Full Disk Encryption: Difference between revisions

(4 intermediate revisions by 4 users not shown)

Line 1:

There are a few options for full disk encryption.

There are a few options for full disk encryption. The easiest way is to use the graphical installer and choose „encrypt“ while doing the installation.

= Enter password on Boot (LVM on LUKS) =

Line 29:

boot = {

loader = {

canTouchEfiVariables = true;

efi.canTouchEfiVariables = true;

grub = {

enable = true;

Line 180:

}

</syntaxhighlight>

= Unlocking secondary drives =

Consider the following example: a secondary hard disk <code>/dev/sdb</code> is to be LUKS-encrypted and unlocked during boot, in addition to <code>/dev/sda</code>.

Encrypt the drive and create the filesystem on it (LVM is used in this example):

cryptsetup luksFormat --label CRYPTSTORAGE /dev/sdb

cryptsetup open /dev/sdb cryptstorage

pvcreate /dev/mapper/cryptstorage

vgcreate vg-storage /dev/mapper/cryptstorage

lvcreate -l 100%FREE -n storage vg-storage

mkfs.ext4 -L STORAGE /dev/vg-storage/storage

</syntaxhighlight>

To unlock this device on boot in addition to the encrypted root filesystem, there are two options:

=== Option 1: Unlock before boot using a password ===

Set the following in <code>configuration.nix</code> (replacing <code>UUID-OF-SDB</code> with the actual UUID of <code>/dev/sdb</code>):

{

boot.initrd.luks.devices.cryptstorage.device = "/dev/disk/by-uuid/UUID-OF-SDB";

}

</syntaxhighlight>

During boot, a password prompt for the second drive will be displayed. Passwords previously entered are tried automatically to also unlock the second drive. This means that if you use the same passwords to encrypt both your main and secondary drives, you will only have to enter it once to unlock both.

The decrypted drive will be unlocked and made available under <code>/dev/mapper/cryptstorage</code> for mounting.

One annoyance with this approach is that reusing entered passwords only happens on the initial attempt. If you mistype the password for your main drive on the first try, you will now have to re-enter it twice, once for the main drive and again for the second drive, even if the passwords are the same.

=== Option 2: Unlock after boot using crypttab and a keyfile ===

Alternatively, you can create a keyfile stored on your root partition to unlock the second drive just before booting completes. This can be done using the <code>/etc/crypttab</code> file (see manpage <code>crypttab(5)</code>).

First, create a keyfile for your secondary drive, store it safely and add it as a LUKS key:

dd bs=512 count=4 if=/dev/random of=/root/mykeyfile.key iflag=fullblock

chmod 400 /root/mykeyfile.key

cryptsetup luksAddKey /dev/sdb /root/mykeyfile.key

</syntaxhighlight>

Next, create <code>/etc/crypttab</code> in <code>configuration.nix</code> using the following option (replacing <code>UUID-OF-SDB</code> with the actual UUID of <code>/dev/sdb</code>):

{

environment.etc.crypttab.text = ''

cryptstorage UUID=UUID-OF-SDB /root/mykeyfile.key

''

}

</syntaxhighlight>

With this approach, the secondary drive is unlocked just before the boot process completes, without the need to enter its password.

Again, the secondary drive will be unlocked and made available under <code>/dev/mapper/cryptstorage</code> for mounting.

= Further reading =

Line 188:

Line 242:

* Have a look at https://wiki.archlinux.org/index.php/Disk_encryption to see all the possible options. This wiki page is not complete.

* [https://gist.github.com/ladinu/bfebdd90a5afd45dec811296016b2a3f Installation with encrypted /boot]

* [[Remote ~~LUKS Unlocking~~|Using Tor and SSH to unlock your LUKS Disk over the internet]].

* [[Remote disk unlocking|Using Tor and SSH to unlock your LUKS Disk over the internet]].

* [[Bcachefs]], filesystem which supports native encryption

[[Category:Desktop]]

[[Category:Server]]