LinuxQuestions.org
Visit Jeremy's Blog.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Slackware
User Name
Password
Slackware This Forum is for the discussion of Slackware Linux.

Notices


Reply
  Search this Thread
Old 11-14-2021, 04:13 PM   #1
Didier Spaier
LQ Addict
 
Registered: Nov 2008
Location: Paris, France
Distribution: Slint64-15.0
Posts: 11,065

Rep: Reputation: Disabled
Full disk LUKS encryption without LVM or separate /boot partition, passphrase typed only once


This is an answer to this post.

Context: installation of Slint64-14.2.1.

If users chooses the Auto mode and dedicate a drive to Slint the installer propose to encrypt the drive. if they accept, they are prompted to type a passphrase twice. Then the installer encrypts the root partition and if requested an additional partition using the same passphrase. A key files for each partition is stored in /etc/keys. If an additional partition is created the file /etc/crypttab is written accordingly. The installer creates an iniramfs and stores there the key file. The init script in the initrd is modified from one in the mkinitrd Slackware package to handle unlocking the root partition (named by UUID) with a key file stored inside it. /etc/defaut/grub includes ' GRUB_ENABLE_CRYPTODISK=y' and 'GRUB_PRELOAD_MODULES="luks cryptodisk"' so when booting:
  1. GRUB asks the passphrase to unlock the drive before displaying the boot menu.
  2. The init script of the initramfs unlocks the root partition.
  3. The optional additional partition is unlocked.
So: no LVM, no separate /boot partition, passphrase typed only once.
 
Old 11-14-2021, 04:20 PM   #2
Jeebizz
Senior Member
 
Registered: May 2004
Distribution: Slackware15.0 64-Bit Desktop, Debian 11 non-free Toshiba Satellite Notebook
Posts: 4,190

Rep: Reputation: 1383Reputation: 1383Reputation: 1383Reputation: 1383Reputation: 1383Reputation: 1383Reputation: 1383Reputation: 1383Reputation: 1383Reputation: 1383
Quote:
Originally Posted by Didier Spaier View Post
This is an answer to this post.

Context: installation of Slint64-14.2.1.

If users chooses the Auto mode and dedicate a drive to Slint the installer propose to encrypt the drive. if they accept, they are prompted to type a passphrase twice. Then the installer encrypts the root partition and if requested an additional partition using the same passphrase. A key files for each partition is stored in /etc/keys. If an additional partition is created the file /etc/crypttab is written accordingly. The installer creates an iniramfs and stores there the key file. The init script in the initrd is modified from one in the mkinitrd Slackware package to handle unlocking the root partition (named by UUID) with a key file stored inside it. /etc/defaut/grub includes ' GRUB_ENABLE_CRYPTODISK=y' and 'GRUB_PRELOAD_MODULES="luks cryptodisk"' so when booting:
  1. GRUB asks the passphrase to unlock the drive before displaying the boot menu.
  2. The init script of the initramfs unlocks the root partition.
  3. The optional additional partition is unlocked.
So: no LVM, no separate /boot partition, passphrase typed only once.
I was wondering about that actually, it is good to know that you can now have full encryption without needing an un-encrypted /boot partition. As for no LVM, what if you still want that, and does that require a /boot partition if encrypted?

My other question, can you get the installer to detect encrypted partitions to install on? Say for example if I come from another distro and already setup encrypted partitions, and just want to install over it?

Also given that you did quite the leg-work for this - I kinda wish / hope it will make it into the Slackware installer at some point.
 
Old 11-14-2021, 04:33 PM   #3
Didier Spaier
LQ Addict
 
Registered: Nov 2008
Location: Paris, France
Distribution: Slint64-15.0
Posts: 11,065

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by Jeebizz View Post
As for no LVM, what if you still want that, and does that require a /boot partition if encrypted?
I have no experience with setting up LVM so can't answer. If I needed the features that LVM provides I would rather use instead a file system like BTRFS or ZFS.

Quote:
My other question, can you get the installer to detect encrypted partitions to install on? Say for example if I come from another distro and already setup encrypted partitions, and just want to install over it?
No. As this feature is only provided in case user wants tu dedicate the whole drive to Slint we begin with wiping out anything on it . But of course user is allowed to type the same passphrase as previously.

Quote:
Also given that you did quite the leg-work for this - I kinda wish / hope it will make it into the Slackware installer at some point.
I have already stated that I would be glad to help make this happen.

As an aside, this is also true for other specific features of the Slint installer like the Auto mode itself, or making a portable installation.

Last edited by Didier Spaier; 11-14-2021 at 04:58 PM.
 
Old 11-14-2021, 05:18 PM   #4
Jeebizz
Senior Member
 
Registered: May 2004
Distribution: Slackware15.0 64-Bit Desktop, Debian 11 non-free Toshiba Satellite Notebook
Posts: 4,190

Rep: Reputation: 1383Reputation: 1383Reputation: 1383Reputation: 1383Reputation: 1383Reputation: 1383Reputation: 1383Reputation: 1383Reputation: 1383Reputation: 1383
Quote:
Originally Posted by Didier Spaier View Post
No. As this feature is only provided in case user wants tu dedicate the whole drive to Slint we begin with wiping out anything on it . But of course user is allowed to type the same passphrase as previously.
Well I mean can you still have it retain the partition? What I mean is say I used Debian's graphical installer (cause yes I am that fscking lazy to do it by hand) to partition up the disk, I don't want to have to go in and do that myself again - I don't mind if I have to wipe/re-encrypt if that is still required. Basically I wish the installer would say "oh you have an encrypted partition, supply the password and I will be happy to wipe/re-encrypt and then install, without you needing to manually create the partitions again" ... If I am explaining myself right.
 
Old 11-14-2021, 05:34 PM   #5
Didier Spaier
LQ Addict
 
Registered: Nov 2008
Location: Paris, France
Distribution: Slint64-15.0
Posts: 11,065

Original Poster
Rep: Reputation: Disabled
Well, in the Auto mode of the Slint installer you don't create the partitions yourself, instead you just indicate the size of the root partition and if requested the size of the additional partition. Actually in this mode you don't type any command, instead you just answer (very few) questions as indicated in https://slint.fr/doc/HandBook.html#A...c_installation.
 
1 members found this post helpful.
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Uefi and full disk encryption with lvm on luks with luks keyfile lancsuk Slackware 2 04-02-2021 02:43 PM
Full Disk Encryption Luks with USB keyfile and fallback to passphrase Nikosis Debian 1 09-14-2020 09:02 AM
[SOLVED] Small / partition on OpenSUSE Tumbleweed with LVM+LUKS full disk encryption HowOriginal Linux - General 9 06-10-2018 06:32 AM
How to have luks encryption with keyfile OR passphrase (efi full disk encryption including boot)? byroncollege Linux - Security 2 03-30-2017 07:45 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Slackware

All times are GMT -5. The time now is 04:30 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration