[LUKS over LVM] or [LVM over LUKS]?

[x220tux]

Scenario:

I have two free partitions say sda2 and sda5 between which there are other NTFS partitions in use wiht important data.

Goal:

Combine these two partitioins together like a single partition;

Install Gentoo on this new combined single partition;

Gentoo system is encrypted.

My current idea:

First, cryptsetup (LUKS) to encrypt sda2 and sda5 with different keyfile;

Then create a single volume group (VG) on top those two paritions;

After that, create LVM partitions like root, swap and home;

Problem:

I cannot generate a correct genkernel initramfs to decrypt those two partitions at boot.

Ask for help:

Should I first create volume group; then cryptsetup with LUKS?

Or any ideas how to orgranize the two partitions to install fully encrypt Gentoo

[frostschutz]

Personally, I'm using LVM on LUKS. That is because I wish to be able to use 'lvcreate' and have the new LV automatically encrypted because the entire disk already is encrypted.

Basically I'm using full disk encryption with a flexible LVM on top so I don't have to worry that there may be unencrypted parts anywhere.

With LUKS on top of LVM, you have to remember to create a new LUKS container for each LV you create, and you have to find a way to open all of them when you need them. Of course it also gives you the choice of leaving some LV unencrypted.

In the end there is no solution better than the other, it all depends on taste and how you like to set things up.

Although from your description I would suggest you merge those two free partitions into one instead in order to achieve a less complicated setup. If you want some suggestions in that direction you should show us your current partition table (using `parted /dev/disk unit s print free` or similar).

[x220tux]

[x220tux]