LinuxQuestions.org
Go Job Hunting at the LQ Job Marketplace
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices

Reply
 
LinkBack Search this Thread
Old 01-28-2009, 08:58 PM   #1
nyle
Member
 
Registered: Feb 2008
Location: Atlanta
Distribution: Ubuntu 9.10
Posts: 42

Rep: Reputation: 17
LVM and dm-crypt -- best way to encrypt a logical volume?


Howdy,

I have two drives, /dev/sda and /dev/sdb. I set up a volume group called "fileshare" which is composed of a bunch of logical volumes (called "music," "video," etc.) spread across both drives. Then I formatted them.

Everything shows up fine in the actual system; I can mount /dev/mapper/fileshare-video and read and write to it just fine. I want to encrypt everything but /boot and the / directory but am having trouble figuring out the most elegant way to do it.

I can easily use cryptsetup to encrypt /dev/mapper/fileshare-(whatever) but it seems hackish. Case in point-
Code:
cryptsetup luksFormat -c aes-cbc-essiv:sha256 /dev/mapper/fileshare-video
cryptsetup luksOpen /dev/mapper/fileshare-video video
mount /dev/mapper/video /var/fileserver/video
This will do the trick, but now in the /dev/mapper directory I have two entries pointing to the same thing-- /dev/mapper/fileshare-video (the LV) and /dev/mapper/video (the encrypted device).

Is this simply *the* way to do it or is there a way to avoid having to create a separate /dev/mapper entry? I've read that one can encrypt the whole VG, which spares me from having to enter the key once for every partition when I decrypt them at boot. Can't figure out how to do that though, as:
Code:
cryptsetup luksFormat -c aes-cbc-essiv:sha256 /dev/fileshare
results in a device can't be accessed error. Which makes sense since /dev/fileshare just points to the individual partitions, but I don't see how else to encrypt the entire VG.

Any tips would be appreciated!
 
Old 01-29-2009, 04:45 AM   #2
almatic
Member
 
Registered: Mar 2007
Distribution: Debian
Posts: 547

Rep: Reputation: 66
first you need to create the encrypted container (without filesystem), then the lvm volume-group inside it.
 
Old 01-30-2009, 11:36 AM   #3
nyle
Member
 
Registered: Feb 2008
Location: Atlanta
Distribution: Ubuntu 9.10
Posts: 42

Original Poster
Rep: Reputation: 17
I think I understand the concept...make a container, encrypt it, then set up a filesystem within it. Ok.

Just to make sure I understand the actual procedure though, I still have to set up LVM beforehand, right? Once I have a (physical?) volume spanning the two drives, I would create a container on that volume, encrypt it, mount it, and set up a filesystem within it.

Do I have that right?
 
Old 01-31-2009, 12:59 AM   #4
almatic
Member
 
Registered: Mar 2007
Distribution: Debian
Posts: 547

Rep: Reputation: 66
Quote:
Originally Posted by nyle View Post
Just to make sure I understand the actual procedure though, I still have to set up LVM beforehand, right? Once I have a (physical?) volume spanning the two drives, I would create a container on that volume, encrypt it, mount it, and set up a filesystem within it.

Do I have that right?
No

If you want to encrypt your entire volume-group (as stated in your first post) you need to setup the encryption _before_ the lvm. Basically like this:

Create the enrypted container:

cryptsetup -c aes-cbc-essiv:sha256 --key-size 256 luksFormat /dev/whereever-your-physical-partition-is

open the container:

cryptsetup luksOpen /dev/whereever-your-physical-partition-is my-enc-container

you now have /dev/mapper/my-enc-container as device, on which you now create the volume group:

pvcreate /dev/mapper/my-enc-container
vgcreate my-vol-group /dev/mapper/my-enc-container

now you can create your logical volumes with 'lvcreate' and setup your config files.
 
Old 01-31-2009, 01:53 PM   #5
nyle
Member
 
Registered: Feb 2008
Location: Atlanta
Distribution: Ubuntu 9.10
Posts: 42

Original Poster
Rep: Reputation: 17
Got it. Thanks so much. I didn't quite understand the concept of "container," hence my confusion.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
How to Resize Root LVM Logical Volume??? jdupre Fedora 17 10-02-2010 07:21 AM
Shrinking a Logical Volume With LVM jimmyjiang Red Hat 1 02-28-2008 04:45 PM
LVM: The Impact of Reducing a Logical Volume Size? muff Linux - General 0 07-27-2007 02:18 AM
LVM - Extending logical volume - Insufficient free space deim Linux - Newbie 0 04-07-2007 09:47 PM
LVM: How to create logical (physical) volume with extent sie 32 Mb consistgd Linux - Software 4 11-14-2006 05:03 PM


All times are GMT -5. The time now is 11:28 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration