg-root     /            ext4      noatime,nodiratime,defaults    0 1
 
/dev/sr0                /mnt/cdrom    auto      noauto,ro                      0 0
 
/dev/mapper/vg-portage  /usr/portage  ext4      noatime,nodiratime              0 0
 
/dev/mapper/vg-home    /home        ext4      noatime,nodiratime              0 0
 
</pre>}}
 
  
= Kernel options =
+
==Get Funtoo Gnome==
{{Note}}This part is particularly important: pay close attention.
+
You can pull your [[Subarches]] gnome tarball if you wish:
{{kernelop
 
| <br> |<pre>
 
General setup --->
 
      [*] Initial RAM filesystem and RAM disk (initramfs/initrd) support
 
</pre>}}
 
  
{{kernelop
+
{{console|body=
| <br> |<pre>
+
###i## cd /mnt/funtoo
Device Drivers --->
+
###i## wget https://build.funtoo.org/1.4-release-std/x86-64bit/generic_64/gnome-latest.tar.xz
      Generic Driver Options --->
+
###i## tar --numeric-owner --xattrs --xattrs-include='*' -xpf *gnome* && rm -f *gnome*
      [*] Maintain a devtmpfs filesystem to mount at /dev
+
}}
</pre>}}
 
  
{{kernelop
+
==Load Funtoo==
| <br> |<pre>
+
=== mount ===
Device Drivers --->
+
*mount up:
      [*] Multiple devices driver support --->
+
{{console|body=
      <*>Device Mapper Support
+
###i## cd /mnt/funtoo && mount -t proc none proc
        <*> Crypt target support
+
mount --rbind /sys sys
</pre>}}
+
mount --rbind /dev dev
 +
}}
  
{{kernelop
+
=== chroot ===
| <br> |<pre>
+
*chroot in:
Cryptographic API --->
+
{{console|body=
      <*> XTS support
+
###i## env -i HOME=/root TERM=$TERM $(which chroot) /mnt/funtoo bash -l
      -*-AES cipher algorithms
+
}}
</pre>}}
 
  
= Initramfs setup and configuration =
+
*Set yo password:
== Better-initramfs ==
+
*set yo hostname:
'''Build your initramfs with [https://bitbucket.org/piotrkarbowski/better-initramfs better-initramfs] project.'''
+
*set cloudflare dns resolution for installing:
 +
*Set yo time zone:
  
{{note}}better-initramfs supports neither dynamic modules nor udev, so you should compile your kernel with built-in support for your block devices.
+
{{console|body=
 +
###i## passwd
 +
###i## echo 'hostname="crypto"' > /etc/conf.d/hostname
 +
###i## echo "nameserver 1.1.1.1" > /etc/resolv.conf
 +
###i## ln -sf /usr/share/zoneinfo/America/Detroit /etc/localtime
 +
}}
  
<console>
+
=== fstab ===
# ##i##cd /opt
+
*Deploy your fstab:
# ##i##git clone git://github.com/slashbeast/better-initramfs.git
 
# ##i##cd better-initramfs
 
# ##i##less README.rst
 
# ##i##bootstrap/bootstrap-all
 
# ##i##make prepare
 
# ##i##make image
 
</console>
 
  
Copy resulting <code>initramfs.cpio.gz</code> to <code>/boot</code>:
+
{{console|body=
<console># ##i##cp output/initramfs.cpio.gz /boot</console>
+
###i## cat > /etc/fstab << "EOF"
 +
LABEL=BOOT /boot vfat noauto,noatime 1 2
 +
/dev/mapper/vg-swap none swap sw 0 0
 +
/dev/mapper/vg-root / ext4 noatime,nodiratime,defaults 0 1
 +
tmpfs /var/tmp/portage tmpfs size=6G,uid=portage,gid=portage,mode=775,noatime 0 0
 +
EOF
 +
}}
  
Alternatively, a pre-compiled binary initramfs is available at https://bitbucket.org/piotrkarbowski/better-initramfs/downloads
+
*Deploy your crypttab:
<console>
 
# ##i##wget https://bitbucket.org/piotrkarbowski/better-initramfs/downloads/release-x86_64-v0.7.2.tar.bz2
 
# ##i##tar xf release-x86_64-v0.5.tar.bz2
 
# ##i##cd release*
 
# ##i##gzip initramfs.cpio
 
# ##i##cp initramfs.cpio.gz /boot
 
</console>
 
  
Remember, better-initramfs project is a work in progress, so you need to update from time to time. It can be done easily with <code>git</code>. Go to the better-initramfs source dir and follow:
+
{{console|body=
<console>
+
###i## echo "dmcrypt_root PARTLABEL=FUNTOO none luks,discard" >> /etc/crypttab
# ##i##cd /opt/better-initramfs
+
}}
# ##i##git pull
 
# ##i##less ChangeLog
 
</console>
 
{{Note}}Please read the ChangeLog carefuly and perform necessary updates to <code>/etc/boot.conf</code>. Also, please backup the working <code>/boot/initramfs.cpio.gz</code> and <code>/etc/boot.conf</code> before updating better-initramfs.
 
  
== Genkernel ==
+
=== compile in ram ===
Funtoo's genkernel capable to create initramfs for encrypted drive. Compile and install kernel and initramfs of your favorite kernel sources:
+
*compile in ram:
<console>
+
{{console|body=
# ##i##genkernel --kernel-config=/path/to/your/custom-kernel-config --no-mrproper --makeopts=-j5 --install --lvm --luks all </console>
+
###i## mkdir /var/tmp/portage
 +
###i## chown portage:portage /var/tmp/portage
 +
###i## mount /var/tmp/portage
 +
}}
  
== Bootloader Configuration ==
+
*Sync:
=== Grub2 configuration ===
+
{{console|body=
==== better-initramfs ====
+
###i## ego sync
An example <code>/etc/boot.conf</code> for better-initramfs:
+
}}
  
{{File
+
*Deploy your ego profile:
|/etc/boot.conf|<pre>
+
{{console|body=
boot {
+
###i## ego profile mix-in encrypted-root
  generate grub
+
}}
  default "Funtoo Linux"
+
 
  timeout 3
+
*Deploy your package.use file:
}
+
{{console|body=
"Funtoo Linux" {
+
###i## cat > /etc/portage/package.use << "EOF"
  kernel vmlinuz[-v]
+
*/* device-mapper lvm luks
  initrd /initramfs.cpio.gz
+
sys-kernel/linux-firmware initramfs
  params += enc_root=/dev/sda3 lvm luks root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
+
EOF
</pre>}}
+
}}
 +
 
 +
*merge stuff:
 +
 
 +
{{console|body=
 +
###i## emerge grub haveged intel-microcode linux-firmware eix cryptsetup lvm2 debian-sources debian-sources-lts && emerge -vuND @world && emerge --depclean
 +
}}
 +
 
 +
*add required services:
 +
{{console|body=
 +
###i## rc-update add device-mapper sysinit
 +
###i## rc-update add dmcrypt sysinit
 +
###i## rc-update add lvmetad sysinit
 +
###i## rc-update add haveged && rc-update add gpm && rc-update add busybox-ntpd
 +
}}
 +
 
 +
*deploy dmtab:
 +
{{console|body=
 +
###i## dmsetup table >> /etc/dmtab
 +
}}
  
Now, run <code>boot-update</code> to write the configuration files to <code>/boot/grub/grub.cfg</code>
+
=== Bootloader Configuration ===
  
==== genkernel ====
+
*deploy boot.conf
Configure the bootloader as described above, with correct kernel and initramfs images names. An example for genkernel and grub2. You will be editing <code>/etc/boot.conf</code>:
+
{{warning|uuid is the only known working method of loading crypt_root. even /dev/sdc will not load it.}}
  
{{File
+
{{console|body=
|/etc/boot.conf|<pre>
+
###i## cat > /etc/boot.conf << "EOF"
 
boot {
 
boot {
 
   generate grub
 
   generate grub
Line 184: Line 210:
 
}
 
}
 
"Funtoo Linux" {
 
"Funtoo Linux" {
  kernel kernel-genkernel-x86_64-3.13.0
+
kernel kernel[-v]
  initrd initramfs-genkernel-x86_64-3.13.0
+
initrd initramfs[-v]
   params += crypt_root=/dev/sda3 dolvm real_root=/dev/mapper/vg-root rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
+
   params += crypt_root=UUID=a5ca52dc-d00a-40f9-8666-31d9021de327 dolvm real_root=/dev/mapper/vg-root ro rootfstype=auto resume=swap:/dev/mapper/vg-swap quiet
</pre>}}
+
}
 
+
EOF
== Lilo configuration ==
+
}}
For oldschool geeks, an example for lilo bootloader. Emerge lilo with device-mapper support
 
<console>
 
# ##i##echo 'sys-boot/lilo device-mapper' >> /etc/portage/package.use/lilo
 
# ##i##emerge lilo
 
</console>
 
 
 
Example <code>/etc/lilo.conf</code>:
 
  
{{File
+
== GRUB ==
|/etc/lilo.conf|<pre>
+
*Install grub:
append="init=/linuxrc dolvm crypt_root=/dev/sda2 real_root=/dev/mapper/vg-root"
+
{{console|body=
boot=/dev/sda
+
###i## grub-install --target=i386-pc /dev/sdc
compact
+
###i## grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id="BOOT" --recheck --no-nvram /dev/sdc
default=funtoo
+
###i## ego boot update
lba32
+
}}
prompt
 
read-only
 
timeout=50
 
image=/boot/kernel-genkernel-x86_64-3.13.0
 
initrd=/boot/initramfs-genkernel-x86_64-3.13.0
 
label=funtoo
 
</pre>}}
 
  
== Syslinux bootloader setup ==
+
=== Final steps ===
Syslinux is another advanced bootloader which you can find on all live CD's. Syslinux bootloader does not require additional BIOS boot partition. /dev/sda2 is the root partition.
+
exit chroot, unmount, and close encrypted drive.
<console>
 
# ##i##emerge syslinux
 
# ##i##mkdir /boot/extlinux
 
# ##i##extlinux --install /boot/extlinux
 
# ##i##dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/mbr.bin of=/dev/sda
 
- or -
 
# ##i##sgdisk /dev/sda --attributes=1:set:2
 
# ##i##dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/gptmbr.bin of=/dev/sda, for GPT partition
 
</console>
 
  
Example <code>/boot/extlinux/extlinux.conf</code>:
+
{{console|body=
 +
###i## exit
 +
###i## swapoff /dev/dm-1
 +
###i## cd ..
 +
###i## umount -lR funtoo
 +
###i## vgchange -a n
 +
###i## cryptsetup luksClose dmcrypt_root
 +
}}
  
{{File
+
==management==
|/boot/extlinux/extlinux.conf|<pre>
+
=== Change your LUKs-encrypted drive's passphrase ===
LABEL kernel1_bzImage-3.2.1
+
You may want to change your encrypted volume’s passphrase or password from time to time. To do so, run the following commands in the console as root:
MENU LABEL Funtoo Linux bzImage-3.2.1
 
LINUX /bzImage-3.2.1
 
INITRD /initramfs.cpio.gz
 
APPEND rootfstype=ext4 luks enc_root=/dev/sda2 lvm root=/dev/mapper/vg-root
 
</pre>}}
 
  
= Final steps =
+
{{console|body=
Umount everything, close encrypted drive and reboot
+
# ##i##cryptsetup luksChangeKey /dev/sdx3
<console>
+
}}
# ##i##umount -l -v /mnt/funtoo/{dev, proc, home, usr/portage, boot}
 
# ##i##vgchange -a n
 
# ##i##cryptsetup luksClose /dev/sda2 dmcrypt_root
 
</console>
 
After reboot you will get the following:
 
<console>
 
>>> better-initramfs started. Kernel version 2.6.35-gentoo-r10
 
>>> Create all the symlinks to /bin/busybox.
 
>>> Initiating /dev/dir
 
>>> Getting LVM volumes up (if any)
 
Reding all physical volumes. This make take awhile...
 
No volume group found
 
No volume group found
 
>>> Opening encrypted partition and mapping to /dev/mapper/dmcrypt_root
 
Enter passphrase fore /dev/sda2:
 
</console>
 
Type your password
 
  
<console>
+
You'll be prompted to enter in the existing passphrase first, then to enter in your new passphrase.
>>> Again, getting LVM volumes up (if any, after map dmcrypt).
+
You will not be asked to confirm your new passphrase, so be careful when running this operation.
  Reading all physical volumes.  This may take a while...
 
  Found volume group "vg" using metadata type lvm2
 
  4 logical volume(s) in volume group "vg" now active
 
>>> Mounting rootfs to /newroot
 
>>> Umounting /sys and /proc.
 
>>> Switching root to /newroot and executing /sbin/init.
 
INIT: version 2.88 booting
 
Loading /libexec/rc/console/keymap
 
  OpenRC 0.6.1 is starting up Funtoo Linux (x86_64)
 
...boot messages omitted for clarity
 
 
 
orion login: oleg
 
Password:
 
Last login: Thu Oct 14 20:49:21 EEST 2010 on tty1
 
oleg@orion ~ %
 
</console>
 
  
= Additional links and information =
+
== Additional links and information ==
 +
* [https://www.freedesktop.org/software/systemd/man/crypttab.html crypttab]
 
* [[gentoo-wiki:Root filesystem over LVM2, DM-Crypt and RAID|Root filesystem over LVM2, DM-Crypt, and RAID]]
 
* [[gentoo-wiki:Root filesystem over LVM2, DM-Crypt and RAID|Root filesystem over LVM2, DM-Crypt, and RAID]]
 
* [http://wiki.archlinux.org/index.php/System_Encryption_with_LUKS_for_dm-crypt System Encryption with LUKS for dm-crypt]
 
* [http://wiki.archlinux.org/index.php/System_Encryption_with_LUKS_for_dm-crypt System Encryption with LUKS for dm-crypt]
 +
* [https://wiki.archlinux.org/index.php/Dm-crypt/Encrypting_an_entire_system#LVM_on_LUKS arch encrypt entire system]
 
* [http://en.wikipedia.org/wiki/Logical_volume_management Wikipedia article on LVM]
 
* [http://en.wikipedia.org/wiki/Logical_volume_management Wikipedia article on LVM]
 
* [https://wiki.archlinux.org/index.php/Dm-crypt_with_LUKS Arch Wiki article]
 
* [https://wiki.archlinux.org/index.php/Dm-crypt_with_LUKS Arch Wiki article]
  
 
[[Category:HOWTO]]
 
[[Category:HOWTO]]

Latest revision as of 11:46, April 14, 2021

This howto describes how to setup LVM, swap, and root with dmcrypt LUKS. It is a standalone installation walk through, based on the official installations finished product. boot is not encrypted.

   Warning
You may try this installation method at your own risk! Please note: this guide is outside of the official installation documentation and cannot be supported. If you choose to use this, we assume you know what you are doing and you are on your own.

Prepare the hard drive and partitions

  • List the device to be partitioned, mine is on /dev/sdc
root # lsblk -o name,size,label,partlabel

Partition

root # cgdisk /dev/sdc

delete everything.

Command:  new ↵
First sector: 
Last sector: +1M ↵
Hex Code: EF02 ↵
Enter name: BIOS Boot ↵

scroll down to large chunk of free space:

Command: new ↵
First sector: 
Last sector: +128M ↵
Hex Code: EF00 ↵
Enter name: BOOT ↵

scroll down to large chunk of free space:

Command: new ↵
First sector: 
Last sector: 
Hex Code:  8304 ↵
Enter name: FUNTOO ↵
Disk Drive: /dev/sdc
                            Size: 62333952, 29.7 GiB

Part. #     Size        Partition Type            Partition Name
----------------------------------------------------------------
            1007.0 KiB  free space
   1        1024.0 KiB  BIOS boot partition	  BIOS Boot
   2        256.0 MiB   EFI System                BOOT
   3        29.5 GiB    Linux x86-64 root (/)     FUNTOO
Command: write ↵
Command: quit ↵

Encrypting the drive

  • luks2 is not backwards compatible, and requires grub 9999 git latest. grub 2.04 does not support luks2 yet. stick with luks1.
root # cryptsetup luksFormat /dev/sdc3

Unlock the volume

Unlock the volume:

root #cryptsetup luksOpen /dev/sdc3 dmcrypt_root

Create logical volumes

root # pvcreate /dev/mapper/dmcrypt_root
root # vgcreate vg /dev/mapper/dmcrypt_root          
root # lvcreate -L2G --name swap vg
root # lvcreate -l 100%FREE --name root vg

Create a filesystem on volumes

root # mkfs.vfat -F 32 /dev/sdc2
root # fatlabel /dev/sdc2 "BOOT"
root # mkswap /dev/mapper/vg-swap
root # mkfs.ext4 /dev/mapper/vg-root

Mount your partitions

root # swapon /dev/mapper/vg-swap
root # mkdir /mnt/funtoo
root # mount /dev/mapper/vg-root /mnt/funtoo
root # mkdir  /mnt/funtoo/boot
root # mount /dev/sdc2 /mnt/funtoo/boot

Get Funtoo Gnome

You can pull your Subarches gnome tarball if you wish:

root # cd /mnt/funtoo
root # wget https://build.funtoo.org/1.4-release-std/x86-64bit/generic_64/gnome-latest.tar.xz
root # tar --numeric-owner --xattrs --xattrs-include='*' -xpf *gnome* && rm -f *gnome*

Load Funtoo

mount

  • mount up:
root # cd /mnt/funtoo && mount -t proc none proc
mount --rbind /sys sys
mount --rbind /dev dev

chroot

  • chroot in:
root # env -i HOME=/root TERM=$TERM $(which chroot) /mnt/funtoo bash -l
  • Set yo password:
  • set yo hostname:
  • set cloudflare dns resolution for installing:
  • Set yo time zone:
root # passwd
root # echo 'hostname="crypto"' > /etc/conf.d/hostname
root # echo "nameserver 1.1.1.1" > /etc/resolv.conf
root # ln -sf /usr/share/zoneinfo/America/Detroit /etc/localtime

fstab

  • Deploy your fstab:
root # cat > /etc/fstab << "EOF"
LABEL=BOOT /boot vfat noauto,noatime 1 2
/dev/mapper/vg-swap none swap sw 0 0
/dev/mapper/vg-root / ext4 noatime,nodiratime,defaults 0 1
tmpfs /var/tmp/portage tmpfs size=6G,uid=portage,gid=portage,mode=775,noatime 0 0
EOF
  • Deploy your crypttab:
root # echo "dmcrypt_root PARTLABEL=FUNTOO none luks,discard" >> /etc/crypttab

compile in ram

  • compile in ram:
root # mkdir /var/tmp/portage
root # chown portage:portage /var/tmp/portage
root # mount /var/tmp/portage
  • Sync:
root # ego sync
  • Deploy your ego profile:
root # ego profile mix-in encrypted-root
  • Deploy your package.use file:
root # cat > /etc/portage/package.use << "EOF"
*/* device-mapper lvm luks
sys-kernel/linux-firmware initramfs
EOF
  • merge stuff:
root # emerge grub haveged intel-microcode linux-firmware eix cryptsetup lvm2 debian-sources debian-sources-lts && emerge -vuND @world && emerge --depclean
  • add required services:
root # rc-update add device-mapper sysinit
root # rc-update add dmcrypt sysinit
root # rc-update add lvmetad sysinit
root # rc-update add haveged && rc-update add gpm && rc-update add busybox-ntpd
  • deploy dmtab:
root # dmsetup table >> /etc/dmtab

Bootloader Configuration

  • deploy boot.conf
   Warning

uuid is the only known working method of loading crypt_root. even /dev/sdc will not load it.

root # cat > /etc/boot.conf << "EOF"
boot {
  generate grub
  default "Funtoo Linux"
  timeout 3
}
"Funtoo Linux" {
	kernel kernel[-v]
	initrd initramfs[-v]
  params += crypt_root=UUID=a5ca52dc-d00a-40f9-8666-31d9021de327 dolvm real_root=/dev/mapper/vg-root ro rootfstype=auto resume=swap:/dev/mapper/vg-swap quiet
}
EOF

GRUB

  • Install grub:
root # grub-install --target=i386-pc /dev/sdc 
root # grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id="BOOT" --recheck --no-nvram /dev/sdc
root # ego boot update

Final steps

exit chroot, unmount, and close encrypted drive.

root # exit
root # swapoff /dev/dm-1
root # cd ..
root # umount -lR funtoo
root # vgchange -a n
root # cryptsetup luksClose dmcrypt_root

management

Change your LUKs-encrypted drive's passphrase

You may want to change your encrypted volume’s passphrase or password from time to time. To do so, run the following commands in the console as root:

root # cryptsetup luksChangeKey /dev/sdx3

You'll be prompted to enter in the existing passphrase first, then to enter in your new passphrase. You will not be asked to confirm your new passphrase, so be careful when running this operation.

Additional links and information