LVM on LUKS on LVM

davermont · 2014-09-15 01:56:21

Does anyone know if, on a system with LVM on LUKS on LVM, a logical volume created inside a LUKS container can be added to the same volume group that the LUKS container is in? Even if this is possible, is it this just a bad idea from a security perspective? Should the outer LVM and inner LVM each have their own physical devices, volume groups, and logical volumes?

bstaletic · 2014-09-15 09:30:59

LVM needs designated virtual groups upon designated physical volumes. A physical volume can not belog to more than one virtual group at the same time. That said I can not see why can't you use LUKS device as a new physical volumeand use only that physical volume for virtual group. I never used LUKS so Ican't be sure about that part. Security wise I have no idea.

Out of curiosity, why do you need such a setup?

davermont · 2014-09-15 12:15:20

I want my unencrypted / partition inside a logical volume. However, I also want encrypted /var, /home, /tmp, and swap partitions inside logical volumes as well. LVM on LUKS on LVM was the best solution I could come up with. I am also new to LUKS and I've never tried nesting LVM containers either.

clfarron4 · 2014-09-15 12:22:13

Head-scratching...

Something like:

sda
└─sda1
  └─Storage 254:0    0 XG  0 lvm 
    ├─Storage-lrootvol                        254:1    0    XG  0 lvm   /
    └─luks 254:0    0 XG  0 crypt
      ├─Storage-lvarvol                         254:2    0    XG  0 lvm   /var
      ├─Storage-lhomevol                        254:3    0   XG  0 lvm   /home
      ├─Storage-ltmpvol                        254:4    0   XG  0 lvm   /tmp
      └─Storage-lswapvol                        254:5    0   XG  0 lvm   swap

Note: This is only a conceptual mock-up.

Last edited by clfarron4 (2014-09-15 12:26:30)

bstaletic · 2014-09-15 12:25:33

Was that a typo or do you want /, /var, /home, /tmp and swap as encrypted logical volumes?

If it wasn't a typo you could just make one large volume group containing all the drives. Make logical LVM partitions and then encrypt those using LUKS. It is a simpler approach.

th3voic3 · 2014-09-15 12:55:53

davermont wrote:

I want my unencrypted / partition inside a logical volume. However, I also want encrypted /var, /home, /tmp, and swap partitions inside logical volumes as well. LVM on LUKS on LVM was the best solution I could come up with. I am also new to LUKS and I've never tried nesting LVM containers either.

Why don't you just encrypt the root partition as well? Any reason why that wouldn't work for you?

davermont · 2014-09-15 13:02:29

sda
└─sda1
└─Storage 254:0 0 XG 0 lvm
├─Storage-lrootvol 254:1 0 XG 0 lvm /
└─luks 254:0 0 XG 0 crypt
├─Storage-lvarvol 254:2 0 XG 0 lvm /var
├─Storage-lhomevol 254:3 0 XG 0 lvm /home
├─Storage-ltmpvol 254:4 0 XG 0 lvm /tmp
└─Storage-lswapvol 254:5 0 XG 0 lvm swap

Yes, that's what I was thinking, except that it's all on sda2 because sda1 is my EFI System partion.

Why don't you just encrypt the root partition as well? Any reason why that wouldn't work for you?

This is on a laptop, so I was trying to avoid the performance/battery life penalty of encrypting the root partition.

clfarron4 · 2014-09-15 19:35:44

davermont wrote:

Why don't you just encrypt the root partition as well? Any reason why that wouldn't work for you?
This is on a laptop, so I was trying to avoid the performance/battery life penalty of encrypting the root partition.

I don't really notice the performance penalties for encrypting the whole thing and with modern laptops shipping with AES-NI, encryption performance shouldn't be noticeable for most people.

davermont · 2014-09-16 01:22:09

This does have AES-NI acceleration, so maybe I will try that. Still not sure what the battery life implications are though.

Last edited by davermont (2014-09-16 01:22:55)

Arch Linux

#1 2014-09-15 01:56:21

LVM on LUKS on LVM

#2 2014-09-15 09:30:59

Re: LVM on LUKS on LVM

#3 2014-09-15 12:15:20

Re: LVM on LUKS on LVM

#4 2014-09-15 12:22:13

Re: LVM on LUKS on LVM

#5 2014-09-15 12:25:33

Re: LVM on LUKS on LVM

#6 2014-09-15 12:55:53

Re: LVM on LUKS on LVM

#7 2014-09-15 13:02:29

Re: LVM on LUKS on LVM

#8 2014-09-15 19:35:44

Re: LVM on LUKS on LVM

#9 2014-09-16 01:22:09

Re: LVM on LUKS on LVM

Board footer