|
|
| (44 intermediate revisions by 16 users not shown) |
| Line 1: |
Line 1: |
| − | == Encrypted LVM ==
| + | #REDIRECT [[Dm-crypt/Encrypting an entire system#LVM on LUKS]] |
| − | | |
| − | This is a new section added ~March 2013 to try and consolidate all the various info about creating an LUKS+LVM install, and also to clear up a lot of the confusion based around old and out of date wiki articles.
| |
| − | (WORK IN PROGRESS for the next few hours)
| |
| − | | |
| − | Keep in mind that this is DESTRUCTIVE and encrypting a drive will make any previous data unreadable! The following must be done on a fresh drive, or one where you don't mind losing the data (because backups!).
| |
| − | | |
| − | The following section will refer to your target hard drive as /dev/sd'''x'''. Be sure to change "sdx" to a proper target like /dev/sda. I will also assume this is a NEW Arch installation (complete with GPT and [[GRUB2]]).
| |
| − | | |
| − | I highly recommend reading through the [[LVM]] Wiki if you haven't already, and perhaps even playing inside a Virtual Machine before you start playing with your real data.
| |
| − | | |
| − | | |
| − | ===Single-Disk===
| |
| − | Encrypted LVM can be set up in 2 ways: LVM on LUKS, or LUKS on LVM. In a single-disk system, either is acceptable. However, IF YOU WISH to span your LVM across multiple drives in the future, you must use LUKS on LVM. (Explanation is below in the "Spanned" section).
| |
| − | | |
| − | | |
| − | In all cases, we must first clean the target drive and fill it with random data. This is to make our new encrypted partition blend in with the 'noise', and make it impossible to tell where the random data ends and where the LUKS container begins. The small [[frandom]] module is very quick at spitting out randomized data; much faster than /dev/urandom, which is helpful when we are dealing with 1TB+ size disks! We'll also use [[dcfldd]], a small program that works exactly like dd, but is more verbose. Both these packages are from the AUR.
| |
| − | | |
| − | # yaourt -S frandom
| |
| − | # yaourt -S dcfldd
| |
| − | You can also use /dev/urandom if you would rather not install frandom.
| |
| − | | |
| − | # dcfldd if=/dev/frandom of=/dev/sdx
| |
| − | Wait for this to finish -- it might take a while depending on how large your disk is.
| |
| − | | |
| − | | |
| − | ====LVM on LUKS====
| |
| − | | |
| − | _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
| |
| − | |Logical volume1 15GB |Logical volume2 35GB |Logical volume3 200GB |
| |
| − | |/dev/MyStorage/rootvol|/dev/MyStorage/homevol |/dev/MyStorage/mediavol |
| |
| − | |_ _ _ _ _ _ _ _ _ _ _ |_ _ _ _ _ _ _ _ _ _ _ _ _ |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ |
| |
| − | | |
| |
| − | | (LUKS Encrypted Disk /dev/sdxx) |
| |
| − | | |
| |
| − | |--------------------------------------------------------------------------------------|
| |
| − | | |
| − | In this first case a LUKS encrypted blob is created directly at the partition level, and then an LVM system is placed inside of the blob. This config hides all information about the underlying partitions -- while the LUKS container is encrypted, the disk simply looks full of random data. Only when the container is decrypted can you see that there is in fact an LVM system inside. To set up this config:
| |
| − | | |
| − | Start with partitioning your newly randomized drive:
| |
| − | # gdisk /dev/sdx
| |
| − | Make the following:
| |
| − | *sdx1 - Size 2MB, Partition Type EF02 (This is so GRUB plays nice with GPT)
| |
| − | *sdx2 - Size 200mb, Partition Type 8300 (This is your /boot partition)
| |
| − | *sdx3 - Remaining space, Partition Type 8E00 (LVM)
| |
| − | | |
| − | Create the LUKS encrypted container (sdx3. We don't encrypt /boot or the BIOS partition)
| |
| − | # cryptsetup luksFormat /dev/sdx3
| |
| − | NOTE: cryptsetup has a TON of options (which you can find in its man page). The defaults now are quite secure (aes-xts-plain64 with 256bit key), but you may change whatever settings you like here. Enter your password twice.
| |
| − | | |
| − | # cryptsetup luksOpen /dev/sdx3 lvm
| |
| − | Now we open our container. Your decrypted disk is now available at /dev/mapper/lvm
| |
| − | | |
| − | | |
| − | From here, create your LVM system....
| |
| − | # pvcreate /dev/mapper/lvm
| |
| − | # vgcreate MyStorage /dev/mapper/lvm
| |
| − | # lvcreate -L 15G MyStorage -n rootvol
| |
| − | # lvcreate -L 35G MyStorage -n homevol
| |
| − | # lvcreate -L 200G MyStorage -n mediavol
| |
| − | | |
| − | # mkfs.ext4 /dev/mapper/MyStorage-rootvol
| |
| − | # mkfs.ext4 /dev/mapper/MyStorage-homevvol
| |
| − | # mkfs.ext4 /dev/mapper/MyStorage-mediavol
| |
| − | | |
| − | | |
| − | .....And then mount the proper folders to their locations.
| |
| − | IE:
| |
| − | | |
| − | # mount /dev/MyStorage/rootvol /mnt
| |
| − | # mount /dev/MyStorage/homevol /mnt/home
| |
| − | etc.
| |
| − | Now continue through the Arch setup. (Pacstrap, arch-chroot /mnt, and so on. This HOWTO will assume you're also installing grub-bios to GPT as per the install guide.)
| |
| − | | |
| − | | |
| − | IT IS '''CRITICAL''', before exiting the install, that you modify GRUB2 and initcpio so that it will unlock your LUKS container on boot!
| |
| − | | |
| − | | |
| − | Edit '''/etc/mkinitcpio.conf''', and change HOOKS=" " to include (order is important here):
| |
| − | # ....... keymap encrypt lvm2 filesystems..."
| |
| − | | |
| − | | |
| − | Next, edit '''/etc/default/grub''' and change the following line to say:
| |
| − | # GRUB_CMDLINE_LINUX="cryptdevice=/dev/sdx3:MyStorage"
| |
| − |
| |
| − | Rebuild:
| |
| − | # mkinitcpio -p linux
| |
| − | # grub-mkconfig -o /boot/grub/grub.conf
| |
| − | | |
| − | Done! Exit the chroot, unmount all your partitions and reboot. After GRUB2 loads, you will be prompted to enter your volume password -- do so and Arch will continue to boot.
| |
| − | | |
| − | | |
| − | ====LUKS on LVM====
| |
| − | _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
| |
| − | |Encrypted Volume1 |Encrypted volume2 |Encrypted volume3 200GB |
| |
| − | |/dev/MyStorage/rootvol|/dev/MyStorage/homevol |/dev/MyStorage/mediavol |
| |
| − | |_ _ _ _ _ _ _ _ _ _ _ |_ _ _ _ _ _ _ _ _ _ _ _ _ |_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ |
| |
| − | | |
| − | This is the opposite of above: your disk is partitioned openly, and each LVM section is visible. However, the contents of the LVMs are safely encrypted until unlocked. THIS IS THE REQUIRED CONFIGURATION IF YOU WISH TO ADD/SPAN MORE PHYSICAL DRIVES IN THE FUTURE.
| |
| − | | |
| − | Start with partitioning your newly randomized drive:
| |
| − | # gdisk /dev/sdx
| |
| − | Make the following:
| |
| − | *sdx1 - Size 2MB, Partition Type EF02 (This is so GRUB plays nice with GPT)
| |
| − | *sdx2 - Size 200mb, Partition Type 8300 (This is your /boot partition)
| |
| − | *sdx3 - Remaining space, Partition Type 8E00 (LVM)
| |
| − | | |
| − | Create your LVM partition from sdx3:
| |
| − | # pvcreate /dev/sdx3
| |
| − | # vgcreate MyStorage /dev/sdx3
| |
| − | # lvcreate -L 15G MyStorage -n rootvol
| |
| − | # lvcreate -L 35G MyStorage -n homevol
| |
| − | # lvcreate -L 200G MyStorage -n mediavol
| |
| − | | |
| − | Now, encrypt each LVM partition seperately:
| |
| − | # cryptsetup luksFormat /dev/MyStorage/rootvol
| |
| − | # cryptsetup luksFormat /dev/MyStorage/homevol
| |
| − | # cryptsetup luksFormat /dev/MyStorage/mediavol
| |
| − | Again -- as above, cryptsetup has many options, and you can use whichever cipher or keysize you like, or simply accept the defaults.
| |
| − | | |
| − | | |
| − | Unlock each LUKS container:
| |
| − | # cryptsetup luksOpen /dev/MyStorage/rootvol root
| |
| − | # cryptsetup luksOpen /dev/MyStorage/homevol home
| |
| − | # cryptsetup luksOpen /dev/MyStorage/mediavol media
| |
| − | | |
| − | | |
| − | And format as ext4 for all partitions including boot: (Note this is how you access your LVM partitions now, via /dev/<volumegroup>/<mount point> )
| |
| − | # mkfs.ext4 /dev/MyStorage/root
| |
| − | # mkfs.ext4 /dev/MyStorage/home
| |
| − | # mkfs.ext4 /dev/MyStorage/media
| |
| − | # mkfs.ext4 /dev/sdx2
| |
| − | | |
| − | | |
| − | Now continue through the Arch setup. (Pacstrap, arch-chroot /mnt, and so on. This HOWTO will assume you're also installing grub-bios to GPT as per the install guide.)
| |
| − | Be precise with the following edits!
| |
| − | IT IS '''CRITICAL''', before exiting the install, that you modify GRUB2 and initcpio so that it will unlock your LUKS container on boot!
| |
| − | | |
| − | | |
| − | Edit '''/etc/mkinitcpio.conf''', and change HOOKS=" " to include (order is important here):
| |
| − | # ....... keymap lvm2 encrypt filesystems..."
| |
| − | | |
| − | | |
| − | Next, edit '''/etc/default/grub''' and change the following line to say:
| |
| − | # GRUB_CMDLINE_LINUX="cryptdevice=/dev/mapper/MyStorage-rootvol:root root=/dev/mapper/root ro"
| |
| − |
| |
| − | Rebuild:
| |
| − | # mkinitcpio -p linux
| |
| − | # grub-mkconfig -o /boot/grub/grub.conf
| |
| − | | |
| − | | |
| − | '''A note about LUKS encryption keys:''' below we will be editing /etc/crypttab. This is necessary to unlock each non-root LUKS container (like /home, /media, etc) -- these logical volumes are just as important as /root, and if they are not visible the entire system will fail to boot! LVM must have '''all''' volumes present and accounted for.
| |
| − | Now, in order to avoid typing in multiple passwords (1 per container) every boot, we may generate some strong encryption keys and save them in /etc.
| |
| − | These keys are perfectly safe: they are being saved inside the root LVM container, which must be unlocked by you at boot with a password. As well, having different passwords for each disk makes breaking the encryption even more difficult -- even if one password is compromised, the LVM WILL NOT activate without the other partitions.
| |
| − | | |
| − | | |
| − | # dd if=/dev/frandom of=/etc/home.key bs=512 count=4
| |
| − | # dd if=/dev/frandom of=/etc/media.key bs=512 count=4
| |
| − | | |
| − | | |
| − | Finally, we must add the non-root LVMs to '''/etc/crypttab'''
| |
| − | # home /dev/mapper/MyStorage-homevol /etc/home.key
| |
| − | # media /dev/mapper/MyStorage-mediavol /etc/media.key
| |
| − | '''IF YOU DO NOT WANT TO USE KEYS HERE''', simply delete the columns above containing "/etc/<keyname>" and you will be asked for each unlock password on boot.
| |
| − | | |
| − | | |
| − | | |
| − | Now exit the chroot, unmount all your partitions and reboot. After GRUB2 loads, you will be prompted to enter your volume password -- do so and Arch will continue to boot.
| |
| − | | |
| − | ===Spanned/Multiple Disks===
| |