LVM and dm-crypt -- best way to encrypt a logical volume?
I have two drives, /dev/sda and /dev/sdb. I set up a volume group called "fileshare" which is composed of a bunch of logical volumes (called "music," "video," etc.) spread across both drives. Then I formatted them.
Everything shows up fine in the actual system; I can mount /dev/mapper/fileshare-video and read and write to it just fine. I want to encrypt everything but /boot and the / directory but am having trouble figuring out the most elegant way to do it.
I can easily use cryptsetup to encrypt /dev/mapper/fileshare-(whatever) but it seems hackish. Case in point-
Is this simply *the* way to do it or is there a way to avoid having to create a separate /dev/mapper entry? I've read that one can encrypt the whole VG, which spares me from having to enter the key once for every partition when I decrypt them at boot. Can't figure out how to do that though, as:
Any tips would be appreciated!
first you need to create the encrypted container (without filesystem), then the lvm volume-group inside it.
I think I understand the concept...make a container, encrypt it, then set up a filesystem within it. Ok.
Just to make sure I understand the actual procedure though, I still have to set up LVM beforehand, right? Once I have a (physical?) volume spanning the two drives, I would create a container on that volume, encrypt it, mount it, and set up a filesystem within it.
Do I have that right?
If you want to encrypt your entire volume-group (as stated in your first post) you need to setup the encryption _before_ the lvm. Basically like this:
Create the enrypted container:
cryptsetup -c aes-cbc-essiv:sha256 --key-size 256 luksFormat /dev/whereever-your-physical-partition-is
open the container:
cryptsetup luksOpen /dev/whereever-your-physical-partition-is my-enc-container
you now have /dev/mapper/my-enc-container as device, on which you now create the volume group:
vgcreate my-vol-group /dev/mapper/my-enc-container
now you can create your logical volumes with 'lvcreate' and setup your config files.
Got it. Thanks so much. I didn't quite understand the concept of "container," hence my confusion.
|All times are GMT -5. The time now is 11:12 PM.|