Full Disk Encryption: Difference between revisions
imported>Ulinja move "LVM on LUKS" to relevant section |
imported>Ulinja add section on unlocking secondary drives |
||
| Line 180: | Line 180: | ||
} | } | ||
</syntaxhighlight> | </syntaxhighlight> | ||
= Unlocking secondary drives = | |||
Consider the following example: a secondary hard disk <code>/dev/sdb</code> is to be LUKS-encrypted and unlocked during boot, in addition to <code>/dev/sda</code>. | |||
Encrypt the drive and create the filesystem on it (LVM is used in this example): | |||
<syntaxhighlight lang="bash"> | |||
cryptsetup luksFormat --label CRYPTSTORAGE /dev/sdb | |||
cryptsetup open /dev/sdb cryptstorage | |||
pvcreate /dev/mapper/cryptstorage | |||
vgcreate vg-storage /dev/mapper/cryptstorage | |||
lvcreate -l 100%FREE -n storage vg-storage | |||
mkfs.ext4 -L STORAGE /dev/vg-storage/storage | |||
</syntaxhighlight> | |||
To unlock this device on boot in addition to the encrypted root filesystem, there are two options: | |||
=== Option 1: Unlock before boot using a password === | |||
Set the following in <code>configuration.nix</code> (replacing <code>UUID-OF-SDB</code> with the actual UUID of <code>/dev/sdb</code>): | |||
<syntaxhighlight lang="nix"> | |||
{ | |||
boot.initrd.luks.devices.cryptstorage.device = "/dev/disk/by-uuid/UUID-OF-SDB"; | |||
} | |||
</syntaxhighlight> | |||
During boot, a password prompt for the second drive will be displayed. Passwords previously entered are tried automatically to also unlock the second drive. This means that if you use the same passwords to encrypt both your main and secondary drives, you will only have to enter it once to unlock both. | |||
The decrypted drive will be unlocked and made available under <code>/dev/mapper/cryptstorage</code> for mounting. | |||
One annoyance with this approach is that reusing entered passwords only happens on the initial attempt. If you mistype the password for your main drive on the first try, you will now have to re-enter it twice, once for the main drive and again for the second drive, even if the passwords are the same. | |||
=== Option 2: Unlock after boot using crypttab and a keyfile === | |||
Alternatively, you can create a keyfile stored on your root partition to unlock the second drive just before booting completes. This can be done using the <code>/etc/crypttab</code> file (see manpage <code>crypttab(5)</code>). | |||
First, create a keyfile for your secondary drive, store it safely and add it as a LUKS key: | |||
<syntaxhighlight lang="bash"> | |||
dd bs=512 count=4 if=/dev/random of=/root/mykeyfile.key iflag=fullblock | |||
chmod 400 /root/mykeyfile.key | |||
cryptsetup luksAddKey /dev/sdb /root/mykeyfile.key | |||
</syntaxhighlight> | |||
Next, create <code>/etc/crypttab</code> in <code>configuration.nix</code> using the following option (replacing <code>UUID-OF-SDB</code> with the actual UUID of <code>/dev/sdb</code>): | |||
<syntaxhighlight lang="nix"> | |||
{ | |||
environment.etc.crypttab.text = '' | |||
cryptstorage UUID=UUID-OF-SDB /root/mykeyfile.key | |||
'' | |||
} | |||
</syntaxhighlight> | |||
With this approach, the secondary drive is unlocked just before the boot process completes, without the need to enter its password. | |||
Again, the secondary drive will be unlocked and made available under <code>/dev/mapper/cryptstorage</code> for mounting. | |||
= Further reading = | = Further reading = | ||