https://wiki.archlinux.org/api.php?action=feedcontributions&user=Baz&feedformat=atomArchWiki - User contributions [en]2024-03-29T12:30:09ZUser contributionsMediaWiki 1.41.0https://wiki.archlinux.org/index.php?title=Dm-crypt/Encrypting_an_entire_system&diff=512992Dm-crypt/Encrypting an entire system2018-03-08T09:30:33Z<p>Baz: /* LVM on LUKS */ fix dead link</p>
<hr />
<div>{{Lowercase title}}<br />
[[Category:Encryption]]<br />
[[Category:File systems]]<br />
[[Category:Getting and installing Arch]]<br />
[[de:Systemverschlüsselung mit dm-crypt]]<br />
[[es:Dm-crypt/Encrypting an entire system]]<br />
[[ja:Dm-crypt/システム全体の暗号化]]<br />
<br />
The following are examples of common scenarios of full system encryption with ''dm-crypt''. They explain all the adaptations that need to be done to the normal [[Installation guide|installation procedure]]. All the necessary tools are on the [https://www.archlinux.org/download/ installation image].<br />
<br />
== Overview ==<br />
<br />
Securing a root filesystem is where ''dm-crypt'' excels, feature and performance-wise. Unlike selectively encrypting non-root filesystems, an encrypted root filesystem can conceal information such as which programs are installed, the usernames of all user accounts, and common data-leakage vectors such as [[mlocate]] and {{ic|/var/log/}}. Furthermore, an encrypted root filesystem makes tampering with the system far more difficult, as everything except the [[boot loader]] and (usually) the kernel is encrypted.<br />
<br />
All scenarios illustrated in the following share these advantages, other pros and cons differentiating them are summarized below:<br />
<br />
{| class="wikitable"<br />
! Scenarios<br />
! Advantages<br />
! Disadvantages<br />
|----------------------------------------------------------<br />
| [[#Simple partition layout with LUKS]]<br />
shows a basic and straight-forward set-up for a fully LUKS encrypted root.<br />
|<br />
* Simple partitioning and setup<br />
|<br />
* Inflexible; disk-space to be encrypted has to be pre-allocated<br />
|----------------------------------------------------------<br />
| [[#LVM on LUKS]]<br />
achieves partitioning flexiblity by using LVM inside a single LUKS encrypted partition.<br />
|<br />
* Simple partitioning with knowledge of LVM<br />
* Only one key required to unlock all volumes (e.g. easy resume-from-disk setup)<br />
* Volume layout not transparent when locked<br />
* Easiest method to allow [[Dm-crypt/Swap_encryption#With_suspend-to-disk_support|suspension to disk]]<br />
|<br />
* LVM adds an additional mapping layer and hook<br />
* Less useful, if a singular volume should receive a separate key<br />
|----------------------------------------------------------<br />
| [[#LUKS on LVM]]<br />
uses dm-crypt only after the LVM is setup.<br />
|<br />
* LVM can be used to have encrypted volumes span multiple disks<br />
* Easy mix of un-/encrypted volume groups<br />
|<br />
* Complex; changing volumes requires changing encryption mappers too<br />
* Volumes require individual keys<br />
* LVM layout is transparent when locked<br />
|----------------------------------------------------------<br />
| [[#LUKS on software RAID]]<br />
uses dm-crypt only after RAID is setup.<br />
|<br />
* Analogous to LUKS on LVM<br />
|<br />
* Analogous to LUKS on LVM<br />
|----------------------------------------------------------<br />
| [[#Plain dm-crypt]]<br />
uses dm-crypt plain mode, i.e. without a LUKS header and its options for multiple keys. <br>This scenario also employs USB devices for {{ic|/boot}} and key storage, which may be applied to the other scenarios.<br />
|<br />
* Data resilience for cases where a LUKS header may be damaged<br />
* Allows [[Wikipedia:Disk encryption#Full disk encryption|Full Disk Encryption]]<br />
* Helps addressing [[Dm-crypt/Specialties#Discard/TRIM support for solid state drives (SSD)|problems]] with SSDs<br />
|<br />
* High care to all encryption parameters is required<br />
* Single encryption key and no option to change it<br />
|----------------------------------------------------------<br />
| [[#Encrypted boot partition (GRUB)]]<br />
shows how to encrypt the boot partition using the GRUB bootloader. <br> This scenario also employs an ESP partition, which may be applied to the other scenarios.<br />
|<br />
* Same advantages as the scenario the installation is based on (LVM on LUKS for this particular example)<br />
* Less data is left unencrypted, i.e. the boot loader and the ESP partition, if present<br />
|<br />
* Same disadvantages as the scenario the installation is based on (LVM on LUKS for this particular example)<br />
* More complicated configuration<br />
* Not supported by other boot loaders<br />
|----------------------------------------------------------<br />
| [[#Btrfs subvolumes with swap]]<br />
shows how to encrypt a [[Btrfs]] system, including the {{ic|/boot}} directory, also adding a partition for swap, on UEFI hardware.<br />
|<br />
* Similar advantages as [[#Encrypted boot partition (GRUB)]]<br />
* Availability of Btrfs' features<br />
|<br />
* Similar disadvantages as [[#Encrypted boot partition (GRUB)]]<br />
|}<br />
<br />
While all above scenarios provide much greater protection from outside threats than encrypted secondary filesystems, they also share a common disadvantage: any user in possession of the encryption key is able to decrypt the entire drive, and therefore can access other users' data. If that is of concern, it is possible to use a combination of blockdevice and stacked filesystem encryption and reap the advantages of both. See [[Disk encryption]] to plan ahead.<br />
<br />
See [[Dm-crypt/Drive preparation#Partitioning]] for a general overview of the partitioning strategies used in the scenarios.<br />
<br />
Another area to consider is whether to set up an encrypted swap partition and what kind. See [[Dm-crypt/Swap encryption]] for alternatives.<br />
<br />
If you anticipate to protect the system's data not only against physical theft, but also have a requirement of precautions against logical tampering, see [[Dm-crypt/Specialties#Securing the unencrypted boot partition]] for further possibilities after following one of the scenarios.<br />
<br />
{{Warning|In any scenario, never use file system repair software such as [[fsck]] directly on an encrypted volume, or it will destroy any means to recover the key used to decrypt your files. Such tools must be used on the decrypted (opened) device instead.}}<br />
<br />
== Simple partition layout with LUKS ==<br />
<br />
This example covers a full system encryption with ''dmcrypt'' + LUKS in a simple partition layout:<br />
<br />
+--------------------+--------------------------+---------------------------+<br />
| Boot partition | LUKS encrypted system | Optional free space |<br />
| | partition | for additional partitions |<br />
| | | or swap to be setup later |<br />
| /boot | / | |<br />
| | | |<br />
| | /dev/mapper/cryptroot | |<br />
| +--------------------------| |<br />
| /dev/sdaY | /dev/sdaX | |<br />
+--------------------+--------------------------+---------------------------+<br />
<br />
The first steps can be performed directly after booting the Arch Linux install image.<br />
<br />
=== Preparing the disk ===<br />
<br />
Prior to creating any partitions, you should inform yourself about the importance and methods to securely erase the disk, described in [[Dm-crypt/Drive preparation]].<br />
<br />
Then create the needed partitions, at least one for {{ic|/}} (e.g. {{ic|/dev/sdaX}}) and {{ic|/boot}} ({{ic|/dev/sdaY}}). See [[Partitioning]].<br />
<br />
=== Preparing non-boot partitions ===<br />
<br />
The following commands create and mount the encrypted root partition. They correspond to the procedure described in detail in [[Dm-crypt/Encrypting a non-root file system#Partition]] (which, despite the title, ''can'' be applied to root partitions, as long as [[#Configuring mkinitcpio|mkinitcpio]] and the [[#Configuring the boot loader|boot loader]] are correctly configured).<br />
If you want to use particular non-default encryption options (e.g. cipher, key length), see the [[Dm-crypt/Device encryption#Encryption_options_for_LUKS_mode|encryption options]] before executing the first command:<br />
<br />
# cryptsetup -y -v luksFormat --type luks2 /dev/sdaX<br />
# cryptsetup open /dev/sdaX cryptroot<br />
# mkfs.ext4 /dev/mapper/cryptroot<br />
# mount /dev/mapper/cryptroot /mnt<br />
<br />
Check the mapping works as intended:<br />
# umount /mnt<br />
# cryptsetup close cryptroot<br />
# cryptsetup open /dev/sdaX cryptroot<br />
# mount /dev/mapper/cryptroot /mnt<br />
<br />
If you created separate partitions (e.g. {{ic|/home}}), these steps have to be adapted and repeated for all of them, ''except'' for {{ic|/boot}}. See [[Dm-crypt/Encrypting a non-root file system#Automated unlocking and mounting]] on how to handle additional partitions at boot.<br />
<br />
Note that each blockdevice requires its own passphrase. This may be inconvenient, because it results in a separate passphrase to be input during boot. An alternative is to use a keyfile stored in the system partition to unlock the separate partition via {{ic|crypttab}}. See [[Dm-crypt/Device encryption#Using LUKS to format partitions with a keyfile]] for instructions.<br />
<br />
=== Preparing the boot partition ===<br />
<br />
What you do have to setup is a non-encrypted {{ic|/boot}} partition, which is needed for a encrypted root. For a standard [[EFI|MBR/non-EFI]] {{ic|/boot}} partition, for example, execute:<br />
# mkfs.ext4 /dev/sdaY<br />
# mkdir /mnt/boot<br />
# mount /dev/sdaY /mnt/boot<br />
<br />
=== Mounting the devices ===<br />
<br />
At [[Installation guide#Mount the file systems]] you will have to mount the mapped devices, not the actual partitions. Of course {{ic|/boot}}, which is not encrypted, will still have to be mounted directly.<br />
<br />
Afterwards continue with the installation procedure up to the mkinitcpio step.<br />
<br />
=== Configuring mkinitcpio ===<br />
<br />
Add the {{ic|keyboard}}, {{ic|keymap}} and {{ic|encrypt}} hooks to [[mkinitcpio.conf]]. If the default US keymap is fine for you, you can omit the {{ic|keymap}} hook.<br />
<br />
{{hc|/etc/mkinitcpio.conf|2=<br />
HOOKS=(... '''keyboard''' '''keymap''' block '''encrypt''' ... filesystems ...)<br />
}}<br />
<br />
Depending on which other hooks are used, the order may be relevant. See [[dm-crypt/System configuration#mkinitcpio]] for details and other hooks that you may need.<br />
<br />
=== Configuring the boot loader ===<br />
<br />
In order to unlock the encrypted root partition at boot, the following kernel parameters need to be set by the boot loader:<br />
<br />
cryptdevice=UUID=''<device-UUID>'':cryptroot root=/dev/mapper/cryptroot<br />
<br />
See [[Dm-crypt/System configuration#Boot loader]] for details.<br />
<br />
The {{ic|''<device-UUID>''}} refers to the UUID of {{ic|/dev/sdaX}}. See [[Persistent block device naming]] for details.<br />
<br />
== LVM on LUKS ==<br />
<br />
The straight-forward method is to set up [[LVM]] on top of the encrypted partition instead of the other way round. Technically the LVM is setup inside one big encrypted blockdevice. Hence, the LVM is not transparent until the blockdevice is unlocked and the underlying volume structure is scanned and mounted during boot.<br />
<br />
The disk layout in this example is:<br />
+--------------------------------------------------------------------------+ +----------------+<br />
| Logical volume1 | Logical volume2 | Logical volume3 | | Boot partition |<br />
| | | | | |<br />
| [SWAP] | / | /home | | /boot |<br />
| | | | | |<br />
| /dev/mapper/MyVol-swap | /dev/mapper/MyVol-root | /dev/mapper/MyVol-home | | |<br />
|_ _ _ _ _ __ _ _ _ _ _ _|__ _ _ _ _ _ _ _ _ _ _ _|__ _ _ _ _ _ _ _ _ _ _ _| | (may be on |<br />
| | | other device) |<br />
| LUKS encrypted partition | | |<br />
| /dev/sdaX | | /dev/sdbY |<br />
+--------------------------------------------------------------------------+ +----------------+<br />
<br />
{{Warning|This method does not allow you to span the logical volumes over multiple disks easily; see [[Dm-crypt/Specialties#Modifying the encrypt hook for multiple partitions]].}}<br />
<br />
{{Tip|Three variants of this setup:<br />
* Instructions at [[dm-crypt/Specialties#Encrypted system using a detached LUKS header]] use this setup with a detached LUKS header on a USB device to achieve a two factor authentication with it.<br />
* Instructions at [https://web.archive.org/web/20180103175714/http://www.pavelkogan.com/2014/05/23/luks-full-disk-encryption/ Pavel Kogan's blog] show how to encrypt the {{ic|/boot}} partition while keeping it on the main LUKS partition when using GRUB.<br />
* Instructions at [[Dm-crypt/Specialties#Encrypted /boot and a detached LUKS header on USB]] use this setup with a detached LUKS header, encrypted {{ic|/boot}} partition, and encrypted keyfile all on a USB device.<br />
}}<br />
<br />
=== Preparing the disk ===<br />
<br />
Prior to creating any partitions, you should inform yourself about the importance and methods to securely erase the disk, described in [[Dm-crypt/Drive preparation]].<br />
<br />
When using the [[GRUB]] bootloader together with [[GPT]], create a BIOS Boot Partition as explained in [[GRUB#BIOS systems]].<br />
<br />
Create a partition to be mounted at {{ic|/boot}} of type {{ic|8300}} with a size of 200 MiB or more.<br />
<br />
Create a partition of type {{ic|8E00}}, which will later contain the encrypted container.<br />
<br />
Create the LUKS encrypted container at the "system" partition. Enter the chosen password twice.<br />
<br />
# cryptsetup luksFormat --type luks2 /dev/''sdaX''<br />
<br />
For more information about the available cryptsetup options see the [[Dm-crypt/Device encryption#Encryption_options_for_LUKS_mode|LUKS encryption options]] prior to above command.<br />
<br />
Open the container:<br />
<br />
# cryptsetup open /dev/''sdaX'' cryptolvm<br />
<br />
The decrypted container is now available at {{ic|/dev/mapper/cryptolvm}}.<br />
<br />
=== Preparing the logical volumes ===<br />
<br />
Create a physical volume on top of the opened LUKS container:<br />
<br />
# pvcreate /dev/mapper/cryptolvm<br />
<br />
Create the volume group named {{ic|MyVol}} (or whatever you want), adding the previously created physical volume to it:<br />
<br />
# vgcreate MyVol /dev/mapper/cryptolvm<br />
<br />
Create all your logical volumes on the volume group:<br />
<br />
# lvcreate -L 8G MyVol -n swap<br />
# lvcreate -L 32G MyVol -n root<br />
# lvcreate -l 100%FREE MyVol -n home<br />
<br />
Format your filesystems on each logical volume:<br />
<br />
# mkfs.ext4 /dev/mapper/MyVol-root<br />
# mkfs.ext4 /dev/mapper/MyVol-home<br />
# mkswap /dev/mapper/MyVol-swap<br />
<br />
Mount your filesystems:<br />
<br />
# mount /dev/mapper/MyVol-root /mnt<br />
# mkdir /mnt/home<br />
# mount /dev/mapper/MyVol-home /mnt/home<br />
# swapon /dev/mapper/MyVol-swap<br />
<br />
=== Preparing the boot partition ===<br />
<br />
The bootloader loads the kernel, [[initramfs]], and its own configuration files from the {{ic|/boot}} directory. This directory must be located on a separate unencrypted filesystem.<br />
<br />
Create an Ext2 filesystem on the partition intended for {{ic|/boot}}. Any filesystem that can be read by the bootloader is eligible.<br />
<br />
# mkfs.ext2 /dev/''sdbY''<br />
<br />
Create the directory {{ic|/mnt/boot}}:<br />
<br />
# mkdir /mnt/boot<br />
<br />
Mount the partition to {{ic|/mnt/boot}}:<br />
<br />
# mount /dev/''sdbY'' /mnt/boot<br />
<br />
Afterwards continue with the installation procedure up to the {{ic|mkinitcpio}} step.<br />
<br />
=== Configuring mkinitcpio ===<br />
<br />
Add the {{ic|keyboard}}, {{ic|encrypt}} and {{ic|lvm2}} hooks to [[mkinitcpio.conf]]:<br />
<br />
{{hc|/etc/mkinitcpio.conf|2=<br />
HOOKS=(... '''keyboard''' '''keymap''' block '''encrypt''' '''lvm2''' ... filesystems ...)<br />
}}<br />
<br />
See [[dm-crypt/System configuration#mkinitcpio]] for details and other hooks that you may need.<br />
<br />
=== Configuring the boot loader ===<br />
<br />
In order to unlock the encrypted root partition at boot, the following kernel parameter needs to be set by the boot loader:<br />
<br />
cryptdevice=UUID=''device-UUID'':cryptolvm root=/dev/mapper/MyVol-root<br />
<br />
The {{ic|''<device-UUID>''}} refers to the UUID of {{ic|/dev/sdaX}}. See [[Persistent block device naming]] for details.<br />
<br />
See [[Dm-crypt/System configuration#Boot loader]] for details.<br />
<br />
== LUKS on LVM ==<br />
<br />
To use encryption on top of [[LVM]], the LVM volumes are set up first and then used as the base for the encrypted partitions. This way, a mixture of encrypted and non-encrypted volumes/partitions is possible as well.<br />
{{tip|Unlike [[#LVM on LUKS]], this method allows normally spanning the logical volumes over multiple disks. }}<br />
<br />
The following short example creates a LUKS on LVM setup and mixes in the use of a key-file for the /home partition and temporary crypt volumes for {{ic|/tmp}} and {{ic|/swap}}. The latter is considered desirable from a security perspective, because no potentially sensitive temporary data survives the reboot, when the encryption is re-initialised. If you are experienced with LVM, you will be able to ignore/replace LVM and other specifics according to your plan. If you want to span a logical volume over multiple disks during setup already, a procedure to do so is described in [[Dm-crypt/Specialties#Expanding LVM on multiple disks]].<br />
<br />
{{Expansion|The intro of this scenario needs some adjustment now that a comparison has been added to [[#Overview]]. A suggested structure is to make it similar to the [[#Simple partition layout with LUKS]] intro.}}<br />
<br />
=== Preparing the disk ===<br />
<br />
Partitioning scheme:<br />
<br />
+----------------+--------------------------------------------------------------------------+<br />
| Boot partition | LUKS encrypted volume | LUKS encrypted volume | LUKS encrypted volume |<br />
| | | | |<br />
| /boot | [SWAP] | / | /home |<br />
| | | | |<br />
| | /dev/mapper/swap | /dev/mapper/root | /dev/mapper/home |<br />
| |_ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ _ _ _|_ _ _ _ _ _ _ _ _ __ _ _|<br />
| | Logical volume 1 | Logical volume 2 | Logical volume 3 |<br />
| | /dev/mapper/MyVol-swap | /dev/mapper/MyVol-root | /dev/mapper/MyVol-home |<br />
| |_ _ _ _ _ _ _ _ _ __ _ _|_ _ _ _ _ _ _ _ _ __ _ _|_ _ _ _ _ _ _ _ __ _ _ _|<br />
| | |<br />
| /dev/sda1 | /dev/sda2 |<br />
+----------------+--------------------------------------------------------------------------+<br />
<br />
Randomise {{ic|/dev/sda2}} according to [[Dm-crypt/Drive preparation#dm-crypt wipe on an empty disk or partition]].<br />
<br />
=== Preparing the logical volumes ===<br />
<br />
# pvcreate /dev/sda2<br />
# vgcreate MyVol /dev/sda2<br />
# lvcreate -L 32G -n lvroot MyVol<br />
# lvcreate -L 500M -n swap MyVol<br />
# lvcreate -L 500M -n tmp MyVol<br />
# lvcreate -l 100%FREE -n home MyVol<br />
<br />
# cryptsetup luksFormat --type luks2 /dev/mapper/MyVol-lvroot<br />
# cryptsetup open /dev/mapper/MyVol-lvroot root<br />
# mkfs.ext4 /dev/mapper/root<br />
# mount /dev/mapper/root /mnt<br />
<br />
More information about the encryption options can be found in [[Dm-crypt/Device encryption#Encryption options for LUKS mode]].<br />
Note that {{ic|/home}} will be encrypted in [[#Encrypting logical volume /home]]. Further, note that if you ever have to access the encrypted root from the Arch-ISO, the above {{ic|open}} action will allow you to after the [[LVM#Logical Volumes do not show_up|LVM shows up]].<br />
<br />
=== Preparing the boot partition ===<br />
<br />
# dd if=/dev/zero of=/dev/sda1 bs=1M status=progress<br />
# mkfs.ext4 /dev/sda1<br />
# mkdir /mnt/boot<br />
# mount /dev/sda1 /mnt/boot<br />
<br />
Now after setup of the encrypted LVM partitioning, it would be time to install: [[Installation guide#Mount_the_file_systems|Arch Install Scripts]].<br />
<br />
=== Configuring mkinitcpio ===<br />
<br />
Add the {{ic|keyboard}}, {{ic|lvm2}} and {{ic|encrypt}} hooks to [[mkinitcpio.conf]]:<br />
<br />
{{hc|/etc/mkinitcpio.conf|2=<br />
HOOKS=(... '''keyboard''' '''keymap''' block '''lvm2''' '''encrypt''' ... filesystems ...)<br />
}}<br />
<br />
See [[dm-crypt/System configuration#mkinitcpio]] for details and other hooks that you may need.<br />
<br />
=== Configuring the boot loader ===<br />
<br />
In order to unlock the encrypted root partition at boot, the following kernel parameters need to be set by the boot loader:<br />
<br />
cryptdevice=/dev/mapper/MyVol-lvroot:root root=/dev/mapper/root<br />
<br />
See [[Dm-crypt/System configuration#Boot loader]] for details.<br />
<br />
=== Configuring fstab and crypttab ===<br />
<br />
{{hc|/etc/fstab|<br />
/dev/mapper/root / ext4 defaults 0 1<br />
/dev/sda1 /boot ext4 defaults 0 2<br />
/dev/mapper/tmp /tmp tmpfs defaults 0 0<br />
/dev/mapper/swap none swap sw 0 0<br />
}}<br />
<br />
The following [[crypttab]] options will re-encrypt the temporary filesystems each reboot:<br />
<br />
{{hc|/etc/crypttab|<br />
swap /dev/mapper/MyVol-swap /dev/urandom swap,cipher<nowiki>=aes-xts-plain64,size=</nowiki>256<br />
tmp /dev/mapper/MyVol-tmp /dev/urandom tmp,cipher<nowiki>=aes-xts-plain64,size=</nowiki>256<br />
}}<br />
<br />
=== Encrypting logical volume /home ===<br />
<br />
Since this scenario uses LVM as the primary and dm-crypt as secondary mapper, each encrypted logical volume requires its own encryption. Yet, unlike the temporary filesystems configured with volatile encryption above, the logical volume for {{ic|/home}} should be persistent, of course. The following assumes you have rebooted into the installed system, otherwise you have to adjust paths.<br />
To safe on entering a second passphrase at boot for it, a [[Dm-crypt/Device_encryption#Keyfiles|keyfile]] is created:<br />
<br />
# mkdir -m 700 /etc/luks-keys<br />
# dd if=/dev/random of=/etc/luks-keys/home bs=1 count=256 status=progress<br />
<br />
The logical volume is encrypted with it:<br />
<br />
# cryptsetup luksFormat --type luks2 -v /dev/mapper/MyVol-home /etc/luks-keys/home<br />
# cryptsetup -d /etc/luks-keys/home open /dev/mapper/MyVol-home home<br />
# mkfs.ext4 /dev/mapper/home<br />
# mount /dev/mapper/home /home<br />
<br />
The encrypted mount is configured in [[crypttab]]:<br />
<br />
{{hc|/etc/crypttab|<br />
home /dev/mapper/MyVol-home /etc/luks-keys/home<br />
}}<br />
<br />
{{hc|/etc/fstab|<br />
/dev/mapper/home /home ext4 defaults 0 2<br />
}}<br />
<br />
and setup is done.<br />
<br />
If you want to expand the logical volume for {{ic|/home}} (or any other volume) at a later point, it is important to note that the LUKS encrypted part has to be resized as well. For a procedure see [[Dm-crypt/Specialties#Expanding LVM on multiple disks]].<br />
<br />
== LUKS on software RAID ==<br />
<br />
This example is based on a real-world setup for a workstation class laptop equipped with two SSDs of equal size, and an additional HDD for bulk storage. The end result is LUKS based full disk encryption (including {{ic|/boot}}) for all drives, with the SSDs in a [[RAID|RAID0]] array, and keyfiles used to unlock all encryption after [[GRUB]] is given a correct passphrase at boot.<br />
<br />
This setup utilizes a very simplistic partitioning scheme, with all the available RAID storage being mounted at {{ic|/}} (no separate {{ic|/boot}} partition), and the decrypted HDD being mounted at {{ic|/mnt/data}}. It is also worth mentioning that the system in this example boots in BIOS mode and the drives are partitioned with [[Partitioning|GPT]] partitions. <br />
<br />
Please note that regular [[System backup|backups]] are very important in this setup. If either of the SSDs fail, the data contained in the RAID array will be practically impossible to recover. You may wish to select a different [[RAID#Standard RAID levels|RAID level]] if fault tolerance is important to you. <br />
<br />
The encryption is not deniable in this setup.<br />
<br />
For the sake of the instructions below, the following block devices are used:<br />
/dev/sda = first SSD<br />
/dev/sdb = second SSD<br />
/dev/sdc = HDD<br />
Be sure to substitue them with the appropriate device designations for your setup, as they may be different.<br />
<br />
=== Preparing the disks ===<br />
<br />
Prior to creating any partitions, you should inform yourself about the importance and methods to securely erase the disk, described in [[Dm-crypt/Drive preparation]].<br />
<br />
When using the [[GRUB]] bootloader together with [[GPT]], create a BIOS Boot Partition as explained in [[GRUB#BIOS systems]]. For this setup, this includes a 1M partition for "BIOS boot" at {{ic|/dev/sda1}} and the remaining space on the drive being partitioned for "Linux RAID" at {{ic|/dev/sda2}}. <br />
<br />
Once partitions have been created on {{ic|/dev/sda}}, the following commands can be used to clone them to {{ic|/dev/sdb}}.<br />
# sfdisk -d /dev/sda > sda.dump<br />
# sfdisk /dev/sdb < sda.dump<br />
<br />
The HDD is prepared with a single Linux partition covering the whole drive at {{ic|/dev/sdc1}}.<br />
<br />
=== Building the RAID array ===<br />
<br />
Create the RAID array for the SSDs. This example utilizes RAID0, you may wish to substitute a different level based on your preferences or requirements. <br />
# mdadm --create --verbose --level=0 --metadata=1.2 --raid-devices=2 /dev/md0 /dev/sda2 /dev/sdb2<br />
<br />
=== Preparing the block devices ===<br />
<br />
As explained in [[Dm-crypt/Drive preparation]], the devices are wiped with random data utilizing {{ic|/dev/zero}} and a crypt device with a random key. Alternatively, you could use {{ic|dd}} with {{ic|/dev/random}} or {{ic|/dev/urandom}}, though it will be much slower.<br />
# cryptsetup open --type plain /dev/md0 container --key-file /dev/random<br />
# dd if=/dev/zero of=/dev/mapper/container bs=1M status=progress<br />
# cryptsetup close container<br />
<br />
And repeat above for the HDD ({{ic|/dev/sdc1}} in this example).<br />
<br />
Set up encryption for {{ic|/dev/md0}}:<br />
# cryptsetup -y -v luksFormat --type luks2 /dev/md0<br />
# cryptsetup open /dev/md0 cryptroot<br />
# mkfs.ext4 /dev/mapper/cryptroot<br />
# mount /dev/mapper/cryptroot /mnt<br />
<br />
And repeat for the HDD:<br />
# cryptsetup -y -v luksFormat --type luks2 /dev/sdc1<br />
# cryptsetup open /dev/sdc1 cryptdata<br />
# mkfs.ext4 /dev/mapper/cryptdata<br />
# mkdir -p /mnt/mnt/data<br />
# mount /dev/mapper/cryptdata /mnt/mnt/data<br />
<br />
=== Configuring the boot loader ===<br />
<br />
Configure [[GRUB]] for the encrypted system by editing {{ic|/etc/default/grub}} with the following:<br />
<br />
GRUB_CMDLINE_LINUX="cryptdevice=/dev/md0:cryptroot root=/dev/mapper/cryptroot"<br />
GRUB_ENABLE_CRYPTODISK=y<br />
<br />
See [[Dm-crypt/System configuration#Boot loader]] and [[GRUB#Boot partition]] for details.<br />
<br />
Complete the GRUB install to both SSDs (in reality, installing only to {{ic|/dev/sda}} will work).<br />
# grub-install --target=i386-pc /dev/sda<br />
# grub-install --target=i386-pc /dev/sdb<br />
# grub-mkconfig -o /boot/grub/grub.cfg<br />
<br />
=== Creating the keyfiles ===<br />
<br />
The next steps save you from entering your passphrase twice when you boot the system (once so GRUB can unlock the encryption, and second time once the initramfs assumes control of the system). This is done by creating a [[dm-crypt/Device_encryption#Keyfiles|keyfile]] for the encryption and adding it to the initramfs image to allow the encrypt hook to unlock the root device. See [[dm-crypt/Device encryption#With a keyfile embedded in the initramfs]] for details.<br />
<br />
* Create the [[dm-crypt/Device_encryption#Keyfiles|keyfile]] and add the key to {{ic|/dev/md0}}.<br />
* Create another keyfile for the HDD ({{ic|/dev/sdc1}}) so it can also be unlocked at boot. For convenience, leave the passphrase created above in place as this can make recovery easier if you ever need it. Edit {{ic|/etc/crypttab}} to decrypt the HDD at boot. See [[dm-crypt/Device encryption#Unlocking a secondary partition at boot]].<br />
<br />
=== Configuring the system ===<br />
<br />
Edit [[fstab|/etc/fstab]] to mount the cryptroot and cryptdata block devices:<br />
<br />
/dev/mapper/cryptroot / ext4 rw,noatime 0 1 <br />
/dev/mapper/cryptdata /mnt/data ext4 defaults 0 2 <br />
<br />
Save the RAID configuration:<br />
<br />
# mdadm --detail --scan > /etc/mdadm.conf <br />
<br />
Edit [[mkinitcpio.conf]] to include your keyfile and add the proper hooks:<br />
<br />
FILES=(/crypto_keyfile.bin)<br />
HOOKS=( ... '''keyboard''' '''keymap''' block '''mdadm_udev''' '''encrypt''' filesystems ... )<br />
<br />
See [[dm-crypt/System configuration#mkinitcpio]] for details.<br />
<br />
== Plain dm-crypt ==<br />
<br />
Contrary to LUKS, dm-crypt ''plain'' mode does not require a header on the encrypted device: this scenario exploits this feature to set up a system on an unpartitioned, encrypted disk that will be indistinguishable from a disk filled with random data, which could allow [[Wikipedia:Deniable encryption|deniable encryption]]. See also [[wikipedia:Disk encryption#Full disk encryption]].<br />
<br />
Note that if full-disk encryption is not required, the methods using LUKS described in the sections above are better options for both system encryption and encrypted partitions. LUKS features like key management with multiple passphrases/key-files or re-encrypting a device in-place are unavailable with ''plain'' mode.<br />
<br />
''Plain'' dm-crypt encryption can be more resilient to damage than LUKS, because it does not rely on an encryption master-key which can be a single-point of failure if damaged. However, using ''plain'' mode also requires more manual configuration of encryption options to achieve the same cryptographic strength. See also [[Disk encryption#Cryptographic metadata]]. Using ''plain'' mode could also be considered if concerned with the problems explained in [[Dm-crypt/Specialties#Discard/TRIM support for solid state drives (SSD)]].<br />
<br />
{{Tip|If headerless encryption is your goal but you are unsure about the lack of key-derivation with ''plain'' mode, then two alternatives are:<br />
* [[dm-crypt/Specialties#Encrypted system using a detached LUKS header|dm-crypt LUKS mode with a detached header]] by using the ''cryptsetup'' {{ic|--header}} option. It cannot be used with the standard ''encrypt'' hook, but the hook may be modified.<br />
* [[tcplay]] which offers headerless encryption but with the PBKDF2 function.<br />
}}<br />
<br />
The scenario uses two USB sticks:<br />
<br />
* one for the boot device, which also allows storing the options required to open/unlock the plain encrypted device in the boot loader configuration, since typing them on each boot would be error prone;<br />
* another for the encryption key file, assuming it stored as raw bits so that to the eyes of an unaware attacker who might get the usbkey the encryption key will appear as random data instead of being visible as a normal file. See also [[Wikipedia:Security through obscurity]], follow [[Dm-crypt/Device encryption#Keyfiles]] to prepare the keyfile.<br />
<br />
The disk layout is:<br />
<br />
+---------------------------+-------------------------+---------------------------+ +----------------+ +----------------+<br />
| Logical volume 1 | Logical volume 2 | Logical volume 3 | | Boot device | | Encryption key |<br />
| | | | | | | file storage |<br />
| / | [SWAP] | /home | | /boot | | (unpartitioned |<br />
| | | | | | | in example) |<br />
| /dev/mapper/store-root | /dev/mapper/store-swap | /dev/mapper/store-home | | /dev/sdY1 | | /dev/sdZ |<br />
|---------------------------+-------------------------+---------------------------| |----------------| |----------------|<br />
| disk drive /dev/sdaX encrypted using plain mode and LVM | | USB stick 1 | | USB stick 2 |<br />
+---------------------------------------------------------------------------------+ +----------------+ +----------------+<br />
<br />
{{Tip|<br />
* It is also possible to use a single usb key by copying the keyfile to the initram directly. An example keyfile {{ic|/etc/keyfile}} gets copied to the initram image by setting {{ic|1=FILES=(/etc/keyfile)}} in {{ic|/etc/mkinitcpio.conf}}. The way to instruct the {{ic|encrypt}} hook to read the keyfile in the initram image is using {{ic|rootfs:}} prefix before the filename, e.g. {{ic|cryptkey&#61;rootfs:/etc/keyfile}}.<br />
* Another option is using a passphrase with good [[Disk_encryption#Choosing_a_strong_passphrase|entropy]].<br />
}}<br />
<br />
=== Preparing the disk ===<br />
<br />
It is vital that the mapped device is filled with data. In particular this applies to the scenario usecase we apply here.<br />
<br />
See [[Dm-crypt/Drive preparation]] and [[Dm-crypt/Drive preparation#dm-crypt specific methods]]<br />
<br />
=== Preparing the non-boot partitions ===<br />
<br />
See [[Dm-crypt/Device encryption#Encryption options for plain mode]] for details.<br />
<br />
Using the device {{ic|/dev/sd''X''}}, with the twofish-xts cipher with a 512 bit key size and using a keyfile we have the following options for this scenario:<br />
<br />
{{bc|<nowiki># cryptsetup --hash=sha512 --cipher=twofish-xts-plain64 --offset=0 --key-file=</nowiki>/dev/sd''Z'' <nowiki>--key-size=512 open --type=plain /dev/sdX enc</nowiki>}}<br />
<br />
Unlike encrypting with LUKS, the above command must be executed ''in full'' whenever the mapping needs to be re-established, so it is important to remember the cipher, hash and key file details.<br />
<br />
We can now check a mapping entry has been made for {{ic|/dev/mapper/enc}}:<br />
<br />
# fdisk -l<br />
<br />
Next, we setup [[LVM]] logical volumes on the mapped device. See [[LVM#Installing Arch Linux on LVM]] for further details:<br />
<br />
# pvcreate /dev/mapper/enc<br />
# vgcreate store /dev/mapper/enc<br />
# lvcreate -L 32G store -n root<br />
# lvcreate -L 10G store -n swap<br />
# lvcreate -l 100%FREE store -n home<br />
<br />
We format and mount them and activate swap. See [[File systems#Create a file system]] for further details:<br />
<br />
# mkfs.ext4 /dev/mapper/store-root<br />
# mkfs.ext4 /dev/mapper/store-home<br />
# mount /dev/mapper/store-root /mnt<br />
# mkdir /mnt/home<br />
# mount /dev/mapper/store-home /mnt/home<br />
# mkswap /dev/mapper/store-swap<br />
# swapon /dev/mapper/store-swap<br />
<br />
=== Preparing the boot partition ===<br />
<br />
The {{ic|/boot}} partition can be installed on the standard vfat partition of a USB stick, if required. But if manual partitioning is needed, then a small 200 MiB partition is all that is required. Create the partition using a [[Partitioning#Partitioning_tools|partitioning tool]] of your choice.<br />
<br />
We choose a non-journalling file system to preserve the flash memory of the {{ic|/boot}} partition, if not already formatted as vfat:<br />
<br />
# mkfs.ext2 /dev/sd''Y''1<br />
# mkdir /mnt/boot<br />
# mount /dev/sd''Y''1 /mnt/boot<br />
<br />
=== Configuring mkinitcpio ===<br />
<br />
Add the {{ic|keyboard}}, {{ic|encrypt}} and {{ic|lvm2}} hooks to [[mkinitcpio.conf]]:<br />
<br />
{{hc|etc/mkinitcpio.conf|2=<br />
HOOKS=(... '''keyboard''' '''keymap''' block '''encrypt''' '''lvm2''' ... filesystems ...)<br />
}}<br />
<br />
See [[dm-crypt/System configuration#mkinitcpio]] for details and other hooks that you may need.<br />
<br />
=== Configuring the boot loader ===<br />
<br />
In order to boot the encrypted root partition, the following kernel parameters need to be set by the boot loader:<br />
<br />
cryptdevice=/dev/sd''X'':enc cryptkey=/dev/sd''Z'':0:512 crypto=sha512:twofish-xts-plain64:512:0:<br />
<br />
See [[Dm-crypt/System configuration#Boot loader]] for details and other parameters that you may need.<br />
<br />
{{Tip|If using GRUB, you can install it on the same USB as the {{ic|/boot}} partition with:<br />
# grub-install --recheck /dev/sd''Y''<br />
}}<br />
<br />
=== Post-installation ===<br />
<br />
You may wish to remove the USB sticks after booting. Since the {{ic|/boot}} partition is not usually needed, the {{ic|noauto}} option can be added to the relevant line in {{ic|/etc/fstab}}:<br />
<br />
{{hc|/etc/fstab|<br />
# /dev/sd''Yn''<br />
/dev/sd''Yn'' /boot ext2 '''noauto''',rw,noatime 0 2<br />
}}<br />
<br />
However, when an update to the kernel or bootloader is required, the {{ic|/boot}} partition must be present and mounted. As the entry in {{ic|fstab}} already exists, it can be mounted simply with:<br />
<br />
# mount /boot<br />
<br />
== Encrypted boot partition (GRUB) ==<br />
<br />
This setup utilizes the same partition layout and configuration for the system's root partition as the previous [[#LVM on LUKS]] section, with two distinct differences:<br />
<br />
# The setup is performed for an [[UEFI]] and/or BIOS system<br />
# A special feature of the [[GRUB]] bootloader is used to additionally encrypt the boot partition {{ic|/boot}}. See also [[GRUB#Boot partition]].<br />
<br />
The disk layout in this example is:<br />
<br />
+---------------------+---------------+----------------+------------------------+------------------------+------------------------+<br />
| BIOS boot partition | ESP partition | Boot partition | Logical volume 1 | Logical volume 2 | Logical volume 3 |<br />
| | | | | | |<br />
| | /boot/efi | /boot | /root | [SWAP] | /home |<br />
| | | | | | |<br />
| | | | /dev/mapper/store-root | /dev/mapper/store-swap | /dev/mapper/store-home |<br />
| /dev/sdaW | /dev/sdaX | /dev/sdaY +------------------------+------------------------+------------------------+<br />
| '''un'''encrypted | '''un'''encrypted | LUKS encrypted | /dev/sdaZ encrypted using LVM on LUKS |<br />
+---------------------+---------------+----------------+--------------------------------------------------------------------------+<br />
<br />
{{Tip|<br />
* All scenarios are intended as examples. It is, of course, possible to apply both of the two above distinct installation steps with the other scenarios as well. See also the variants linked in [[#LVM on LUKS]].<br />
* You can use {{ic|cryptboot}} script from {{AUR|cryptboot}} package for simplified encrypted boot management (mounting, unmounting, upgrading packages) and as a defense against [https://www.schneier.com/blog/archives/2009/10/evil_maid_attac.html Evil Maid] attacks with [[Secure Boot#Using your own keys|UEFI Secure Boot]]. For more informations and limitations see [https://github.com/xmikos/cryptboot cryptboot project] page.<br />
}}<br />
<br />
=== Preparing the disk ===<br />
<br />
Prior to creating any partitions, you should inform yourself about the importance and methods to securely erase the disk, described in [[Dm-crypt/Drive preparation]].<br />
<br />
For [[GRUB#BIOS systems|BIOS systems]] create a [[BIOS boot partition]] with size of 1 MiB for GRUB to store the second stage of BIOS bootloader. Do not mount the partition.<br />
<br />
For [[GRUB#UEFI systems|UEFI systems]] create an [[EFI System Partition]] with an appropriate size, it will later be mounted at {{ic|/boot/efi}}.<br />
<br />
Create a partition to be mounted at {{ic|/boot}} of type {{ic|8300}} with a size of 200 MiB or more.<br />
<br />
Create a partition of type {{ic|8E00}}, which will later contain the encrypted container.<br />
<br />
Create the LUKS encrypted container at the "system" partition.<br />
<br />
# cryptsetup luksFormat --type luks2 /dev/''sdaZ''<br />
<br />
For more information about the available cryptsetup options see the [[Dm-crypt/Device encryption#Encryption_options_for_LUKS_mode|LUKS encryption options]] prior to above command.<br />
<br />
Your partition layout should look similar to this:<br />
<br />
{{hc|# gdisk /dev/sda|<br />
Number Start (sector) End (sector) Size Code Name<br />
1 2048 4095 1024.0 KiB EF02 BIOS boot partition<br />
2 4096 1130495 550.0 MiB EF00 EFI System<br />
3 1130496 1540095 200.0 MiB 8300 Linux filesystem<br />
4 1540096 69205982 32.3 GiB 8E00 Linux LVM<br />
}}<br />
<br />
Open the container:<br />
<br />
# cryptsetup open /dev/''sdaZ'' lvm<br />
<br />
The decrypted container is now available at {{ic|/dev/mapper/lvm}}.<br />
<br />
=== Preparing the logical volumes ===<br />
<br />
The LVM logical volumes of this example follow the exact layout as the previous scenario. Therefore, please follow [[#Preparing the logical volumes|Preparing the logical volumes]] above or adjust as required.<br />
<br />
=== Preparing the boot partition ===<br />
<br />
{{Warning|GRUB does not support LUKS2. Do not use LUKS2 on partitions that GRUB needs to access.}}<br />
<br />
The bootloader loads the kernel, [[initramfs]], and its own configuration files from the {{ic|/boot}} directory.<br />
<br />
First, create the LUKS container where the files will be located and installed into:<br />
<br />
# cryptsetup luksFormat /dev/sda''Y''<br />
<br />
Next, open it:<br />
<br />
# cryptsetup open /dev/sda''Y'' cryptboot<br />
<br />
Create a filesystem on the partition intended for {{ic|/boot}}. Any filesystem that can be read by the bootloader is eligible:<br />
<br />
# mkfs.ext2 /dev/mapper/''cryptboot''<br />
<br />
Create the directory {{ic|/mnt/boot}}:<br />
<br />
# mkdir /mnt/boot<br />
<br />
Mount the partition to {{ic|/mnt/boot}}:<br />
<br />
# mount /dev/mapper/''cryptboot'' /mnt/boot<br />
<br />
Create a mountpoint for the [[EFI System Partition]] at {{ic|/boot/efi}} for compatibility with {{ic|grub-install}} and mount it:<br />
<br />
# mkdir /mnt/boot/efi<br />
# mount /dev/''sdaX'' /mnt/boot/efi<br />
<br />
At this point, you should have the following partitions and logical volumes inside of {{ic|/mnt}}:<br />
<br />
{{hc|$ lsblk|<br />
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT<br />
sda 8:0 0 200G 0 disk<br />
├─sda1 8:1 0 1M 0 part<br />
├─sda2 8:2 0 550M 0 part /boot/efi<br />
├─sda3 8:3 0 200M 0 part<br />
│ └─boot 254:0 0 198M 0 crypt /boot<br />
└─sda4 8:4 0 100G 0 part<br />
└─lvm 254:1 0 100G 0 crypt<br />
├─MyStorage-swapvol 254:2 0 8G 0 lvm [SWAP]<br />
├─MyStorage-rootvol 254:3 0 15G 0 lvm /<br />
└─MyStorage-homevol 254:4 0 77G 0 lvm /home<br />
}}<br />
<br />
Afterwards continue with the installation procedure up to the mkinitcpio step.<br />
<br />
=== Configuring mkinitcpio ===<br />
<br />
Add the {{ic|keyboard}}, {{ic|encrypt}} and {{ic|lvm2}} hooks to [[mkinitcpio.conf]]:<br />
<br />
{{hc|/etc/mkinitcpio.conf|2=<br />
HOOKS=(... '''keyboard''' '''keymap''' block '''encrypt''' '''lvm2''' ... filesystems ...)<br />
}}<br />
<br />
See [[dm-crypt/System configuration#mkinitcpio]] for details and other hooks that you may need.<br />
<br />
=== Configuring the boot loader ===<br />
<br />
Configure GRUB to recognize the LUKS encrypted {{ic|/boot}} partition and unlock the encrypted root partition at boot:<br />
<br />
{{hc|/etc/default/grub|2=<br />
GRUB_CMDLINE_LINUX="... cryptdevice=UUID=''<device-UUID>'':lvm ..."<br />
GRUB_ENABLE_CRYPTODISK=y<br />
}}<br />
<br />
See [[Dm-crypt/System configuration#Boot loader]] and [[GRUB#Boot partition]] for details. The {{ic|''<device-UUID>''}} refers to the UUID of {{ic|/dev/sdaZ}} (the partition which holds the lvm containing the root filesystem). See [[Persistent block device naming]].<br />
<br />
Generate GRUB's [[GRUB#Generate the main configuration file|configuration]] file:<br />
<br />
# grub-mkconfig -o /boot/grub/grub.cfg<br />
<br />
[[GRUB#Installation_2|install GRUB]] to the mounted ESP for UEFI booting:<br />
<br />
# grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=grub --recheck<br />
<br />
[[GRUB#Installation|install GRUB]] and to the disk's MBR and BIOS boot partition for BIOS booting:<br />
<br />
# grub-install --target=i386-pc --recheck /dev/sda<br />
<br />
If this finished without errors, GRUB should prompt for the passphrase to unlock the {{ic|/boot}} partition after the next reboot.<br />
<br />
=== Configuring fstab and crypttab ===<br />
<br />
This section deals with extra configuration to let the system '''mount''' the encrypted {{ic|/boot}}.<br />
<br />
While GRUB asks for a passphrase to unlock the encrypted {{ic|/boot}} after above instructions, the partition unlock is not passed on to the initramfs. Hence, {{ic|/boot}} will not be available after the system has re-/booted, because the {{ic|encrypt}} hook only unlocks the system's root.<br />
<br />
If you used the ''genfstab'' script during installation, it will have generated {{ic|/etc/fstab}} entries for the {{ic|/boot}} and {{ic|/boot/efi}} mount points already, but the system will fail to find the generated device mapper for the boot partition. To make it available, add it to [[crypttab]]. For example:<br />
<br />
{{hc|/etc/crypttab|<br />
cryptboot /dev/sdaY none luks<br />
}}<br />
<br />
will make the system ask for the passphrase again (i.e. you have to enter it twice at boot: once for GRUB and once for systemd init). To avoid the double entry for unlocking {{ic|/boot}}, follow the instructions at [[Dm-crypt/Device encryption#Keyfiles]] to:<br />
<br />
# Create a [[Dm-crypt/Device_encryption#Storing the keyfile on a filesystem|randomtext keyfile]],<br />
# Add the keyfile to the ({{ic|/dev/sdaY}}) [[Dm-crypt/Device encryption#Configuring LUKS to make use of the keyfile|boot partition's LUKS header]] and<br />
# Check the {{ic|/etc/fstab}} entry and add the {{ic|/etc/crypttab}} line to [[Dm-crypt/Device_encryption#Unlocking_a_secondary_partition_at_boot|unlock it automatically at boot]].<br />
<br />
If for some reason the keyfile fails to unlock the boot partition, systemd will fallback to ask for a passphrase to unlock and, in case that is correct, continue booting.<br />
<br />
{{Tip|Optional post-installation steps:<br />
* It may be worth considering to add the GRUB bootloader to the ignore list of {{ic|/etc/pacman.conf}} in order to take particular control of when the bootloader (which includes its own encryption modules) is updated.<br />
* If you want to encrypt the {{ic|/boot}} partition to protect against offline tampering threats, the [[Dm-crypt/Specialties#mkinitcpio-chkcryptoboot|mkinitcpio-chkcryptoboot]] hook has been contributed to help.<br />
}}<br />
<br />
== Btrfs subvolumes with swap ==<br />
<br />
The following example creates a full system encryption with LUKS using [[Btrfs]] subvolumes to [[Btrfs#Mounting_subvolumes|simulate partitions]].<br />
<br />
If using UEFI, an [[EFI System Partition]] (ESP) is required. {{ic|/boot}} itself may reside on {{ic|/}} and be encrypted; however, the ESP itself cannot be encrypted. In this example layout, the ESP is {{ic|/dev/sda''Y''}} and is mounted at {{ic|/boot/efi}}. {{ic|/boot}} itself is located on the system partition, {{ic|/dev/sda''X''}}.<br />
<br />
Since {{ic|/boot}} resides on the encrypted {{ic|/}}, [[GRUB]] must be used as the bootloader because only GRUB can load modules necessary to decrypt {{ic|/boot}} (e.g., crypto.mod, cryptodisk.mod and luks.mod) [http://www.pavelkogan.com/2014/05/23/luks-full-disk-encryption/].<br />
<br />
Additionally an optional plain-encrypted [[swap]] partition is shown.<br />
<br />
{{Warning|Do not use a [[swap file]] instead of a separate partition, because this may result in data loss. See [[Btrfs#Swap file]].}}<br />
<br />
+--------------------------+--------------------------+--------------------------+<br />
|ESP |System partition |Swap partition |<br />
|'''un'''encrypted |LUKS-encrypted |plain-encrypted |<br />
| | | |<br />
|/boot/efi |/ |[SWAP] |<br />
|/dev/sda''Y'' |/dev/sda''X'' |/dev/sda''Z'' |<br />
|--------------------------+--------------------------+--------------------------+<br />
<br />
=== Preparing the disk ===<br />
<br />
{{Note|It is not possible to use btrfs partitioning as described in [[Btrfs#Partitionless Btrfs disk]] when using LUKS. Traditional partitioning must be used, even if it is just to create one partition.}}<br />
<br />
Prior to creating any partitions, you should inform yourself about the importance and methods to securely erase the disk, described in [[Dm-crypt/Drive preparation]]. If you are using [[UEFI]] create an [[EFI System Partition]] with an appropriate size. It will later be mounted at {{ic|/boot/efi}}. If you are going to create an encrypted swap partition, create the partition for it, but do '''not''' mark it as swap, since plain ''dm-crypt'' will be used with the partition.<br />
<br />
Create the needed partitions, at least one for {{ic|/}} (e.g. {{ic|/dev/sda''X''}}). See the [[Partitioning]] article.<br />
<br />
=== Preparing the system partition ===<br />
<br />
==== Create LUKS container ====<br />
<br />
Follow [[dm-crypt/Device encryption#Encrypting devices with LUKS mode]] to setup {{ic|/dev/sda''X''}} for LUKS. See the [[Dm-crypt/Device encryption#Encryption options for LUKS mode]] before doing so for a list of encryption options.<br />
<br />
==== Unlock LUKS container ====<br />
<br />
Now follow [[Dm-crypt/Device encryption#Unlocking/Mapping LUKS partitions with the device mapper]] to unlock the LUKS container and map it.<br />
<br />
==== Format mapped device ====<br />
<br />
Proceed to format the mapped device as described in [[Btrfs#File system on a single device]], where {{ic|''/dev/partition''}} is the name of the mapped device (i.e., {{ic|cryptroot}}) and '''not''' {{ic|/dev/sda''X''}}.<br />
<br />
==== Mount mapped device ====<br />
<br />
Finally, [[mount]] the now-formatted mapped device (i.e., {{ic|/dev/mapper/cryptroot}}) to {{ic|/mnt}}.<br />
<br />
{{Tip|You may want to use the {{ic|1=compress=lzo}} mount option. See [[Btrfs#Compression]] for more information.}}<br />
<br />
=== Creating btrfs subvolumes ===<br />
<br />
==== Layout ====<br />
<br />
[[Btrfs#Subvolumes|Subvolumes]] will be used to simulate partitions, but other (nested) subvolumes will also be created. Here is a partial representation of what the following example will generate:<br />
<br />
subvolid=5 (/dev/sda''X'')<br />
|<br />
├── @ (mounted as /)<br />
| |<br />
| ├── /bin (directory)<br />
| |<br />
| ├── /home (mounted @home subvolume)<br />
| |<br />
| ├── /usr (directory)<br />
| |<br />
| ├── /.snapshots (mounted @snapshots subvolume)<br />
| |<br />
| ├── /var/cache/pacman/pkg (nested subvolume)<br />
| |<br />
| ├── ... (other directories and nested subvolumes)<br />
|<br />
├── @snapshots (mounted as /.snapshots)<br />
|<br />
├── @home (mounted as /home)<br />
|<br />
└── @... (additional subvolumes you wish to use as mount points)<br />
<br />
This section follows the [[Snapper#Suggested filesystem layout]], which is most useful when used with [[Snapper]]. You should also consult [https://btrfs.wiki.kernel.org/index.php/SysadminGuide#Layout Btrfs Wiki SysadminGuide#Layout].<br />
<br />
==== Create top-level subvolumes ====<br />
<br />
Here we are using the convention of prefixing {{ic|@}} to subvolume names that will be used as mount points, and {{ic|@}} will be the subvolume that is mounted as {{ic|/}}.<br />
<br />
Following the [[Btrfs#Creating a subvolume]] article, create subvolumes at {{ic|/mnt/@}}, {{ic|/mnt/@snapshots}}, and {{ic|/mnt/@home}}.<br />
<br />
Create any additional subvolumes you wish to use as mount points now.<br />
<br />
==== Mount top-level subvolumes ====<br />
<br />
Unmount the system partition at {{ic|/mnt}}.<br />
<br />
Now mount the newly created {{ic|@}} subvolume which will serve as {{ic|/}} to {{ic|/mnt}} using the {{ic|1=subvol=}} mount option. Assuming the mapped device is named {{ic|cryptroot}}, the command would look like:<br />
<br />
# mount -o compress=lzo,subvol=@ /dev/mapper/cryptroot /mnt<br />
<br />
See [[Btrfs#Mounting subvolumes]] for more details.<br />
<br />
Also mount the other subvolumes to their respective mount points: {{ic|@home}} to {{ic|/mnt/home}} and {{ic|@snapshots}} to {{ic|/mnt/.snapshots}}.<br />
<br />
==== Create nested subvolumes ====<br />
<br />
Create any subvolumes you do '''not''' want to have snapshots of when taking a snapshot of {{ic|/}}. For example, you probably do not want to take snapshots of {{ic|/var/cache/pacman/pkg}}. These subvolumes will be nested under the {{ic|@}} subvolume, but just as easily could have been created earlier at the same level as {{ic|@}} according to your preference.<br />
<br />
Since the {{ic|@}} subvolume is mounted at {{ic|/mnt}} you will need to [[create a subvolume]] at {{ic|/mnt/var/cache/pacman/pkg}} for this example. You may have to create any parent directories first.<br />
<br />
Other directories you may wish to do this with are {{ic|/var/abs}}, {{ic|/var/tmp}}, and {{ic|/srv}}.<br />
<br />
==== Mount ESP ====<br />
<br />
If you prepared an EFI system partition earlier, create its mount point and mount it now.<br />
<br />
{{Note|Btrfs snapshots will exclude {{ic|/boot/efi}}, since it is not a btrfs file system.}}<br />
<br />
At the [[Installation guide#Install the base packages|pacstrap]] installation step, the {{Pkg|btrfs-progs}} must be installed in addition to the base group.<br />
<br />
=== Configuring mkinitcpio ===<br />
<br />
==== Create keyfile ====<br />
<br />
In order for GRUB to open the LUKS partition without having the user enter his passphrase twice, we will use a keyfile embedded in the initramfs. Follow [[Dm-crypt/Device encryption#With a keyfile embedded in the initramfs]] making sure to add the key to {{ic|/dev/sda''X''}} at the ''luksAddKey'' step.<br />
<br />
==== Edit mkinitcpio.conf ====<br />
<br />
After creating, adding, and embedding the key as described above, add the {{ic|encrypt}} hook to [[mkinitcpio.conf]] as well as any other hooks you require. See [[Dm-crypt/System configuration#mkinitcpio]] for detailed information. Be sure to regenerate the initial ramdisk when finished.<br />
<br />
{{Tip|You may want to add {{ic|1=BINARIES=(/usr/bin/btrfs)}} to your {{ic|mkinitcpio.conf}}. See the [[Btrfs#Corruption recovery]] article.}}<br />
<br />
=== Configuring the boot loader ===<br />
<br />
Install [[GRUB]] to {{ic|/dev/sda}}. Then, edit {{ic|/etc/default/grub}} as instructed in the [[GRUB#Encryption]] article, following both the instructions for an encrypted root and boot partition. Finally, generate the GRUB configuration file.<br />
<br />
=== Configuring swap ===<br />
<br />
If you created a partition to be used for encrypted swap, now is the time to configure it. Follow the instructions at [[Dm-crypt/Swap encryption]].<br />
<br />
After completing this step, continue configuring your system as normal according to the [[Installation_guide#Reboot|installation guide]].</div>Baz