Full Disk Encryption From Scratch Simplified

From Gentoo Wiki
Jump to: navigation, search

This article discusses several aspects of using Dm-crypt for full disk encryption with LVM (with some notes for SSD) for daily usage from scratch.

Most of details you can find on great article here: LUKS-LVM filesystem (Sakaki's Install Guide)

Disk preparation

In this HOWTO used GPT disk partition schema and grub boot loader. Disk schema creates with help of gparted.

Note
For more information about GPT and EFI, see handbook Disks (AMD64 Handbook)

Create partitions

Partition schema are:

--------------------------------------------------------------------------------
/dev/sdX
|--> GRUB BIOS                       2   MB       no fs       grub loader itself
|--> /boot                 boot      512 Mb       fat32       grub and kernel
|--> LUKS encrypted                  100%         encrypted   encrypted binary block 
     |-->  LVM             lvm       100%                  
           |--> /          root      25  Gb       ext4        rootfs
           |--> /var       var       40  Gb       ext4        var files
           |--> /home      home      100%         ext4        user files

Create GRUB BIOS:

root@localhost #parted -a optimal /dev/sdX

Set the default units to megabits:

(parted)unit mib

Create GPT partition table:

(parted)mklabel gpt

Create BIOS partition:

(parted)mkpart primary 1 3
(parted)name 1 grub
(parted)set 1 bios_grub on

Create boot partition. This partition will contain grub files, plain (unencrypted) kernel and kernel initrd:

(parted)mkpart primary fat32 3 515
(parted)name 2 boot
(parted)set 2 BOOT on
(parted)mkpart primary 515 -1
(parted)name 3 lvm
(parted)set 3 lvm on

Everything is done, exit from parted:

(parted)quit

Create boot filesystem

Create filesystem for /dev/sdX2, that will contain grub and kernel files. This partition are read by UEFI bios. Most of motherboards can ready only FAT32 fs:

root@localhost #mkfs.vfat -F32 /dev/sdX2

Prepare encrypted partition

In next step configure DM-CRYPT for /dev/sdX3:

Note
For Ubuntu live cd, execute this command
root@localhost #modprobe dm-crypt

Crypt LVM partition /dev/sdX3 with LUKS:

root@localhost #cryptsetup luksFormat -c aes-xts-plain64:sha256 -s 256 /dev/sdX3
Note
Type in UPPERCASE YES

Create LVM inside encrypted block

LVM creation

Open encrypted device:

root@localhost #cryptsetup luksOpen /dev/sdX3 lvm
Note
For more information about LVM see LVM.

Create lvm structure for partition mapping (/root, /var, /home):

Crypt physical volume group:

root@localhost #lvm pvcreate /dev/mapper/lvm

Create volume group vg0:

root@localhost #vgcreate vg0 /dev/mapper/lvm

Create logical volume for /root fs:

root@localhost #lvcreate -L 25G -n root vg0

Create logical volume for /var fs:

root@localhost #lvcreate -L 40G -n var vg0

Create logical volume for /home fs

root@localhost #lvcreate -l 100%FREE -n home vg0

File Systems

root@localhost #mkfs.ext4 /dev/mapper/vg0-root
root@localhost #mkfs.ext4 /dev/mapper/vg0-var
root@localhost #mkfs.ext4 /dev/mapper/vg0-home

Gentoo installation

Create mount point for permanent Gentoo:

root@localhost #mkdir /mnt/gentoo
root@localhost #mkdir /mnt/gentoo/var

Mount rootfs from encrypted LVM partition:

root@localhost #mount /dev/mapper/vg0-root /mnt/gentoo

Mount var from encrypted LVM partition:

root@localhost #mount /dev/mapper/vg0-var /mnt/gentoo/var

And cd into /mnt/gentoo:

root@localhost #cd /mnt/gentoo

rootfs install

Stage 3 install

Download stage3 to /mnt/gentoo from https://www.gentoo.org/downloads/mirrors

For example:

Unzip downloaded archive:

root@localhost:/mnt/gentoo#tar xvjpf stage3-*.tar.bz2 --xattrs --numeric-owner

Configuring compile options

Open with nano /mnt/gentoo/etc/portage/make.conf and setup required flags. See Stages (AMD64 Handbook) article.

Repos configuration

root@localhost:/mnt/gentoo#mkdir /mnt/gentoo/etc/portage/repos.conf
root@localhost:/mnt/gentoo#cp /mnt/gentoo/usr/share/portage/config/repos.conf /mnt/gentoo/etc/portage/repos.conf/gentoo.conf

Chroot prepare

Copy DNS info:

root@localhost:/mnt/gentoo#cp /etc/resolv.conf /mnt/gentoo/etc/resolv.conf

Mount all required fs into chroot:

root@localhost:/mnt/gentoo#mount -t proc /proc /mnt/gentoo/proc
root@localhost:/mnt/gentoo#mount --rbind /sys /mnt/gentoo/sys
root@localhost:/mnt/gentoo#mount --make-rslave /mnt/gentoo/sys
root@localhost:/mnt/gentoo#mount --rbind /dev /mnt/gentoo/dev
root@localhost:/mnt/gentoo#mount --make-rslave /mnt/gentoo/dev

Mount shm fs:

root@localhost:/mnt/gentoo#test -L /dev/shm && rm /dev/shm && mkdir /dev/shm
root@localhost:/mnt/gentoo#mount -t tmpfs -o nosuid,nodev,noexec shm /dev/shm
root@localhost:/mnt/gentoo#chmod 1777 /dev/shm

Enter chroot:

root@localhost:/mnt/gentoo#chroot /mnt/gentoo /bin/bash
root@localhost:/mnt/gentoo#source /etc/profile

And run: export PS1="(chroot) $PS1"

Mounting the boot partition:

(chroot) root@localhost:/#mount /dev/sda2 /boot

Install Portage files:

(chroot) root@localhost:/#emerge-webrsync

Choose and install correct profile:

(chroot) root@localhost:/#eselect profile list

Select profile:

(chroot) root@localhost:/#eselect profile set X

Setup correct timezone:

(chroot) root@localhost:/#echo Europe/Kiev > /etc/timezone
(chroot) root@localhost:/#emerge --config sys-libs/timezone-data

Configure locales:

(chroot) root@localhost:/#nano -w /etc/locale.gen
(chroot) root@localhost:/#locale-gen

Set default locale:

(chroot) root@localhost:/#eselect locale list
(chroot) root@localhost:/#eselect locale set 1

Update env:

(chroot) root@localhost:/#env-update && source /etc/profile

Run export PS1="(chroot) $PS1"

Configure fstab

For correct setup of required partition, will be used UUID technique.

Run blkid and see partition IDs:

(chroot) root@localhost:/#blkid
/dev/sdb1: UUID="4F20-B9DB" TYPE="vfat" PARTLABEL="grub" PARTUUID="70b1627b-57e7-4559-877a-355184f0ab9d"
/dev/sdb2: UUID="DB1D-89C5" TYPE="vfat" PARTLABEL="boot" PARTUUID="b2a61809-4c19-4685-8875-e7fdf645eec5"
/dev/sdb3: UUID="6a7a642a-3262-4f87-9540-bcd53969343b" TYPE="crypto_LUKS" PARTLABEL="lvm" PARTUUID="be8e6694-b39c-4d2f-9f42-7ca455fdd64f"
/dev/mapper/lvm: UUID="HL32bg-ZjrZ-RBo9-PcFM-DmaQ-QbrC-9HkNMk" TYPE="LVM2_member"
/dev/mapper/vg0-root: UUID="6bedbbd8-cea9-4734-9c49-8e985c61c120" TYPE="ext4"
/dev/mapper/vg0-var: UUID="61e4cc83-a1ee-4190-914b-4b62b49ac77f" TYPE="ext4"
/dev/mapper/vg0-home: UUID="5d6ff087-50ce-400f-91c4-e3378be23c00" TYPE="ext4" 

Edit /etc/fstab and setup correct filesystem:

(chroot) root@localhost:/#nano -w /etc/fstab
# <fs>                                          <mountpoint>    <type>          <opts>          <dump/pass>
UUID=DB1D-89C5                                  /boot           vfat            noauto,noatime  1 2
UUID=6bedbbd8-cea9-4734-9c49-8e985c61c120       /               ext4            defaults        0 1
UUID=61e4cc83-a1ee-4190-914b-4b62b49ac77f       /var            ext4            defaults        0 1
UUID=5d6ff087-50ce-400f-91c4-e3378be23c00       /home           ext4            defaults        0 1
# tmps
tmpfs                                           /tmp            tmpfs           size=4Gb        0 0
tmpfs                                           /run            tmpfs           size=100M       0 0
# shm
shm                                             /dev/shm        tmpfs           nodev,nosuid,noexec 0 0

Configuring the Linux kernel

Install kernel, genkernel and cryptsetup packages:

(chroot) root@localhost:/#emerge sys-kernel/gentoo-sources
(chroot) root@localhost:/#emerge sys-kernel/genkernel
(chroot) root@localhost:/#emerge sys-fs/cryptsetup

Build genkernel:

(chroot) root@localhost:/#genkernel --luks --lvm --no-zfs all
Note
To build only initramfs
(chroot) root@localhost:/#genkernel --luks --lvm initramfs

install GRUB2

(chroot) root@localhost:/#emerge -av grub
(chroot) root@localhost:/#vim /etc/default/grub
GRUB_CMDLINE_LINUX="dolvm crypt_root=UUID=6a7a642a-3262-4f87-9540-bcd53969343b root=/dev/mapper/vg0-root"

Mount boot:

(chroot) root@localhost:/#mount /boot

Install GRUB with EFI:

(chroot) root@localhost:/#grub-install --target=x86_64-efi --efi-directory=/boot
Note
For some old motherboards for grub run this command
(chroot) root@localhost:/#mkdir -p /boot/efi/efi/boot
(chroot) root@localhost:/#cp /boot/efi/efi/gentoo/grubx64.efi /boot/efi/efi/boot/bootx64.efi

Generate grub configuration file:

(chroot) root@localhost:/#grub-mkconfig -o /boot/grub/grub.cfg

SSD tricks

Add to /etc/default/grub trim command:

GRUB_CMDLINE_LINUX="...root_trim=yes"

edit /etc/lvm/lvm.conf LVM

 issue_discards = 1