[SOLVED] Trying to install Arch with full encryption

Mar · 2017-06-11 06:49:15

I've been flying all over the wiki for the past three days and I just cannot figure this out.

I'm trying to install arch in virtualbox (for practice) in efi mode using LVM on LUKS with root, home, and swap logical volumes, and an encrypted boot partition as well.

I managed to figure out how to use cryptsetup, encrypted /dev/sda1-2 with LUKS and set up the logical volumes on 2,

created a key at /crypto_keyfile.bin and added it to the encrypted lvm partition (/dev/sda2) and mkinitcpio.conf,

added the encrypt and lvm2 hooks in the (hopefully) right place (HOOKS="base udev autodetect keyboard modconf block encrypt lvm2 resume filesystems fsck") then executed "mkinitcpio -p linux",

installed grub with "grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id=grub-efi" and configured and generated the cfg with "GRUB_CMDLINE_LINUX="cryptdevice=UUID=[/dev/sda2] resume=UUID=[/dev/mapper/VG-swap]" and "GRUB_ENABLE_CRYPTODISK=y".

After rebooting all I get is virtualbox's damned EFI shell. Obviously I missed a few things somewhere.

I wanted to do this on my own, but apparently I'm just not smart enough. I would really appreciate some step by step instructions if anyone is willing.

Last edited by Mar (2017-06-11 22:37:14)

null · 2017-06-11 07:48:11

No idea where you copied those commands from, but your UUIDs are no UUIDs but block device paths and also those [] arround them seem really wrong.

https://wiki.archlinux.org/index.php/Pe … ng#by-uuid
https://wiki.archlinux.org/index.php/GRUB#Encryption

Last edited by null (2017-06-11 07:48:30)

Mar · 2017-06-11 14:09:28

I meant that as a placeholder because I don't feel like typing out UUIDs on the forum. I'll add italics to make it more obvious.

WorMzy · 2017-06-11 14:37:21

I'm trying to install arch in virtualbox (for practice) in efi mode [...] encrypted boot partition as well.

I have no knowledge of how grub2 works, but I'm pretty sure that EFI System Partitions (ESPs) cannot be encrypted. There would need to be decryption capabilities built into the UEFI implementation for that to work.

Does the grub-install command execute successfully? Does it print any warnings? Can you try the same setup with a non-encrypted ESP?

Mod note: Please remove the superfluous call for help from your topic title

https://wiki.archlinux.org/index.php/Co … ow_to_post

Mar · 2017-06-11 20:51:11

Aha! I (almost) got it.*

First of all, virtualbox needs a startup.nsh file to direct it to the .efi file to boot from: https://forums.virtualbox.org/viewtopic … 70#p289297

Then, I need to leave the ESP unencrypted and have a separate encrypted boot partition.

So my partitions look like this:

NAME * SIZE * TYPE MOUNTPOINT
sda 64G disk
|-sda1 100M part /boot/efi
|-sda2 250M part
| `-luksboot 248M crypt /boot
`-sda3 63.7G part
`-lukslvm 63.7G crypt
|-vg0-root 20G lvm /
|-vg0-swap 8.5G lvm [SWAP]
|-vg0-home 35.2G lvm /home

And my fstab looks like this:

# /dev/mapper/vg0-root
UUID={UUID} / ext4 rw,relatime,data=ordered 0 1
# /dev/mapper/vg0-home
UUID={UUID} /home ext4 rw,relatime,data=ordered 0 2
# /dev/mapper/luksboot
UUID={UUID} /boot ext2 rw,relatime,block_validity,barrier,user_xattr,acl 0 2
# /dev/sda1
UUID={UUID} /boot/efi vfat rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro 0 2
# /dev/mapper/vg0-swap
UUID={UUID} none swap defaults 0 0

Now when I start the virtual machine it reads startup.nsh, launches grubx64.efi, grub asks for passphrase for /dev/sda2, and (almost) everything boots fine from there.

*Of course then I have yet another problem.

I get put in emergency mode after boot, apparently because:

[TIME] Timed out waiting for device dev-disk-by\x2duuid-81e2ff41\x2ddefa\x2d43ff\x2da7da\x2de3610741807f.device
[DEPEND] Dependency failed for /boot
[DEPEND] Dependency failed for Local File Systems
[DEPEND] Dependency failed for /boot/efi
[DEPEND] Dependency failed for File System Check on /dev/disk/by-uuid/81e2ff41-defa-43ff-a7da-e3610741807f

That UUID belongs to /dev/mapper/luksboot.

lsblk shows /dev/sda2 is not decrypted, so no /dev/mapper/luksboot to mount on /boot. So I'm guess grub decrypted it to boot then dropped it when it was finished?

Would I have to do anything in crypttab to fix this? As I understood it I didn't think I would have to mess with crypttab unless I had external encrypted storage I wanted to mount at boot.

EDIT: Yes! Added the following line to crypttab:

luksboot UUID=81e2ff41-defa-43ff-a7da-e3610741807f /crypto_keyfile.bin

and then:

cryptsetup luksAddKey /dev/sda2 /crypto_keyfile.bin

and now it works perfectly!

Thank you for the responses. Hopefully this can help someone in the future.

Last edited by Mar (2017-06-11 22:26:23)

Arch Linux

#1 2017-06-11 06:49:15

[SOLVED] Trying to install Arch with full encryption

#2 2017-06-11 07:48:11

Re: [SOLVED] Trying to install Arch with full encryption

#3 2017-06-11 14:09:28

Re: [SOLVED] Trying to install Arch with full encryption

#4 2017-06-11 14:37:21

Re: [SOLVED] Trying to install Arch with full encryption

#5 2017-06-11 20:51:11

Re: [SOLVED] Trying to install Arch with full encryption

Board footer