Adding new volumes to a LVM lukscrypt setup

abduct · Apprentice Joined: 19 Mar 2015 Posts: 215

So I was following this article: https://wiki.gentoo.org/wiki/Full_Disk_Encryption_From_Scratch_Simplified#Configure_fstab and I was wondering if it was possible to add another drive to the LVM which unlocks under the same passphrase.

For instance I setup my main HDD as the article has, but I have a 32gb cache drive which I want to add to the LVM. My main drive is SDA while the 32gb cache drive is SDB.

I would like to partition it so that I have 4GB on the cache drive as SWAP and then the remaining size as additional storage which will be mounted for a VM (passing the unlocked /dev/mapper/ to QEMU if possible to allow for direct read/writes without having say a cow2 file.)

I want this cache drive encrypted
I want this cache drive to be unlocked with the same passphrase as my main drive at the same time at boot.

Is this possible?

Thanks.

Hu · Moderator Joined: 06 Mar 2007 Posts: 21633

The technically correct, but practically useless answer is that yes, of course you can reuse the same passphrase on multiple drives. You just need to enter it once for each drive you want to unlock.

The practical answer is that you could do some tricks to capture the passphrase at entry and reuse it automatically, or you could avoid the whole problem by not combining the two drives in one LVM group. Nothing in your post explains why both drives need to be part of one LVM group. You could easily have a separate LUKS+LVM on each drive, with the limitation that you cannot span a logical volume across distinct LVM groups. If you don't make them part of one LVM, then you could store the unlock key for sdb in a filesystem on sda.

abduct · Apprentice Joined: 19 Mar 2015 Posts: 215

I simply didn't want to type two passphrases to unlock all my drives.

Although now that I think about it a bit more perhaps its not so bad.

How can I shrink my main volume that was created with `lvcreate -l 100%FREE -n home vg0' so that I can create a swap partition on that LVM.

Afterwards on my cache drive I will use the entire thing for an encrypted VM container that I will unlock when I want to use it.

Hu · Moderator Joined: 06 Mar 2007 Posts: 21633

Make and verify a backup of all important data in the relevant LVM group. This conversion is safe if you do it right, but can cause data loss if you do it wrong.
Use the appropriate filesystem-specific tool (such as resize2fs for extN filesystems) to shrink the filesystem on /dev/mapper/vg0-home to create an unused area at the end of that block device. Some filesystems support shrinking in-place if unmounted. If not, you may need to remake the filesystem with a smaller size, which would discard all your data as a side effect.
Unmount the filesystem (if not already unmounted).
Verify filesystem integrity using fsck. If it does not come back clean, stop and ask for help.
Use LVM commands to shrink the block device /dev/mapper/vg0-home. Now the unused space from above is in LVM free space, rather than being allocated from an LVM perspective but outside the filesystem.
Verify filesystem integrity using fsck, again. This verifies that the filesystem does not exceed the bounds of its new smaller block device. If it does exceed those bounds, the filesystem cannot be used (until the device is grown) and creating any new volumes risks data loss. If the filesystem exceeds bounds, undo the LVM resize step. If you are unsure how to do this, stop and ask for help. This is the stage at which the risk of data loss is greatest.
Create new volume(s) as appropriate.

frostschutz · Advocate Joined: 22 Feb 2005 Posts: 2977 Location: Germany

abduct · Apprentice Joined: 19 Mar 2015 Posts: 215