[Support] System Encryption DM-Crypt with LUKS

Mr.Pink · n00b Joined: 02 Mar 2004 Posts: 2

Hi all,

sorry swit for interrupting you and posting a new question without yours being answered...

I read the HOWTO and the posts in here and now I'd like to try to setup an encrypted system. The problem thereby is that I'd like to use LVM to create individual resizable partitions for not only root but also /home, /usr etc.
Am I right when I say that in this case it would be necessary to encrypt the whole harddisc at once using /dev/hda for instance and then setting up the LVM partitions to use with LVM or will I have to encrypt every LVM partition itself with a different key/passphrase?
Or is it even impossible to use LVM and encryption at the same time?

Regards
Mr.Pink

unixtroll · n00b Joined: 19 Aug 2003 Posts: 41

alecpap · n00b Joined: 12 Oct 2005 Posts: 11

I don't mean to beat a dead horse, but I'm also getting the failed to setup dm-crypt mapping error message. I have all of the kernel additions compiled into the kernel, as well as all of the crypto options, as in the howto. Here are some exerpts form my config file:

rr · n00b Joined: 22 Feb 2005 Posts: 35

Great article on file encryption. I'm trying to set it up now, but have run into a problem. You say to download the
precompiled cryptsetup-luks binary from http://luks.endorphin.org/dm-crypt, but you don't say how. My Gentoo 2005.1 install does not have FTP or Lynx. How do you download?

rr · n00b Joined: 22 Feb 2005 Posts: 35

Answered my own question. It's called links2.

rainbow flag · n00b Joined: 03 Jul 2005 Posts: 33

alecpap · n00b Joined: 12 Oct 2005 Posts: 11

rainbow flag-
thanks for your reply. I did solve it, I think. I was using the 2.6.13 kernel, and when I tried it with 2.6.12, it worked perfectly! Maybe I changed something else that I didn't know about, but, it works now.

Now I have another question, though. I'd like to be able to use a key on a usb stick to decrypt it (actually, I'd like to encrypt the key on the usb stick, decrypt that, and then use that key to decrypt the hdd). So, I put

rainbow flag · n00b Joined: 03 Jul 2005 Posts: 33

hi again.

i'm just not sure if my proposals are very useful (as you can see, i'm a newbie like you)

but maybe, the device node /dev/uba5 does not exist and you have to create it (by something like "mknod /dev/uba5 b <major> <minor>") ...

alecpap · n00b Joined: 12 Oct 2005 Posts: 11

rainbow flag-
Thanks for the help! That sure did the trick, I can't believe I forgot that part - I was going crazy! Everything is working very smoothly now, thanks again!

I just had to make the nod /dev/uba and /dev/uba5

And thanks for the great How-To Reikinio!

jester42 · n00b Joined: 10 Dec 2005 Posts: 1

I just read the Wiki and used some information from there to encrypt a single hdd... Around X-Mas I will try the whole encryption of my system, impressions will follow.

I have got one question right now: is the skull-ascii-art shown in the article available for download somewhere? i quite like it

Well... more in two weeks then.
jester

Armageddon · n00b Joined: 29 Dec 2004 Posts: 39

hello,

first of all thank you for this really great howto

i installed a encryptet system and all works fine.

The only thing not working correctly is the Encypting swap at boot.

It needs more then 15 mins to make the swap is that normal?

GenKreton · Posted: Sun Jan 29, 2006 5:50 am Post subject:

daff · Posted: Thu Feb 02, 2006 7:44 pm Post subject:

Could it be that there are no CONFIG_BLK_DEV_DM or CONFIG_DM_CRYPT options in gentoo-sources-2.6.15-r1? I can't seem to find them.

EDIT: Feeling stupid right now. These options are available only if you enable Multiple devices driver support (RAID and LVM) under Device Drivers.
_________________
Instead of asking why a piece of software is using 1970s technology,
start asking why software is ignoring 30 years of accumulated wisdom.

fuzebest · n00b Joined: 19 Jan 2006 Posts: 5

Sorry, for little offtopic.
Are there any guide how to create encrypted CD/DVD images using LUKS?

thank you!
sorry again

b0rsten · n00b Joined: 08 Mar 2006 Posts: 1

i've tried this howto, but after reboot i get this error:

mephist0 · Posted: Tue Mar 14, 2006 6:46 pm Post subject:

Very good HOWTO ! :wink:

works perfectly !

Thanks very much !

Is it possible to install windows xp afterwards ? is it safe ?

I mean, I dont want to loose my data

EDIT : As I installed Gentoo I left 50GB free space for windows for gaming ... someone got a tip ?

Thanks

_________________
There is only one God, and his name is Death. And there is only one thing we say to Death: 'Not today!'

Photography portfolio

mephist0 · Posted: Fri Mar 17, 2006 7:14 am Post subject:

*push*
_________________
There is only one God, and his name is Death. And there is only one thing we say to Death: 'Not today!'

Photography portfolio

GenKreton · Posted: Tue Mar 21, 2006 1:30 am Post subject:

mephist0 · Posted: Tue Mar 21, 2006 10:47 pm Post subject:

GenKreton · Posted: Thu Mar 23, 2006 4:54 am Post subject:

anuron · n00b Joined: 01 Feb 2005 Posts: 4

nice work.

just for the record and for people expieriencing the same problem as I. sys-fs/cryptsetup-luks-1.0.1-r1 is somehow broken (see https://bugs.gentoo.org/show_bug.cgi?id=128925) and produces regardless of what you try the error "invalid argument".

anuron

Reikinio · Posted: Thu May 11, 2006 8:39 pm Post subject:

Hello,
I forgot about this thread, I am sorry :oops:

The email notifications for this thread stopped, I didn't knew that you had to be logged in for the email notification system log that you have followed the link sent by email, it won't happen again.

Anyway, I have rewrited the guide, many things have been added, I spent a _lot_ of time on it so you better like it.

ChangeLog:
* Added initramfs support, initrd is gone.
* Using BusyBox for the initramfs image.
* Added a bash script to handle initramfs images.
* Added steps for booting from an USB-stick.
* Added steps for gpg protected keys(randomly generated).
* Removed all the childish comments and excessive smileys that made the guide look it was written by a five year old kid.
* Guide wikified(using wiki code, should look better now)
* And more...

What do you guys think of the new guide ?

Bye.

Reikinio · Posted: Thu May 11, 2006 8:51 pm Post subject:

I am looking for people interested in helping to mantain and improve the guide, also there is another guide on gentoo-wiki which has the same goal of this guide, so I proposed merging the two guides into one.
This is the other guide: http://gentoo-wiki.com/SECURITY_Encrypting_Root_Filesystem_with_DM-Crypt_with_LUKS

What do you think?

Reikinio · Posted: Thu May 11, 2006 9:03 pm Post subject:

andersenep · Posted: Mon May 15, 2006 4:34 am Post subject: having problems with initramfs

Hi, I've been trying to get this working all day with no luck. I've stuck to the howto as closely as possible and I think my main problem is with initramfs. I'm using gentoo-sources-2.6.16-r7 and for starters there is no default initramfs_date.cpio.gz in /usr/src/linux/usr. I've tried adding the gzip'd cpio I created following the howto (in /output) and touching it but when I build the kernel it is overwritten. I gunzip'd the cpio to / and set CONFIG_INITRAMFS_SOURCE="/initramfs_data.cpio" and rebuilt and this generates what seems to be the right image in /usr/src/linux/usr (zcat initramfs_date.cpio.gz | cpio -t spits out the files/dirs in my testimage dir) but I still can seem to get a working kernel. It will boot and go through everything until it tries to init (I forget the actual error) and then the kernel panics and I have to reboot.
I'm not sure if I have something wrong in my kernel config or in the init script in my initramfs_data.cpio.gz. I set set the line: