Arch Linux

CarterCox

Member

From: Argentina

Registered: 2018-02-24

Posts: 116

[SOLVED]Encrypting /boot without LVM

Hi. Looking at this https://wiki.archlinux.org/index.php/Dm … .28GRUB.29 it seems that LVM is the only way to go, but is there another alternative to do it with a simple layout like:

/dev/sda1: BIOS boot
/dev/sda2: /boot
/dev/sda3: /

?

Last edited by CarterCox (2018-06-30 02:23:04)

---

And neither the angels in Heaven above
   Nor the demons down under the sea
Can ever dissever my soul from the soul
   Of the beautiful Annabel Lee;

loqs

Member

Registered: 2014-03-06

Posts: 19,113

Re: [SOLVED]Encrypting /boot without LVM

Yes.

CarterCox

Member

From: Argentina

Registered: 2018-02-24

Posts: 116

Re: [SOLVED]Encrypting /boot without LVM

Hello Mr. Bot, thanks for the reply. Is there something in your database about an article that can guide me through the steps I have to take to accomplish this? A link to the article would be very helpful.

Thanks again.

---

And neither the angels in Heaven above
   Nor the demons down under the sea
Can ever dissever my soul from the soul
   Of the beautiful Annabel Lee;

Slithery

Administrator

From: Norfolk, UK

Registered: 2013-12-01

Posts: 5,776

Re: [SOLVED]Encrypting /boot without LVM

Just don't set up LVM if you don't want to use it, use the standard partitioning methods instead.

---

No, it didn't "fix" anything. It just shifted the brokeness one space to the right. - jasonwryan
Closing -- for deletion; Banning -- for muppetry. - jasonwryan

aur - dotfiles

loqs

Member

Registered: 2014-03-06

Posts: 19,113

Re: [SOLVED]Encrypting /boot without LVM

What have you tried so far with what results?  What other wiki pages have you read?

CarterCox

Member

From: Argentina

Registered: 2018-02-24

Posts: 116

Re: [SOLVED]Encrypting /boot without LVM

Just don't set up LVM if you don't want to use it, use the standard partitioning methods instead.

I'll try that. Thanks!

@loqs: Only the onces concerning dm-crypt.

Last edited by CarterCox (2018-06-29 21:11:31)

---

And neither the angels in Heaven above
   Nor the demons down under the sea
Can ever dissever my soul from the soul
   Of the beautiful Annabel Lee;

CarterCox

Member

From: Argentina

Registered: 2018-02-24

Posts: 116

Re: [SOLVED]Encrypting /boot without LVM

Ok. I tried doing that and didn't work.

Created this scheme (GPT):

/dev/sda1: BIOS boot
/dev/sda2: Linux extended boot
/dev/sda2: Linux root (x86-64)

After that I ran for root (/dev/sda3)

# cryptsetup -y -v luksFormat --type luks2 /dev/sda3
# cryptsetup open /dev/sda3 cryptroot
# mkfs.ext4 /dev/mapper/cryptroot
# mount /dev/mapper/cryptroot /mnt

Then for boot (/dev/sda2)

# cryptsetup luksFormat /dev/sda2
# cryptsetup open /dev/sda2 cryptboot
# mkfs.ext2 /dev/mapper/cryptboot
# mkdir /mnt/boot
# mount /dev/mapper/cryptboot /mnt/boot

mkinitcpio.conf:

HOOKS=(base udev autodetect keyboard keymap consolefont modconf block encrypt filesystems fsck)

/etc/default/grub:

GRUB_CMDLINE_LINUX="... cryptdevice=UUID=</dev/sda3-UUID>:cryptroot ...
GRUB_ENABLE_CRYPTODISK=y

ran

# grub-mkconfig -o /boot/grub/grub.cfg
# grub-install --target=i386-pc --recheck /dev/sda

/etc/crypttab

cryptboot  /dev/sda2      none        luks

Now when I boot I get:

GRUB loading...
Welcome to GRUB!
Attempting to decrypt master key...
Enter passphrase for hd0,gpt2 (213872381723q1283123123cdf):

I enter the key and then:

error: access denied.
error: no such cryptodisk found.
error: disk 'cryptouuid/213872381723q1283123123cdf' not found.
Entering rescue mode...
grub rescue>

Did I do something wrong?

Last edited by CarterCox (2018-06-29 22:00:39)

---

And neither the angels in Heaven above
   Nor the demons down under the sea
Can ever dissever my soul from the soul
   Of the beautiful Annabel Lee;

loqs

Member

Registered: 2014-03-06

Posts: 19,113

Re: [SOLVED]Encrypting /boot without LVM

No output about keyslots before the 'error: access denied'?

CarterCox

Member

From: Argentina

Registered: 2018-02-24

Posts: 116

Re: [SOLVED]Encrypting /boot without LVM

No output about keyslots before the 'error: access denied'?

No. That's all the output I get.

But the method is right? Maybe I typed something wrong. I can double check later, but there is no point if the method is flawed.

---

And neither the angels in Heaven above
   Nor the demons down under the sea
Can ever dissever my soul from the soul
   Of the beautiful Annabel Lee;

CarterCox

Member

From: Argentina

Registered: 2018-02-24

Posts: 116

Re: [SOLVED]Encrypting /boot without LVM

Ok. This is pretty great.

You can actually encrypt everything with only one partition.

Simply encrypt everything as normal and uncomment

GRUB_ENABLE_CRYPTODISK=y

in /etc/default/grub

The problem I was having before, is that GRUB doesn't load custom keymaps, and my password was wrong.

Anyways, I have everything encrypted in only one partition.

Thanks everyone!

---

And neither the angels in Heaven above
   Nor the demons down under the sea
Can ever dissever my soul from the soul
   Of the beautiful Annabel Lee;