logo

blog

My little blog can’t be this cute!

Entire Disk Encryption with LUKS and ZFS.xhtml (3389B)


  1. <article xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" class="h-entry">
  2. <a class="u-url" href="/articles/Entire%20Disk%20Encryption%20with%20LUKS%20and%20ZFS"><h1 class="p-name">Entire Disk Encryption with LUKS and ZFS</h1></a>
  3. <p>Note: this is done from my current system, notes and my mind.</p>
  4. <p>This tutorial is for people that know how to install gentoo. By Entire Disk Encryption I mean that even the /boot is encrypted. (but grub isn’t I think I’d need UEFI which too much hard and risky to setup and I don’t have hardware compatible with coreboot)</p>
  5. <h3>Setup the disk</h3>
  6. <ul>
  7. <li>Disk: /dev/sda, sda1: BIOS Boot(2M+), sda2: Linux</li>
  8. <li>LUKS container: $hostname</li>
  9. <li>Zpool: $hostname</li>
  10. <li>Your username: haelwenn</li>
  11. <li>temporary mountpoint: /mnt/gentoo</li>
  12. <li>UUID of your clean GPT table: 1c578f43-6f16-497c-ba88-986609ffa1d6</li>
  13. </ul>
  14. <pre><code>cryptsetup --cipher aes-xts-plain64 --key-size 512 --hash sha512 --verify-passphrase luksFormat /dev/sda2
  15. cryptsetup open /dev/sda2 $hostname
  16. zpool create -f -O compression=lz4 -m none -R /mnt/gentoo $hostname /dev/mapper/$hostname
  17. zfs create $hostname/ROOT
  18. zfs create -o mountpoint=legacy $hostname/ROOT/gentoo
  19. mkdir /mnt/gentoo
  20. mount -t zfs $hostname/ROOT/gentoo /mnt/gentoo
  21. zfs create -o mountpoint=/home $hostname/HOME
  22. zfs create $hostname/HOME/haelwenn
  23. zfs create -o mountpoint=/root $hostname/HOME/root
  24. zfs create $hostname/GENTOO
  25. zfs create -o mountpoint=/var/cache/distfiles $hostname/GENTOO/distfiles
  26. zfs create -o mountpoint=/var/cache/binpkgs $hostname/GENTOO/packages
  27. zfs create -o mountpoint=/var/db/repos $hostname/GENTOO/repos
  28. zfs create $hostname/GENTOO/repos/gentoo</code></pre>
  29. <h2>Configuring</h2>
  30. <p>USE flags:</p>
  31. <pre><code>sys-boot/grub libzfs device-mapper
  32. sys-fs/zfs rootfs
  33. sys-fs/zfs-kmod rootfs
  34. sys-kernel/genkernel cryptsetup</code></pre>
  35. <p>Now you need: <code>sys-boot/grub sys-fs/zfs sys-fs/zfs-kmod sys-kernel/genkernel</code>. You can also replace genkernel with dracut.</p>
  36. <p>Configuring ZFS for boot-up: <code>rc-update add zfs-import boot &amp;&amp; rc-update add zfs-mount &amp;&amp; rc-update add zfs-zed</code></p>
  37. <h3>initramfs (genkernel)</h3>
  38. <pre><code>mv /etc/genkernel.conf /etc/genkernel.conf.dist
  39. cat &gt;/etc/genkernel.conf &lt;&lt;-EOF
  40. GK_SHARE="${GK_SHARE:-/usr/share/genkernel}"
  41. CACHE_DIR="/var/cache/genkernel"
  42. DISTDIR="/var/cache/distfiles"
  43. LOGFILE="/var/log/genkernel.log"
  44. DEFAULT_KERNEL_SOURCE="/usr/src/linux"
  45. LOGLEVEL=1
  46. INSTALL="yes"
  47. SYMLINK="yes"
  48. BUSYBOX="yes"
  49. LUKS="yes"
  50. ZFS="yes"
  51. DISKLABEL="yes"
  52. KERNEL_SYMLINK_NAME="vmlinuz"
  53. COMPRESS_INITRD="yes"
  54. COMPRESS_INITRD_TYPE="best"
  55. INITRAMFS_SYMLINK_NAME="initramfs"
  56. MICROCODE_INITRAMFS="yes"
  57. EOF
  58. genkernel initramfs</code></pre>
  59. <h3>GRUB</h3>
  60. <p>As grub-mkconfig is a piece of crap which does unreadable config, I do it myself. Here it is:</p>
  61. <pre><code>#/boot/grub/grub.cfg
  62. insmod part_gpt
  63. insmod cryptodisk
  64. insmod luks
  65. insmod gcry_rijndael
  66. insmod gcry_sha512
  67. insmod zfs
  68. cryptomount -u 1c578f43-6f16-497c-ba88-986609ffa1d6
  69. set root=(crypto0)
  70. set prefix=(crypto0)/ROOT/default/@/boot/grub
  71. insmod gzio
  72. menuentry 'Gentoo' {
  73. linux /ROOT/default/@/boot/vmlinuz root=ZFS=rpool/ROOT/default crypt_root=UUID=1c578f43-6f16-497c-ba88-986609ffa1d6 dozfs=cache rootfstype=zfs
  74. initrd /ROOT/default/@/boot/initramfs
  75. }
  76. </code></pre>
  77. <p>And that should be all !</p>
  78. </article>