Re: [gentoo-user] dm-crypt + ext4 = where will the journal go?

[Florian Philipp]

Am 03.09.2012 22:36, schrieb "Roland Häder":
> Opps, here is the missing link: http://wiki.gentoo.org/wiki/DM-Crypt
>
> (I don't think it is a good idea to store the keyFile somewhere
> plain, [2] tells that there is support for crypt-gnupg, but it
> doesn't show any help how to setup it.
>
> [2]: http://wiki.gentoo.org/wiki/Dracut
>

No comment on dracut as I have no experience with it.

However, as I see it, you need no key file if you just use a pass
phrase. In my opinion, a key file is only necessary for two improvements:

1. Two-factor authentication (read: encrypted key file)

2. Avoiding re-typing the pass phrase for multiple dmcrypt partitions

You can easily achieve the second point by putting an unencrypted key
file on the first partition which you encrypt with a pass phrase. You
don't even need dracut for this, /etc/conf.d/dmcrypt lets you configure
it easily (as long as it doesn't affect /usr).

However, I personally find it easier to put LVM on a single dmcrypt
volume and be done this. All you need for this to work are two lines in
/etc/rc.conf:
rc_dmcrypt_before="lvm"
rc_dmcrypt_after="udev"

Regards,
Florian Philipp