[SOLVED]Encrypting a whole SSD drive without /boot

daankata · 2017-06-15 12:15:11

Hello!

I want to encrypt my whole SSD with dm-crypt with LUKS. I have a root, /boot and a /home partition. How can I encrypt all partitions with only one passphrase, so when I start the PC it asks for my pass only once and it will decrypt everything?

I read the Arch Wiki but I can't seem to find it. Can I use the following command?

# cryptsetup -v luksFormat /dev/sda2 /dev/sda3 /dev/sda4

Or it works only with one device:

# cryptsetup -v luksFormat /dev/sda2

And in the Arch Wiki there is a choosing a setup section.
When should encrypted parts of the disk be unlocked?
-Before boot
-During boot
-At login
-Manually on demand (after login)

What is the difference between "Before boot" and "During boot"? And is there a way that the /boot partition can be encrypted as part of the full disk encryption?
And how exactly can the /boot partition be located on an aforementioned USB stick?

Thank you!

Last edited by daankata (2017-06-15 14:16:06)

frostschutz · 2017-06-15 13:03:36

One common method is to make two partitions, one /boot and one LUKS. Inside LUKS you put LVM and that gives you logical volumes for root, home, this and that. Or you could just go with one filesystem for both root and home.

For SSD if you wish to use TRIM, you'll also have to pass the allow discards flag to LUKS. You can check with dmsetup table to see if it's set or not.

And is there a way that the /boot partition can be encrypted as part of the full disk encryption?

Well, GRUB has some cryptodisk support. (And I guess that's what "before boot" is referring to.)

I don't use it myself (there is not much point to it). It also means giving the passphrase twice (kernel does not know about whatever grub did), unless you supply the keyfile directly in the initramfs... well, not my bailiwick.

You can do more complicated, or non-standard setups, by customizing the initramfs ( writing your own mkinitcpio hook. ) So even if you had multiple LUKS containers, and wanted (LUKS-)encrypted keyfiles to open them, you could do that too - with a little shell scripting. But at the beginning it's probably better to stick to the simple, standard setup and that's quite good enough for most people anyhow.

My own setup is /boot on USB stick (plus a dozen Live/Rescue CDs in case something breaks), with LUKS-encrypted keyfiles in the initramfs. The passphrase you enter unlocks the keyfiles which in turn unlock several LUKS containers.

This indirection (passphrase -> keyfile -> luks) gives you some protection against cheap keyloggers... the passphrase, by itself, is useless if you don't have a copy of my USB stick with the keyfiles as well, and that USB stick stays on my keychain / in my pocket (you can pull the USB stick as soon as the system is booted - you only need it for booting, and updating kernel).

Last edited by frostschutz (2017-06-15 13:07:51)

daankata · 2017-06-15 13:39:54

Thank you very much frostschutz for the detailed reply!

Can you please explain to me a bit better (I am not so advanced user) about

My own setup is /boot on USB stick (plus a dozen Live/Rescue CDs in case something breaks), with LUKS-encrypted keyfiles in the initramfs. The passphrase you enter unlocks the keyfiles which in turn unlock several LUKS containers.

.So I understand that you unlock your encrypted disk by both, passphrase and a keyfile? And what do you mean by

plus a dozen Live/Rescue CDs in case something breaks

How can I pass the allow discards flags to LUKS in Arch so I can trim with my SSD? In Debian it was in /etc/crypttab and then

...UUID...none luks,discard

at the end.

And one more question are you using UEFI or BIOS/Legacy and MBR or GPT?

Last edited by daankata (2017-06-15 13:40:06)

frostschutz · 2017-06-15 14:02:14

I don't use UEFI anywhere... it's a matter of taste, the oldfashioned grub just works for me. MBR on usbstick, GPT for HDDs.

There is something in the wiki about allow discards https://wiki.archlinux.org/index.php/Dm … _.28SSD.29

( the parameter itself explained better here https://wiki.archlinux.org/index.php/Dm … ryptdevice )

It's not the end of the world if it's missing though, so you can always worry about that later.

Slithery · 2017-06-15 14:03:27

Have you read this wiki page?

https://wiki.archlinux.org/index.php/Dm … ire_system

I use LVM on LUKS on a couple of my Arch installs and this has been all the information I've needed.

Arch Linux

#1 2017-06-15 12:15:11

[SOLVED]Encrypting a whole SSD drive without /boot

#2 2017-06-15 13:03:36

Re: [SOLVED]Encrypting a whole SSD drive without /boot

#3 2017-06-15 13:39:54

Re: [SOLVED]Encrypting a whole SSD drive without /boot

#4 2017-06-15 14:02:14

Re: [SOLVED]Encrypting a whole SSD drive without /boot

#5 2017-06-15 14:03:27

Re: [SOLVED]Encrypting a whole SSD drive without /boot

Board footer