Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Installation with LVM/cryptsetup on multiple drives
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Installing Gentoo
View previous topic :: View next topic  
Author Message
JeverTM
n00b
n00b


Joined: 21 May 2014
Posts: 3

PostPosted: Wed May 21, 2014 4:37 pm    Post subject: Installation with LVM/cryptsetup on multiple drives Reply with quote

Hi all,

I have a special problem:
I'm running a configuration with cryptsetup and LVM on one HDD:
sda
|->sda1: boot
|->sda2: cryptsetup
--|->LVM with / and /home and swap
(quite common)

Now I want to add a HDD with encryption for files every user shares and mount it at /home/Media.
Without encryption it's easy, I make an entry in fstab.
Manually I can mount the encrypted partition:
# cryptsetup luksOpen /dev/sdc1 MEDIA
enter PW for /dev/sdc1:
# mount /dev/mapper/MEDIA /home/Media/

Is there a way to have MEDIA mounted at boot or login without
- storing the PW in a (skript) file
- spanning the LVM or crypt-partition over both HDDs, I want to be able to replace one of them easily so I need to be sure only and all files in /home/Media are stored on sdc
- and if possible: typing the PW for sda2 and sdc1 separately

I would appreciate any suggestions.
Jörg
Back to top
View user's profile Send private message
khayyam
Watchman
Watchman


Joined: 07 Jun 2012
Posts: 6228
Location: Room 101

PostPosted: Wed May 21, 2014 6:20 pm    Post subject: Re: Installation with LVM/cryptsetup on multiple drives Reply with quote

JeverTM wrote:
Is there a way to have MEDIA mounted at boot or login without
- storing the PW in a (skript) file
- spanning the LVM or crypt-partition over both HDDs, I want to be able to replace one of them easily so I need to be sure only and all files in /home/Media are stored on sdc
- and if possible: typing the PW for sda2 and sdc1 separately

Jörg ... yes, I assume that currently your encypted root is luksOpen'd via initramfs, so add the details for sdc1 to /etc/conf.d/dmcrypt and add dmcypt to the boot runlevel. You would then provide the password for sda2 from the initramfs, and then the password for sdc1 further in the boot process.

HTH & best ... khay
Back to top
View user's profile Send private message
JeverTM
n00b
n00b


Joined: 21 May 2014
Posts: 3

PostPosted: Thu May 22, 2014 7:57 pm    Post subject: Reply with quote

Thank you khayyam. That is exactly what I did but I'm not 100% satisfied.
At the end everyone has to type the PW for all partitions separately. That is not as convenient as I wish it would be.

Isn't there a way to use the same PW for all partitions and type it once; like truecrypt works for Windows with system favorites?
Since passing the parameter 'crypt_root=/dev/sda2,/dev/sdc1' to the kernel at boot does not work maybe editing the initramfs manually could? Does dracut help with a genkernel generated initramfs?
Or I have to change the source code of the package itself to understand 'crypt_root=/dev/sda2,/dev/sdc1' - but what package would I have to change?

Has anyone else thought about such a scenario? Maybe we can do something for it.
Back to top
View user's profile Send private message
khayyam
Watchman
Watchman


Joined: 07 Jun 2012
Posts: 6228
Location: Room 101

PostPosted: Thu May 22, 2014 8:37 pm    Post subject: Reply with quote

JeverTM wrote:
At the end everyone has to type the PW for all partitions separately. That is not as convenient as I wish it would be.

JeverTM ... no, just twice, once for sda2 (during initramfs stage) and once for sdc1 (during boot) ... and this is what you asked for:

JeverTM wrote:
- and if possible: typing the PW for sda2 and sdc1 separately

... but now it seems you don't want this ...

JeverTM wrote:
Isn't there a way to use the same PW for all partitions and type it once

JeverTM wrote:
Since passing the parameter 'crypt_root=/dev/sda2,/dev/sdc1' to the kernel at boot does not work maybe editing the initramfs manually could? Does dracut help with a genkernel generated initramfs?

I don't use either genkernel or dracut so I can't comment on them.

JeverTM wrote:
Or I have to change the source code of the package itself to understand 'crypt_root=/dev/sda2,/dev/sdc1' - but what package would I have to change?

I doubt this is the intended use of 'crypt_root', if its function is the same as its name then it refers to the rootfs, but again I'm not familiar with genkernel. If you want something like the above then better-initramfs supports "enc_root=/dev/sda2:/dev/sdb2:/dev/sdc2" but this will not use the same password, it calls luksOpen for each item in the variable. You could probably adapt the init within the initramfs to ask for the pass and use this as input to the luksOpen command, but you would then need to use the same passphrase for each luks volume.

HTH & best ... khay
Back to top
View user's profile Send private message
wraeth
Developer
Developer


Joined: 08 May 2007
Posts: 71
Location: Australia

PostPosted: Sat May 24, 2014 3:55 am    Post subject: Reply with quote

DMCrypt has the ability to use a keyfile for unlocking crypted containers.

You could create a random-generated keyfile and add it to a keyslot for the container and store the file somewhere secure (eg /root/keyfile). This should allow only the single password required for the root partition, and when dm-crypt loads it will use the keyfile to unlock the shared media partition transparently.

Code:
dd if=/dev/urandom of=/root/keyfile bs=1M count=4
chmod 400 /root/keyfile
cryptsetup luksAddKey /dev/sdc1 /root/keyfile

# Check the keyfile
cryptsetup -d /root/keyfile open /dev/sdc1 media


Provided that works, you would configure DMCrypt and add it to your boot or default runlevel (the file is well commented). This way, you have your media partition transparently mounted; you don't have a cleartext passphrase and the key is stored securely. This is the only method I am aware of without requiring entering the a passphrase for each device.
Back to top
View user's profile Send private message
JeverTM
n00b
n00b


Joined: 21 May 2014
Posts: 3

PostPosted: Sat May 24, 2014 7:39 pm    Post subject: Reply with quote

@wreath
This sounds like a very good idea.
I thought about a skript getting the key via secret-tool and opening/mounting the device at login. But I had problems with user rights, root doesn't get the PW and user cannot run cryptsetup.

I'll go with the keyfile for now.

Thank you folks.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Installing Gentoo All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum