Parabola with LVM on LUKS - 2017-02-20
As of recently I have reinstalled Parabola with a LUKS encrypted partition containing both swap and root (I do not have a separate home partition). I found this to be a long and painful process, but I learned quite a bit from doing it. My current setup is as follows:
Device Mount Type File System /dev/sda1 /boot Linux ext4 /dev/sda2 - Linux LVM LUKS LVol Mount File System lvolroot / ext4 lvolswap - swap
This configuration does leave `/boot' vulnerable, however I do not have anything particularly important there (if you do you may want to look up how to use LVM on LUKS with `/boot' in an encrypted partition, I believe the ArchWiki has an page on this). I will continue to show you how to setup your configuration so that you can have a similar config (such as adding a `/home' partition or otherwise).
WARNING: I am not responsible for what the outcome of this is if you are following this. This is simply a light guide. Basically, this is a no warranty statement. It will most likely work, but I'm not going to guarantee anything.
I will start assuming you've already booted from the Parabola live CD (the main one, not the MATE one). I will also assume that the device you're installing to is `/dev/sda', please make sure you're using the correct device!. Last thing I want is an e-mail saying that my post caused someone to delete an important drive or something.
To begin will most likely want to secure your disk and assure that no information is left behind on it by overwriting the entire thing. You can do this by running `dd if=/dev/urandom of=/dev/sda bs=1M status=progress'. You can use `/dev/zero' instead as the `if', but beware that if `dd' misses anything then it will be evident that that block of information was not wiped and is relevant. This will take a while, so go make a coffee, go out for a walk, read a book, do something else for a while. I ran this on a 500GB mechanical hard drive and it took about an hour, you can approximate by looking at the progress information (the parameter of which I so generously provided, `status=progress', unlike most other guides) and decide what to do, if you have an SSD it may take less time.
Once you've come back for the hundredth time to finally see that it finished we can now begin with the partitioning. First, you'll want to run `cfdisk /dev/sda' (you can use whatever you want, that's just what I used) and choose the `dos' disk label (others may work, but `dos' is what I used, and `gpt' failed horribly for me). After this create a new primary partition of about 100M, Linux, and set the bootable flag for it (from now on it will be referred to as `/dev/sda1', same warning as before). Then allocate the rest of the space (or whatever you want) to a second primary partition which will be our LUKS encrypted LVM partition, make sure it's a Linux LVM type (from now on it will be referred to as `/dev/sda2', again, please make sure). After which write the changes and exit the program.
First let's get the boot partition out of the way. You only need to run `mkfs.ext4 /dev/sda1' (or ext2 if you prefer, but ext4 works for me).
Now it's finally time to get to the encryption. First make sure the kernel module is enabled: `modprobe dm-crypt'. Now you'll want to run a benchmark to see which encryption algorithm will work best with your computer, seeing that certain CPUs favor certain algorithms. You can see this by running `cryptsetup benchmark'. It is likely that aes-xts will be the best option in your case with a certain key size. You can now run `cryptsetup --cipher . If indeed the best algorithm for your CPU is aes-xts then you can ignore the `--cipher argument, since it will use that by default, otherwise please refer to the docs or man pages. After this your `/dev/sda2' partition should be formatted with LUKS. We're half way there!
Now that you have the encrypted partition it's time to open it ('cause right now it's closed), and by open I just mean decrypt it, it will not be mounted (yet). Run `cryptsetup luksOpen /dev/sda2 . For ` you can put anything you want, I put `lvmcrypt' just to make it clear as to what it is (and that's how I'll refer to it in the rest of this post). Now you should be able to find the partition (or, rather, a link to your partition) in `/dev/mapper/' with the label you just gave it, and you can treat it just like any other partition, which is what we'll do for getting LVM setup on it. The following will be a list of commands to setup LVM with root and swap logical volumes:
# Load kernel module modprobe dm-mod # Setup LVM pvcreate /dev/mapper/lvmcrypt # Create the LVM group I use VolGroup0 vgcreate VolGroup0 /dev/mapper/lvmcrypt # Create the swap partition lvcreate -C y -L 4G VolGroup0 -n lvolswap # Create root partition with the rest of the space lvcreate -l +100%FREE VolGroup0 -n lvolroot
At this point all the partitions should be created and available in `/dev/mapper/' with names like `VolGroup0-lvolswap' (or whatever you put for the group and volume names). These are the volumes we'll be working with. Simply run:
mkfs.ext4 /dev/mapper/VolGroup0-lvolroot mkswap /dev/mapper/VolGroup0-lvolswap -L swap
Or however you wanted to format them.
From this point on you can mount them however you'd like according to the Parabola installation guide. The only thing you need to be careful of is when it comes time to setup the kernel hooks and the GRUB settings. When it comes time to setup the hooks you'll want to your `/etc/mkinitcpio.conf' `HOOKS' variable to look something like this: `HOOKS="base udev autodetect modconf keyboard block encrypt lvm2 filesystems fsck"'. The main hooks here that you need are `keyboard', `encrypt', and `lvm2' (the order they're in compared to the other hooks is important). You'll also want to modify your `/etc/default/grub' to have the `GRUB_CMDLINE_LINUX_DEFAULT' variable look something like `GRUB_CMDLINE_LINUX_DEFAULT="quiet splash cryptdevice=UUID=, where ` is the UUID of your LUKS partition which you can find via looking at the symbolic links in `/dev/disk/by-uuid/'.
If you have a swap partition then you will want to add a `resume' flag and hook to the prior. To do this in `/etc/default/grub' change it the variable to look like `GRUB_CMDLINE_LINUX_DEFAULT="... resume=/dev/mapper/VolGroup0-lvolswap"', and change the hooks in `/etc/mkinitpcio.conf' to look like `HOOKS="... encrypt lvm2 resume ..."'. With this hibernation should work just fine.
When you finish making the changes make sure to run `mkinitcpio -p linux-libre' and then for GRUB run `grub-mkconfig -o /boot/grub/grub.cfg'.
After you're done with all of the configuration and are exiting you'll have to properly unmount the volumes and close the encrypted device. To do this start by unmounting the volumes as would typically do when installing Parabola, and then run the following:
# Disable LVM vgchange -an # Close the LUKS device cryptsetup luksClose lvmcrypt
You should now be able to reboot and startup your new LUKS encrypted Parabola system. I may have forgotten something, if so please send me an e-mail so I can correct it (see my contact page).
Last updated: