Gentoo Archives: gentoo-user

From: Alex Schuster <wonko@×××××××××.org>
To: gentoo-user@l.g.o
Subject: [gentoo-user] Encrypting everything
Date: Wed, 01 Jul 2009 10:40:38
Message-Id: 200907011240.21313.wonko@wonkology.org
1 Hi there!
2
3 The last two PCs (A and B) I installed are fully encrypted. I used
4 different methods. I used genkernel --luks --lvm --install all to create
5 kernel and initramfs. I like to have everything as kernel modules, but the
6 crypto stuff has to be directly in the kernel, unless I put these modules
7 into the initramfs by hand.
8
9
10 A: LVM -> LUKS
11 Many partitions make two volume groups with many LVMs. Each LVM is LUKS-
12 encrypted. This gives me maximum flexibility, who knows what other OSes I
13 might need to install on that drive. The boot partition is on a USB stick
14 and also holds the key.
15
16 This did not work out of the box, I had to modify
17 /lib/rcscripts/addons/dm-crypt-start.sh in order to open the other
18 partitions than swap and root. I need to add something to close them when
19 shutting down, but it seems to work fine without this for the moment. Do
20 you know if there already is a solution for this?
21
22
23 B: LUKS -> LVM
24 A simpler approach. sda1 is a small boot partition, sda2 (the rest of the
25 drive) is a LUKS-formatted LVM physical volume with volume group 'pvcrypt'
26 on it. This does not work yet, the initramfs does not find the LVM.
27
28 I looked into the init script. I wants to do a cryptsetup luksOpen
29 $LUKS_DEVICE $LUKS_NAME with $LUKS_NAME=root, which is not the name I use.
30 But changing this does not help anyway. I get /dev/mapper/pvcrypt created,
31 but pvscan does not find it. At this point I thought I'd ask here, do you
32 have ideas what's wrong?
33
34 Using a live CD I can easily access my data:
35 cryptsetup luksOpen /dev/sda2 pvcrypt
36 pvscan
37 vgchange -a y
38 mount /dev/vgcrypt/root /gentoo
39
40 Wonko

Replies

Subject Author
Re: [gentoo-user] Encrypting everything Alex Schuster <wonko@×××××××××.org>
Re: [gentoo-user] Encrypting everything Dirk Heinrichs <dirk.heinrichs@××××××.de>