The Funtoo Linux project has transitioned to "Hobby Mode" and this wiki is now read-only.
Rootfs over encrypted lvm
This howto describes how to setup LVM and rootfs with cryptoLUKS-encrypted drive. It is not meant to be a standalone installation guide, rather, it is meant to be read alongside the Funtoo Linux Installation Guide.
Prepare the hard drive and partitions
- List the device to be partitioned, mine is on /dev/sdc
root # lsblk -o name,size,label,partlabel
Partition
root # cgdisk /dev/sdc
delete everything.
Command: new ↵ First sector: ↵ Last sector: +1M ↵ Hex Code: EF02 ↵ Enter name: BIOS Boot ↵
scroll down to large chunk of free space:
Command: new ↵ First sector: ↵ Last sector: +128M ↵ Hex Code: EF00 ↵ Enter name: BOOT ↵
scroll down to large chunk of free space:
Command: new ↵ First sector: ↵ Last sector: ↵ Hex Code: 8304 ↵ Enter name: FUNTOO ↵
Disk Drive: /dev/sdc
Size: 62333952, 29.7 GiB
Part. # Size Partition Type Partition Name
----------------------------------------------------------------
1007.0 KiB free space
1 1024.0 KiB BIOS boot partition BIOS Boot
2 256.0 MiB EFI System BOOT
3 29.5 GiB Linux x86-64 root (/) FUNTOO
Command: write ↵ Command: quit ↵
Encrypting the drive
Read more about different cipher options here: [1]
root # cryptsetup luksFormat /dev/sdc3
Or use SHA512 for increase security. Do NOT use SHA-1: LUKS disk encryption. As the cryptography expert Bruce Schneier already told in year 2005, do not use SHA-1 because its broken. See his article here: [2]
root # cryptsetup --cipher twofish-xts-plain64 --hash sha512 --key-size 256 luksFormat /dev/sdc3
Support for twofish-xts-plain64 is NOT in the default debian-kernel. You will need to configure and compile your own kernel if you choose this.
Initializes the volume
Initializes the volume, and sets an initial key or passphrase:
root # cryptsetup luksOpen /dev/sdc3 dmcrypt_root
There you'll be prompted to enter your password phrase for encrypted drive, type your paranoid password there.
The default keymap at boot time is us. If you enter your passphrase using a different keymap, you won't be able to unlock your crypt volume if the passphrase contains any characters that are located elsewere on your keyboard layout that with the us layout.
Create logical volumes
root # pvcreate /dev/mapper/dmcrypt_root root # vgcreate vg /dev/mapper/dmcrypt_root root # lvcreate -L2G --name swap vg root # lvcreate -l 100%FREE --name root vg
Feel free to specify your desired size by altering the numbers after the -L flag. For example, to make your portage dataset 20GB's, use the flag -L20G instead of -L5G.
Please, notice that above mentioned partitioning scheme is an example and not a default recommendation, change it accordingly to desired scheme.
Create a filesystem on volumes
root # mkfs.vfat -F 32 /dev/sdc2 root # fatlabel /dev/sdc2 "BOOT" root # mkswap /dev/mapper/vg-swap root # mkfs.ext4 /dev/mapper/vg-root
Basic system setup
root # swapon /dev/mapper/vg-swap root # mkdir /mnt/funtoo root # mount /dev/mapper/vg-root /mnt/funtoo root # mkdir /mnt/funtoo/boot root # mount /dev/sdc2 /mnt/funtoo/boot
Get Funtoo Gnome
You can pull your Subarches gnome tarball if you wish:
root # cd /mnt/funtoo root # wget https://build.funtoo.org/1.4-release-std/x86-64bit/generic_64/gnome-latest.tar.xz root # tar --numeric-owner --xattrs --xattrs-include='*' -xpf *gnome* && rm -f *gnome*
Load Funtoo
- expand your run tmpfs to be half of your ram:
root # mount -t tmpfs tmpfs /run
- mount up:
root # cd /mnt/funtoo && mount -t proc none proc mount --rbind /sys sys mount --rbind /dev dev mount --rbind /run run
- chroot in:
root # cd /mnt/funtoo && env -i HOME=/root TERM=$TERM chroot . bash -l
- Set yo password:
- set yo hostname:
- set cloudflare dns resolution for installing:
- Set yo time zone:
root # passwd root # echo 'hostname="crypto"' > /etc/conf.d/hostname root # echo "nameserver 1.1.1.1" > /etc/resolv.conf root # ln -sf /usr/share/zoneinfo/America/Detroit /etc/localtime
- Deploy your fstab:
root # cat > /etc/fstab << "EOF" LABEL=BOOT /boot vfat noauto,noatime 1 2 /dev/mapper/vg-swap none swap sw 0 0 /dev/mapper/vg-root / ext4 noatime,nodiratime,defaults 0 1 tmpfs /run tmpfs rw,nodev,nosuid 0 0 EOF
- compile in ram:
root # echo 'PORTAGE_TMPDIR="/run"' > /etc/portage/make.conf
- Deploy your ego profile:
root # ego profile mix-in encrypted-root
- Deploy your package.use file:
root # cat > /etc/portage/package.use << "EOF" sys-kernel/debian-sources lvm luks sys-kernel/debian-sources-lts lvm luks sys-boot/grub device-mapper sys-fs/lvm2 static-libs sys-kernel/genkernel cryptsetup dev-libs/openssl static-libs dev-libs/json-c static-libs app-crypt/argon2 static-libs dev-libs/popt static-libs sys-fs/cryptsetup static dev-libs/libgpg-error static-libs sys-kernel/linux-firmware initramfs EOF
- merge stuff:
root # ego sync && emerge grub haveged intel-microcode linux-firmware eix cryptsetup lvm2 debian-sources debian-sources-lts
Bootloader Configuration
testing stock ego boot update & grub install.
- Install grub in legacy mode:
root # grub-install --target=i386-pc /dev/sdc root # ego boot update
- manually make efi directory:
- remount /dev/sdc2 to /boot/efi:
- install efi images:
root # mkdir /boot/efi root # mount /dev/sdc2 /boot/efi root # grub-install --target=x86_64-efi /boot/efi
below may be dangerous to your system
boot.conf
An example /etc/boot.conf for better-initramfs:
boot {
generate grub
default "Funtoo Linux"
timeout 3
}
"Funtoo Linux" {
kernel vmlinuz[-v]
initrd initramfs[-v]
params += enc_root=PARTLABEL=FUNTOO lvm luks root=/dev/mapper/vg-root rootfstype=auto resume=swap:/dev/mapper/vg-swap
}
Now, run ego boot update to write the configuration files to /boot/grub/grub.cfg
Another Example
Configure the bootloader as described above, with correct kernel and initramfs images names. An example for grub2. You will be editing /etc/boot.conf:
boot {
generate grub
default "Funtoo Linux"
timeout 3
}
"Funtoo Linux" {
kernel kernel[-v]
initrd initramfs[-v]
params += crypt_root=PARTLABEL=FUNTOO dolvm real_root=/dev/mapper/vg-root rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
}
Final steps
exit chroot, unmount everything, close encrypted drive and reboot
root # exit root # swapon NAME TYPE SIZE USED PRIO /home/swapfile file 4G 2M -2 /dev/dm-1 partition 2G 0B -3 root # swapoff /dev/dm-1 root # cd .. root # umount -l -v /mnt/funtoo/{dev, proc, home, usr/portage, boot} root # umount -lR funtoo root # vgchange -a n root # cryptsetup luksClose dmcrypt_root
After reboot you will get the following:
>>> better-initramfs started. Kernel version 2.6.35-gentoo-r10 >>> Create all the symlinks to /bin/busybox. >>> Initiating /dev/dir >>> Getting LVM volumes up (if any) Reding all physical volumes. This make take awhile... No volume group found No volume group found >>> Opening encrypted partition and mapping to /dev/mapper/dmcrypt_root Enter passphrase fore /dev/sda2:
Type your password
>>> Again, getting LVM volumes up (if any, after map dmcrypt). Reading all physical volumes. This may take a while... Found volume group "vg" using metadata type lvm2 4 logical volume(s) in volume group "vg" now active >>> Mounting rootfs to /newroot >>> Umounting /sys and /proc. >>> Switching root to /newroot and executing /sbin/init. INIT: version 2.88 booting Loading /libexec/rc/console/keymap OpenRC 0.6.1 is starting up Funtoo Linux (x86_64) ...boot messages omitted for clarity orion login: oleg Password: Last login: Thu Oct 14 20:49:21 EEST 2010 on tty1 oleg@orion ~ %
management
Change your LUKs-encrypted drive's passphrase
You may want to change your encrypted volume’s passphrase or password from time to time. To do so, run the following commands in the console as root:
root # cryptsetup luksChangeKey /dev/sda3
You'll be prompted to enter in the existing passphrase first, then to enter in your new passphrase. You will not be asked to confirm your new passphrase, so be careful when running this operation.