1 |
Am 07.08.2010 11:48, schrieb Florian Philipp: |
2 |
> Hi list! |
3 |
> |
4 |
> I'm building a new Gentoo system (notebook) and want to rearrange a few |
5 |
> things. I thought it would be good to have the following layout: |
6 |
> |
7 |
> - boot on a normal partition |
8 |
> - root on a normal partition |
9 |
> - one big encrypted partition (dmcrypt / LUKS) |
10 |
> - on that partition an LVM volume group |
11 |
> - on that volume group all stuff not necessary for booting: home, var, |
12 |
> tmp, etc. |
13 |
> |
14 |
> AFAIK, the Gentoo boot process is organized so that LVM gets stated |
15 |
> before dmcrypt is started. I would need it vice versa. |
16 |
> |
17 |
> Is that possible with baselayout-1? Do I need to switch to baselayout-2? |
18 |
> |
19 |
> Thanks in advance! |
20 |
> Florian Philipp |
21 |
> |
22 |
|
23 |
Thanks everyone for your suggestions! However, I decided against using |
24 |
them for basically two reasons: |
25 |
|
26 |
1. I want to keep it simple and safe and there are few things more |
27 |
troublesome than a system which cannot even mount its root. |
28 |
|
29 |
Therefore I keep root on a normal partition while everything with |
30 |
possibly valuable information (tmp, var, home, srv) gets encrypted. opt |
31 |
and usr/local will follow, if necessary. |
32 |
|
33 |
It is also my reason for not using an initrd. |
34 |
|
35 |
2. I want as few single points of failure as possible on my system. A |
36 |
key file would be such a point. Granted, a single volume with a |
37 |
passphrase is also a SPOF - but one which is less likely to fall prey to |
38 |
an rm -rf *. (Okay, I have a backup, but I would like to avoid using it ;) ) |
39 |
|
40 |
Long story short: In the end, I tried baselayout-2 and it works like a |
41 |
charm. I just configured /etc/conf.d/dmcrypt, added dmcrypt to runlevel |
42 |
sysinit and then (just for good measure, don't think it's necessary) |
43 |
added 'rc_dmcrypt_before="lvm"' to /etc/rc.conf. |