[gentoo-user] Encrypting everything

[Alex Schuster <wonko@wonkology.org>]

Hi there!

The last two PCs (A and B) I installed are fully encrypted. I used 
different methods. I used genkernel --luks --lvm --install all to create 
kernel and initramfs. I like to have everything as kernel modules, but the 
crypto stuff has to be directly in the kernel, unless I put these modules 
into the initramfs by hand.


A: LVM -> LUKS
Many partitions make two volume groups with many LVMs. Each LVM is LUKS-
encrypted. This gives me maximum flexibility, who knows what other OSes I 
might need to install on that drive. The boot partition is on a USB stick 
and also holds the key.

This did not work out of the box, I had to modify 
/lib/rcscripts/addons/dm-crypt-start.sh in order to open the other 
partitions than swap and root. I need to add something to close them when 
shutting down, but it seems to work fine without this for the moment. Do 
you know if there already is a solution for this?


B: LUKS -> LVM
A simpler approach. sda1 is a small boot partition, sda2 (the rest of the 
drive) is a LUKS-formatted LVM physical volume with volume group 'pvcrypt' 
on it. This does not work yet, the initramfs does not find the LVM.

I looked into the init script. I wants to do a cryptsetup luksOpen 
$LUKS_DEVICE $LUKS_NAME with $LUKS_NAME=root, which is not the name I use. 
But changing this does not help anyway. I get /dev/mapper/pvcrypt created, 
but pvscan does not find it. At this point I thought I'd ask here, do you 
have ideas what's wrong?

Using a live CD I can easily access my data:
cryptsetup luksOpen /dev/sda2 pvcrypt
pvscan
vgchange -a y
mount /dev/vgcrypt/root /gentoo

	Wonko