Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Encrypted install
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
Fulgurance
Guru
Guru


Joined: 15 Feb 2017
Posts: 473

PostPosted: Fri Jul 20, 2018 4:03 pm    Post subject: Encrypted install Reply with quote

Hello, i have question. I would like to test to encrypte gentoo installation, but i have questions. How is it possible to encrypte my all system with just one Password ? (I have 2 internal disks, hdd and ssd, and i need efi partition and tmpfs partitions) and how i configure GRUB ?
Back to top
View user's profile Send private message
khayyam
Watchman
Watchman


Joined: 07 Jun 2012
Posts: 6229
Location: Room 101

PostPosted: Fri Jul 20, 2018 6:11 pm    Post subject: Re: Encrypted install Reply with quote

Fulgurance wrote:
Hello, i have question. I would like to test to encrypte gentoo installation, but i have questions. How is it possible to encrypte my all system with just one Password ? (I have 2 internal disks, hdd and ssd, and i need efi partition and tmpfs partitions) and how i configure GRUB ?

Fulgurance ... the ESP (EFI System Partition) can't be encrypted, and so you could use this to host your kernel and initramfs (required for encrypted root). As for two disks one password, the first disk is unlocked with the passphrase, and the second is unlocked with a key read from the first disk (at the initramfs stage). This requires you modify your initframfs to do this ...

best ... khay
Back to top
View user's profile Send private message
Fulgurance
Guru
Guru


Joined: 15 Feb 2017
Posts: 473

PostPosted: Fri Jul 20, 2018 7:05 pm    Post subject: Reply with quote

For the second disk with read key, have you got example please ?
Back to top
View user's profile Send private message
khayyam
Watchman
Watchman


Joined: 07 Jun 2012
Posts: 6229
Location: Room 101

PostPosted: Fri Jul 20, 2018 8:10 pm    Post subject: Reply with quote

Fulgurance wrote:
For the second disk with read key, have you got example please ?

Fulgurance ... I don't, no, but it would simply be a case of having the 'init' within the initramfs call cryptsetup with the path to the key once the first disk is unlocked. I'm sure there are examples of this on the forum ... at least I seem to remember threads with this as the subject.

best ... khay
Back to top
View user's profile Send private message
johngalt
Apprentice
Apprentice


Joined: 09 Sep 2004
Posts: 257
Location: 3rd Rock

PostPosted: Fri Jul 20, 2018 9:38 pm    Post subject: Reply with quote

Sakaki's EFI install makes use of an external key (with a fallback) that would be very similar to this, right?
_________________
desultory wrote:
If you want to retain credibility as a functional adult; when you are told that you are acting boorishly, the correct response is to consider that possibility and act accordingly to correct that behavior.


Amen.
Back to top
View user's profile Send private message
khayyam
Watchman
Watchman


Joined: 07 Jun 2012
Posts: 6229
Location: Room 101

PostPosted: Fri Jul 20, 2018 10:59 pm    Post subject: Reply with quote

johngalt wrote:
Sakaki's EFI install makes use of an external key (with a fallback) that would be very similar to this, right?

johngalt ... without looking I couldn't say, but the the use of a keyfile is staightforward, all you need do is modify the 'init' within whatever initramfs you use so that 'cryptsetup luksOpen' is run ... or, alternately, have it unlocked as part of /etc/init.d/dmcrypt (see: /etc/conf.d/dmcrypt).

HTH & best ... khay
Back to top
View user's profile Send private message
Fulgurance
Guru
Guru


Joined: 15 Feb 2017
Posts: 473

PostPosted: Sun Jul 22, 2018 8:31 pm    Post subject: Reply with quote

I have problème, i have finish to make all encrypted luks partition, and i have installed gentoo base, but when i launch grub-install command, GRUB fail and ask me group home and root dont exist. Its strange because i dont use LVM.

For information, i have 3 partitions, efi partitions, home mapper and root mapper
Back to top
View user's profile Send private message
Elleni
l33t
l33t


Joined: 23 May 2006
Posts: 616

PostPosted: Sun Jul 22, 2018 9:01 pm    Post subject: Reply with quote

Maybe this can help you. It helped me setting up encrypted system.

http://blog.guya.de/linux-gentoo-encrypted-boot-partition/
Back to top
View user's profile Send private message
ayeyes
Tux's lil' helper
Tux's lil' helper


Joined: 03 Dec 2017
Posts: 104

PostPosted: Mon Jul 23, 2018 12:55 am    Post subject: Reply with quote

Bliss-Initramfs makes doing an encrypted with boot install easy. Look at his guide for encrypted ZFS on how to add a keyfile. Dunno if it works for an EFI install though.
Back to top
View user's profile Send private message
Fulgurance
Guru
Guru


Joined: 15 Feb 2017
Posts: 473

PostPosted: Mon Jul 23, 2018 11:09 am    Post subject: Reply with quote

I haven't solved my problem, look this log of grub:

Code:
grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=Zohran
Installation pour la plate-forme x86_64-efi.
File descriptor 3 (/dev/nvme0n1p1) leaked on vgs invocation. Parent PID 21250: grub-install
  WARNING: Failed to connect to lvmetad. Falling back to device scanning.
  Volume group "root" not found
  Cannot process volume group root
File descriptor 3 (/dev/nvme0n1p1) leaked on vgs invocation. Parent PID 21250: grub-install
  WARNING: Failed to connect to lvmetad. Falling back to device scanning.
  Volume group "root" not found
  Cannot process volume group root
grub-install��: erreur��: disque ����lvm/root���� non disponible.


Grub search lvm volume but i don't use LVM ... why ???
Back to top
View user's profile Send private message
khayyam
Watchman
Watchman


Joined: 07 Jun 2012
Posts: 6229
Location: Room 101

PostPosted: Mon Jul 23, 2018 12:30 pm    Post subject: Reply with quote

Fulgurance wrote:
Grub search lvm volume but i don't use LVM ... why ???

Fulgurance ... I'm not a grub user, but perhaps you have the 'device-mapper' useflag set:

Code:
% equery -NC uses =sys-boot/grub-2.02-r1 | grep lvm2
 - - device-mapper   : Enable support for device-mapper from sys-fs/lvm2

It seems that sys-fs/lvm2 is a dependency regardless:

Code:
% equery -NC depgraph =sys-boot/grub-2.02-r1 | grep lvm2
   `--  sys-fs/lvm2-2.02.103  (>=sys-fs/lvm2-2.02.45) x86

best ... khay
Back to top
View user's profile Send private message
Fulgurance
Guru
Guru


Joined: 15 Feb 2017
Posts: 473

PostPosted: Mon Jul 23, 2018 1:01 pm    Post subject: Reply with quote

Thanks for your help. But no, sorry, this use flag isn’t enabled :cry:
Back to top
View user's profile Send private message
khayyam
Watchman
Watchman


Joined: 07 Jun 2012
Posts: 6229
Location: Room 101

PostPosted: Mon Jul 23, 2018 3:37 pm    Post subject: Reply with quote

Fulgurance wrote:
Thanks for your help. But no, sorry, this use flag isn’t enabled :cry:

Fulgurance ... it wouldn't matter, because as I showed sys-fs/lvm2 is a hard dependency ... so you get it whether you're using lvm or not.

Again, I'm not a grub user, and looking at the grub-install manpage, and the gentoo wiki, I don't see what you might be doing wrong, or an obvious solution.

Can you post the output of 'lsblk -o +fstype,label'

best ... khay
Back to top
View user's profile Send private message
Fulgurance
Guru
Guru


Joined: 15 Feb 2017
Posts: 473

PostPosted: Mon Jul 23, 2018 4:04 pm    Post subject: Reply with quote

I have emerged GRUB with this use flag, and its good, GRUB make boot entry !

But now, when i boot, i enter partition password, when i start linux on GRUB startscreen, i have kernel panic...
I thing i forget configure something...
Back to top
View user's profile Send private message
khayyam
Watchman
Watchman


Joined: 07 Jun 2012
Posts: 6229
Location: Room 101

PostPosted: Mon Jul 23, 2018 6:44 pm    Post subject: Reply with quote

Fulgurance wrote:
But now, when i boot, i enter partition password, when i start linux on GRUB startscreen, i have kernel panic...

Fulgurance ... again, I have no experience with grub2, but that seems like the wrong order: boot => grub2 => kernel/initramfs => cryptsetup luksOpen => password => init.

best ... khay
Back to top
View user's profile Send private message
abduct
Apprentice
Apprentice


Joined: 19 Mar 2015
Posts: 203

PostPosted: Mon Jul 23, 2018 9:59 pm    Post subject: Reply with quote

I suggest starting over and following https://wiki.gentoo.org/wiki/Full_Disk_Encryption_From_Scratch_Simplified

It sounds like you have made some bad assumptions which is hampering your install. A FDE setup is not this complicated.

I also suggest increasing the partition sizes of /, 25GB is kind of small.

I also suggest using:

Code:
Cipher name:      aes
Cipher mode:      xts-plain64
Hash spec:        sha512
Back to top
View user's profile Send private message
Fulgurance
Guru
Guru


Joined: 15 Feb 2017
Posts: 473

PostPosted: Tue Jul 24, 2018 10:42 am    Post subject: Reply with quote

khayyam wrote:
Fulgurance ... again, I have no experience with grub2, but that seems like the wrong order: boot => grub2 => kernel/initramfs => cryptsetup luksOpen => password => init.

best ... khay


Sorry, but enter password before grub is mandatory. Impossible to change that... i think i have problem with my configuration, but where ? I don't understand ...

abduct wrote:
I suggest starting over and following https://wiki.gentoo.org/wiki/Full_Disk_Encryption_From_Scratch_Simplified

It sounds like you have made some bad assumptions which is hampering your install. A FDE setup is not this complicated.

I also suggest increasing the partition sizes of /, 25GB is kind of small.


I use your recommended crypt settings, and my root partition have 125Go xD

Would you like i post my configurations files ?
Back to top
View user's profile Send private message
khayyam
Watchman
Watchman


Joined: 07 Jun 2012
Posts: 6229
Location: Room 101

PostPosted: Tue Jul 24, 2018 1:46 pm    Post subject: Reply with quote

khayyam wrote:
[...] again, I have no experience with grub2, but that seems like the wrong order: boot => grub2 => kernel/initramfs => cryptsetup luksOpen => password => init.

Fulgurance wrote:
Sorry, but enter password before grub is mandatory. Impossible to change that... i think i have problem with my configuration, but where ? I don't understand ...

Fulgurance ... huh? So you're expecting grub to luksOpen the encypted root?

best ... khay
Back to top
View user's profile Send private message
Fulgurance
Guru
Guru


Joined: 15 Feb 2017
Posts: 473

PostPosted: Tue Jul 24, 2018 2:33 pm    Post subject: Reply with quote

Its good thanks ! I have just Forget to build initrams with luks support
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum