sicherheitsschwankung.de - some things I do for free

The 22C3 in Berlin is coming up and after helping a friend convert his notebook to dm-crypt/lvm, i'm ready to try it myself :) It was not quite straightforward, so i'll describe the necessary steps here.

When i'm done, i'll have two physical partitions (hda1 and hda2). hda1 is /boot and must be unencrypted because it contains the kernel and initrd. hda2 is an encrypted LVM physical volume which contains / and all other volumes.

Before we begin some packages need to be installed: yaird (to build the initrd) cryptsetup-luks (supports a partition header which containes the encrypted key) lvm2 (to manage volumes) yaird and lvm2 are in debian and cryptsetup-luks is avaible from http://luks.endorphin.org/ (a debian repository is at http://einsteinmg.dyndns.org/debian/).

We also need a kernel compiled with aes, dm-crypt and lvm.

This will initialize and open hda2 as pvcrypt

# cryptsetup luksFormat /dev/hda2
WARNING!
========
This will overwrite data on /dev/hda2 irrevocably.

Are you sure? (Type uppercase yes): YES
Enter LUKS passphrase:
# cryptsetup luksOpen /dev/hda2 pvcrypt
Enter LUKS passphrase: 
key slot 0 unlocked.

Now the usual lvm setup:

# pvcreate /dev/mapper/pvcrypt
  Physical volume "/dev/mapper/pvcrypt" successfully created
# vgcreate vgcrypt /dev/mapper/pvcrypt
  Volume group "vgcrypt" successfully created
# lvcreate -n lvroot -L 8G vgcrypt             
  Logical volume "lvroot" created
# lvcreate -n lvswap -L 1G vgcrypt
  Logical volume "lvswap" created
# lvcreate -n lvhome -L 10G vgcrypt
  Logical volume "lvhome" created

If this does not work, you may have an older version of lvm which does not allow mapped devices as pvs per default. You need to change this in /etc/lvm/lvm.conf.

Now we create the filesystems and mount them:

# mkfs.reiserfs /dev/hda1
# mkfs.reiserfs /dev/mapper/vgcrypt-lvroot
# mkfs.reiserfs /dev/mapper/vgcrypt-lvhome
# mkswap /dev/mapper/vgcrypt-lvswap
# mkdir /mnt/target
# mount /dev/mapper/vgcrypt-lvroot /mnt/target
# mkdir /mnt/target/boot
# mount /dev/hda1 /mnt/target/boot
# mkdir /mnt/target/home
# mount /dev/mapper/vgcrypt-lvhome /mnt/target/home

To copy my data to the new filesystems i use rsync -avx. -x tells rsync to copy only one filesystem, so if you have more than one you need to call rsync for each. If you have everything on one filesystem which is mounted at /mnt/source, you can use:

# rsync -avx /mnt/source/ /mnt/target/

UDev uses a tmpfs mounted at /dev, so you may need to copy /dev/.static/dev by hand.

Now you need to make sure /mnt/target/sys and /mnt/target/proc exist. Before we can chroot to the new system we need to bind sys and proc:

# mount --bind /sys /mnt/target/sys
# mount --bind /proc /mnt/target/proc

Now we can enter the new system with chroot /mnt/target. The only thing left now is making the system bootable. I use grub because it allows me to change almost everthing at runtime. Grub needs to load the kernels from /dev/hda1 (which grub calls (hd0,0)).

# grub-install /dev/hda1

You may also need to run update-grub and check /boot/grub/menu.list for incorrect paths.

Yaird needs a /etc/crypttab like this to find the encrypted volumes:

#    
cryptpv         /dev/hda4

Update your /etc/fstab to match the new layout.

Now we can build an initrd with yaird:

# yaird -o /boot/initrd-2.6.12.3

The current yaird has a problem with the new names for the AES kernel option. If you have AES compiled into the kernel, it will not look for the correct option. In /usr/lib/yaird/perl/KConfig.pm replace CONFIG_CRYPTO_AES with CONFIG_CRYPTO_AES_586 (or whatever else you have in your kernel config). If you did not use a initrd before run update-grub again.

Now reboot your system and it should ask you for the password you entered while creating the encrypted volume. Don't forget to wipe your old data after verifying everything is correct.</http://einsteinmg.dyndns.org/debian/></http://luks.endorphin.org/>