1 |
Hi there! |
2 |
|
3 |
The last two PCs (A and B) I installed are fully encrypted. I used |
4 |
different methods. I used genkernel --luks --lvm --install all to create |
5 |
kernel and initramfs. I like to have everything as kernel modules, but the |
6 |
crypto stuff has to be directly in the kernel, unless I put these modules |
7 |
into the initramfs by hand. |
8 |
|
9 |
|
10 |
A: LVM -> LUKS |
11 |
Many partitions make two volume groups with many LVMs. Each LVM is LUKS- |
12 |
encrypted. This gives me maximum flexibility, who knows what other OSes I |
13 |
might need to install on that drive. The boot partition is on a USB stick |
14 |
and also holds the key. |
15 |
|
16 |
This did not work out of the box, I had to modify |
17 |
/lib/rcscripts/addons/dm-crypt-start.sh in order to open the other |
18 |
partitions than swap and root. I need to add something to close them when |
19 |
shutting down, but it seems to work fine without this for the moment. Do |
20 |
you know if there already is a solution for this? |
21 |
|
22 |
|
23 |
B: LUKS -> LVM |
24 |
A simpler approach. sda1 is a small boot partition, sda2 (the rest of the |
25 |
drive) is a LUKS-formatted LVM physical volume with volume group 'pvcrypt' |
26 |
on it. This does not work yet, the initramfs does not find the LVM. |
27 |
|
28 |
I looked into the init script. I wants to do a cryptsetup luksOpen |
29 |
$LUKS_DEVICE $LUKS_NAME with $LUKS_NAME=root, which is not the name I use. |
30 |
But changing this does not help anyway. I get /dev/mapper/pvcrypt created, |
31 |
but pvscan does not find it. At this point I thought I'd ask here, do you |
32 |
have ideas what's wrong? |
33 |
|
34 |
Using a live CD I can easily access my data: |
35 |
cryptsetup luksOpen /dev/sda2 pvcrypt |
36 |
pvscan |
37 |
vgchange -a y |
38 |
mount /dev/vgcrypt/root /gentoo |
39 |
|
40 |
Wonko |