Difference between revisions of "Encrypted Root"

Revision as of 03:28, December 3, 2020

This document describes how to setup a swapless encrypted root partition without lvm.

Warning

Rootfs_over_encrypted_lvm works, this page currently does not. you may try to get this working at your own risk!

Prepare the hard drive and partitions

List the device to be partitioned, mine is on /dev/sdc

root # lsblk -o name,size,label,partlabel

Partition

root # cgdisk /dev/sdc

delete everything.

Command:  new ↵
First sector: ↵
Last sector: +1M ↵
Hex Code: EF02 ↵
Enter name: BIOS Boot ↵

scroll down to large chunk of free space:

Command: new ↵
First sector: ↵
Last sector: +128M ↵
Hex Code: EF00 ↵
Enter name: BOOT ↵

scroll down to large chunk of free space:

Command: new ↵
First sector: ↵
Last sector: ↵
Hex Code:  8304 ↵
Enter name: FUNTOO ↵

Disk Drive: /dev/sdc
                            Size: 62333952, 29.7 GiB

Part. #     Size        Partition Type            Partition Name
----------------------------------------------------------------
            1007.0 KiB  free space
   1        1024.0 KiB  BIOS boot partition	  BIOS Boot
   2        256.0 MiB   EFI System                BOOT
   3        29.5 GiB    Linux x86-64 root (/)     FUNTOO

Command: write ↵
Command: quit ↵

Encrypt the drive

root # cryptsetup luksFormat --type luks2 --label=FUNTOO /dev/sdc3

YES not yes....
enter your password:

Initialize the volume

Initialize the volume:

root # cryptsetup luksOpen /dev/sdc3 dmcrypt_root

Create logical volumes

root # pvcreate /dev/mapper/dmcrypt_root
root # vgcreate vg /dev/mapper/dmcrypt_root          
root # lvcreate -l 100%FREE --name root vg

Create your filesystem

root # mkfs.vfat -F 32 /dev/sdc2
root # fatlabel /dev/sdc2 "BOOT"
root # mkfs.jfs /dev/mapper/vg-root

Mount

root # mkdir /mnt/funtoo
root # mount /dev/mapper/vg-root /mnt/funtoo
root # mkdir  /mnt/funtoo/boot
root # mount /dev/sdc2 /mnt/funtoo/boot

Get Funtoo Gnome

You can pull your Subarches gnome tarball if you wish:

root # cd /mnt/funtoo
root # wget https://build.funtoo.org/1.4-release-std/x86-64bit/generic_64/gnome-latest.tar.xz
root # tar --numeric-owner --xattrs --xattrs-include='*' -xpf *gnome* && rm -f *gnome*

Load Funtoo

expand your run tmpfs to be half of your ram:

root # mount -t tmpfs tmpfs /run

mount up:

root # cd /mnt/funtoo && mount -t proc none proc
mount --rbind /sys sys
mount --rbind /dev dev
mount --rbind /run run

chroot in:

root # cd /mnt/funtoo && env -i HOME=/root TERM=$TERM chroot . bash -l

Set yo password:
set yo hostname:
set cloudflare dns resolution for installing:
Set yo time zone:

root # passwd
root # echo 'hostname="crypto"' > /etc/conf.d/hostname
root # echo "nameserver 1.1.1.1" > /etc/resolv.conf
root # ln -sf /usr/share/zoneinfo/America/Detroit /etc/localtime

load your fstab

Deploy your fstab:

root # cat > /etc/fstab << "EOF"
LABEL=BOOT /boot vfat noauto,noatime 1 2
/dev/mapper/vg-root / jfs noatime,nodiratime,defaults 0 1
tmpfs /run tmpfs rw,nodev,nosuid 0 0
EOF

load your crypttab:

root # echo "dmcrypt_root LABEL=FUNTOO none luks" >> /etc/crypttab
root # dmsetup table >> /etc/dmtab

compile in ram:

root # echo 'PORTAGE_TMPDIR="/run"' > /etc/portage/make.conf

Sync & deploy your profile:

root # ego sync && ego profile mix-in encrypted-root

Deploy your package.use file:

root # cat > /etc/portage/package.use << "EOF"
*/* lvm device-mapper
sys-kernel/linux-firmware initramfs
EOF

root # emerge jfsutils grub haveged intel-microcode linux-firmware eix cryptsetup lvm2 && emerge -vuND @world && emerge --depclean

set services:

root # rc-update del swap boot && rc-update add haveged && rc-update add gpm && rc-update add busybox-ntpd
root # rc-update add device-mapper boot
root # rc-update add dmcrypt boot
root # rc-update add lvm boot

Bootloader Configuration

/etc/boot.conf

boot {
  generate grub
  default "Funtoo Linux"
  timeout 3
}
"Funtoo Linux" {
	kernel kernel[-v]
	initrd initramfs[-v]
  params += crypt_root=LABEL=FUNTOO dolvm luks=yes real_root=/dev/mapper/dmcrypt_root rootfstype=ext4
}

GRUB

Install grub in legacy mode:

root # grub-install --target=i386-pc /dev/sdc 
root # ego boot update

EFI from Legacy

manually make efi directory:
remount /dev/sdc2 to /boot/efi:
install efi images:

root # mkdir /boot/efi
root # mount /dev/sdc2 /boot/efi
root # grub-install --target=x86_64-efi /boot/efi

EFI from EFI

root #mount -o remount,rw /sys/firmware/efi/efivars
root #grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id="Funtoo Linux [GRUB]" --recheck /dev/sda
root #ego boot update

Final steps

exit chroot, unmount everything,and close encrypted root:

root # exit
root # cd ..
root # umount -lR funtoo
root # cryptsetup luksClose dmcrypt_root

management

Change your LUKs-encrypted drive's passphrase

You may want to change your encrypted volume’s passphrase or password from time to time. To do so, run the following commands in the console as root:

root # cryptsetup luksChangeKey /dev/sda3

You'll be prompted to enter in the existing passphrase first, then to enter in your new passphrase. You will not be asked to confirm your new passphrase, so be careful when running this operation.

External Resources

@@ Line 138: / Line 138: @@
 ###i## cat > /etc/fstab << "EOF"
 LABEL=BOOT /boot vfat noauto,noatime 1 2
-/dev/mapper/dmcrypt_root / ext4 noatime,nodiratime,defaults 0 1
+/dev/mapper/vg-root / jfs noatime,nodiratime,defaults 0 1
 tmpfs /run tmpfs rw,nodev,nosuid 0 0
 EOF
@@ Line 168: / Line 168: @@
 {{console|body=
-###i## emerge grub haveged intel-microcode linux-firmware eix cryptsetup lvm2 debian-sources-lts && emerge debian-sources && emerge -vuND @world && emerge --depclean
+###i## emerge jfsutils grub haveged intel-microcode linux-firmware eix cryptsetup lvm2 && emerge -vuND @world && emerge --depclean
 }}
@@ Line 176: / Line 176: @@
 ###i## rc-update add device-mapper boot
 ###i## rc-update add dmcrypt boot
+###i## rc-update add lvm boot
 }}