Installing Gentoo with full disk encryption
The purpose of this exercise - install Gentoo where all disk partitions are encrypted.
Boot from a system rescue disk and partition the disk - use GPT partition table where the first partition is reserved, second is the boot, and the third one is for the rest of the data.
Device Start End Sectors Size Type /dev/sda1 2048 32767 30720 15M BIOS boot /dev/sda2 32768 442367 409600 200M Linux filesystem /dev/sda3 442368 375093902 374651535 178.7G Linux filesystem
Encrypt partitions number 2 and 3, and open them
cryptsetup luksFormat /dev/sda2 cryptsetup luksFormat /dev/sda3 cryptsetup luksOpen /dev/sda2 crypt_boot cryptsetup luksOpen /dev/sda3 crypt_data
Format the boot partition
mkfs.btrfs /dev/mapper/crypt_boot
Prepare LVM for the rest, and format the top level
vgcreate vg0 /dev/mapper/crypt_data lvcreate -l 100%FREE -n data vg0 mkfs.btrfs /dev/vg0/data
Mount and set up any subvolumes
mount /dev/vg0/data /mnt/gentoo btrfs subvol create /mnt/gentoo/@ /mnt/gentoo/@home umount /mnt/gentoo
Now mount the chroot
mount /dev/vg0/data -o subvol=@ /mnt/gentoo install -d -m 01000 /mnt/gentoo/home mount /dev/vg0/data -o subvol=@home /mnt/gentoo/home
Install Gentoo as usual (unpack the stage)
Add a file-based key so you can autodecrypt on boot
mkdir /mnt/gentoo/etc/luks dd bs=2048 if=/dev/urandom count=1 of=/mnt/gentoo/etc/luks/data.key dd bs=2048 if=/dev/urandom count=1 of=/mnt/gentoo/etc/luks/boot.key cryptsetup luksAddKey /dev/sda2 /mnt/gentoo/etc/luks/boot.key cryptsetup luksAddKey /dev/sda3 /mnt/gentoo/etc/luks/data.key
Fix the configuration files
/etc/fstab
Enable crypto grub
echo GRUB_ENABLE_CRYPTODISK=y >> /etc/default/grub
Automount the crypto disks on boot:
cat > /etc/dracut.conf.d/crypto.conf <<EOF install_items+=" /etc/luks/boot.key" install_items+=" /etc/luks/data.key" EOF dracut -f '' 4.4.1-generic
Comments
Post a Comment