Re: [gentoo-user] LVM on LUKS

[Florian Philipp <lists@f_philipp.fastmail.net>]

[-- Attachment #1: Type: text/plain, Size: 1753 bytes --]

Am 07.08.2010 11:48, schrieb Florian Philipp:
> Hi list!
> 
> I'm building a new Gentoo system (notebook) and want to rearrange a few
> things. I thought it would be good to have the following layout:
> 
>  - boot on a normal partition
>  - root on a normal partition
>  - one big encrypted partition (dmcrypt / LUKS)
>  - on that partition an LVM volume group
>  - on that volume group all stuff not necessary for booting: home, var,
> tmp, etc.
> 
> AFAIK, the Gentoo boot process is organized so that LVM gets stated
> before dmcrypt is started. I would need it vice versa.
> 
> Is that possible with baselayout-1? Do I need to switch to baselayout-2?
> 
> Thanks in advance!
> Florian Philipp
> 

Thanks everyone for your suggestions! However, I decided against using
them for basically two reasons:

1. I want to keep it simple and safe and there are few things more
troublesome than a system which cannot even mount its root.

Therefore I keep root on a normal partition while everything with
possibly valuable information (tmp, var, home, srv) gets encrypted. opt
and usr/local will follow, if necessary.

It is also my reason for not using an initrd.

2. I want as few single points of failure as possible on my system. A
key file would be such a point. Granted, a single volume with a
passphrase is also a SPOF - but one which is less likely to fall prey to
an rm -rf *. (Okay, I have a backup, but I would like to avoid using it ;) )

Long story short: In the end, I tried baselayout-2 and it works like a
charm. I just configured /etc/conf.d/dmcrypt, added dmcrypt to runlevel
sysinit and then (just for good measure, don't think it's necessary)
added 'rc_dmcrypt_before="lvm"' to /etc/rc.conf.



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 262 bytes --]