Note

The Funtoo Linux project has transitioned to "Hobby Mode" and this wiki is now read-only.

Difference between revisions of "Encrypted Root"

From Funtoo
Jump to navigation Jump to search
m (encrypted root without llvm!!! gotta do it boss, gotta have a solid foundation to fix the other page upon.)
Line 61: Line 61:
# ##i##cryptsetup luksFormat /dev/sdc3
# ##i##cryptsetup luksFormat /dev/sdc3
}}
}}
*enter your password


== Initialize the volume ==
== Initialize the volume ==

Revision as of 02:31, November 27, 2020

This howto describes how to setup a swapless encrypted root partition without llvm.

Prepare the hard drive and partitions

  • List the device to be partitioned, mine is on /dev/sdc
root # lsblk -o name,size,label,partlabel

Partition

root # cgdisk /dev/sdc

delete everything. 

Command:  new ↵
First sector: ↵
Last sector: +1M ↵
Hex Code: EF02 ↵
Enter name: BIOS Boot ↵

scroll down to large chunk of free space: 

Command: new ↵
First sector: ↵
Last sector: +128M ↵
Hex Code: EF00 ↵
Enter name: BOOT ↵

scroll down to large chunk of free space: 

Command: new ↵
First sector: ↵
Last sector: ↵
Hex Code:  8304 ↵
Enter name: FUNTOO ↵
Disk Drive: /dev/sdc
                            Size: 62333952, 29.7 GiB

Part. #     Size        Partition Type            Partition Name
----------------------------------------------------------------
            1007.0 KiB  free space
   1        1024.0 KiB  BIOS boot partition	  BIOS Boot
   2        256.0 MiB   EFI System                BOOT
   3        29.5 GiB    Linux x86-64 root (/)     FUNTOO
Command: write ↵
Command: quit ↵

Encrypt the drive

root # cryptsetup luksFormat /dev/sdc3
  • enter your password

Initialize the volume

Initialize the volume: 

root # cryptsetup luksOpen /dev/sdc3 dmcrypt_root

Create your filesystem

root # mkfs.vfat -F 32 /dev/sdc2
root # fatlabel /dev/sdc2 "BOOT"
root # mkfs.ext4 /dev/sdc3

Basic system setup

root # mkdir /mnt/funtoo
root # mount /dev/sdc3 /mnt/funtoo
root # mkdir  /mnt/funtoo/boot
root # mount /dev/sdc2 /mnt/funtoo/boot

Get Funtoo Gnome

You can pull your Subarches gnome tarball if you wish: 

root # cd /mnt/funtoo
root # wget https://build.funtoo.org/1.4-release-std/x86-64bit/generic_64/gnome-latest.tar.xz
root # tar --numeric-owner --xattrs --xattrs-include='*' -xpf *gnome* && rm -f *gnome*

Load Funtoo

  • expand your run tmpfs to be half of your ram:
root # mount -t tmpfs tmpfs /run
  • mount up:
root # cd /mnt/funtoo && mount -t proc none proc
mount --rbind /sys sys
mount --rbind /dev dev
mount --rbind /run run
  • chroot in:
root # cd /mnt/funtoo && env -i HOME=/root TERM=$TERM chroot . bash -l
  • Set yo password:
  • set yo hostname:
  • set cloudflare dns resolution for installing:
  • Set yo time zone:
root # passwd
root # echo 'hostname="crypto"' > /etc/conf.d/hostname
root # echo "nameserver 1.1.1.1" > /etc/resolv.conf
root # ln -sf /usr/share/zoneinfo/America/Detroit /etc/localtime
  • Deploy your fstab:
root # cat > /etc/fstab << "EOF"
LABEL=BOOT /boot vfat noauto,noatime 1 2
/dev/mapper/vg-swap none swap sw 0 0
/dev/mapper/vg-root / ext4 noatime,nodiratime,defaults 0 1
tmpfs /run tmpfs rw,nodev,nosuid 0 0
EOF
  • compile in ram:
root # echo 'PORTAGE_TMPDIR="/run"' > /etc/portage/make.conf
  • Deploy your ego profile:
root # ego profile mix-in encrypted-root
  • Deploy your package.use file:
root # cat > /etc/portage/package.use << "EOF"
sys-kernel/debian-sources lvm luks
sys-kernel/debian-sources-lts lvm luks
sys-boot/grub device-mapper
sys-fs/lvm2 static-libs
sys-kernel/genkernel cryptsetup
dev-libs/openssl static-libs
dev-libs/json-c static-libs
app-crypt/argon2 static-libs
dev-libs/popt static-libs
sys-fs/cryptsetup static
dev-libs/libgpg-error static-libs
sys-kernel/linux-firmware initramfs
EOF
  • merge stuff:
root # ego sync && emerge grub haveged intel-microcode linux-firmware eix cryptsetup lvm2 debian-sources debian-sources-lts && emerge -vuND @world
  • add required services:
root # rc-update add device-mapper sysinit
root # rc-update add dmcrypt sysinit
root # rc-update add lvm sysinit

Bootloader Configuration

/etc/boot.conf

boot {
  generate grub
  default "Funtoo Linux"
  timeout 3
}
"Funtoo Linux" {
	kernel kernel[-v]
	initrd initramfs[-v]
  params += cryptdevice=PARTLABEL=FUNTOO luks root=PARTLABEL=FUNTOO  rootfstype=auto
}

Now, run ego boot update to write the configuration files to /boot/grub/grub.cfg

Another Example

Configure the bootloader as described above, with correct kernel and initramfs images names. An example for grub2. You will be editing /etc/boot.conf: 

boot {
  generate grub
  default "Funtoo Linux"
  timeout 3
}
"Funtoo Linux" {
	kernel kernel[-v]
	initrd initramfs[-v]
  params += crypt_root=PARTLABEL=FUNTOO dolvm real_root=/dev/mapper/vg-root  rootfstype=ext4

GRUB

  • Install grub in legacy mode:
root # grub-install --target=i386-pc /dev/sdc 
root # ego boot update

EFI from Legacy

  • manually make efi directory:
  • remount /dev/sdc2 to /boot/efi:
  • install efi images:
root # mkdir /boot/efi
root # mount /dev/sdc2 /boot/efi
root # grub-install --target=x86_64-efi /boot/efi

EFI from EFI

root #mount -o remount,rw /sys/firmware/efi/efivars
root #grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id="Funtoo Linux [GRUB]" --recheck /dev/sda
root #ego boot update

Final steps

exit chroot, unmount everything, close encrypted drive and reboot 

root # exit
root # swapon
NAME           TYPE      SIZE USED PRIO
/home/swapfile file        4G   2M   -2
/dev/dm-1      partition   2G   0B   -3
root # swapoff /dev/dm-1
root # cd ..
root # umount -l -v /mnt/funtoo/{dev, proc, home, usr/portage, boot} 
root # umount -lR funtoo
root # vgchange -a n
root # cryptsetup luksClose dmcrypt_root

After reboot you will get the following: 

>>> better-initramfs started. Kernel version 2.6.35-gentoo-r10
>>> Create all the symlinks to /bin/busybox.
>>> Initiating /dev/dir
>>> Getting LVM volumes up (if any)
Reding all physical volumes. This make take awhile...
No volume group found
No volume group found
>>> Opening encrypted partition and mapping to /dev/mapper/dmcrypt_root
Enter passphrase fore /dev/sda2:

Type your password 

>>> Again, getting LVM volumes up (if any, after map dmcrypt).
  Reading all physical volumes.  This may take a while...
  Found volume group "vg" using metadata type lvm2
  4 logical volume(s) in volume group "vg" now active
>>> Mounting rootfs to /newroot
>>> Umounting /sys and /proc.
>>> Switching root to /newroot and executing /sbin/init.
INIT: version 2.88 booting
Loading /libexec/rc/console/keymap
  OpenRC 0.6.1 is starting up Funtoo Linux (x86_64)
...boot messages omitted for clarity
   
orion login: oleg
Password:
Last login: Thu Oct 14 20:49:21 EEST 2010 on tty1
oleg@orion ~ %

management

Change your LUKs-encrypted drive's passphrase

You may want to change your encrypted volume’s passphrase or password from time to time. To do so, run the following commands in the console as root: 

root # cryptsetup luksChangeKey /dev/sda3

You'll be prompted to enter in the existing passphrase first, then to enter in your new passphrase. You will not be asked to confirm your new passphrase, so be careful when running this operation.


Additional links and information

Retrieved from "https://www.funtoo.org/index.php?title=Encrypted_Root&oldid=34481"