Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision | ||
scratch [2019/03/09 12:36] – [LUKS] admin | scratch [2019/03/10 13:03] (current) – [LUKS] admin | ||
---|---|---|---|
Line 168: | Line 168: | ||
====== LUKS ====== | ====== LUKS ====== | ||
https:// | https:// | ||
+ | | ||
################################# | ################################# | ||
########## Preparation ########## | ########## Preparation ########## | ||
Line 178: | Line 178: | ||
### Find the right partitions ### | ### Find the right partitions ### | ||
lsblk -o name, | lsblk -o name, | ||
- | + | | |
# nvme0n1 | # nvme0n1 | ||
# ├─nvme0n1p1 vfat | # ├─nvme0n1p1 vfat | ||
# ├─nvme0n1p2 ext4 | # ├─nvme0n1p2 ext4 | ||
# └─nvme0n1p3 swap 39,1G | # └─nvme0n1p3 swap 39,1G | ||
- | + | | |
# Set boot and root partition names according to above output! | # Set boot and root partition names according to above output! | ||
BOOTPART=/ | BOOTPART=/ | ||
ROOTPART=/ | ROOTPART=/ | ||
- | + | | |
- | | + | |
############################### | ############################### | ||
########### Encrypt ########### | ########### Encrypt ########### | ||
| | ||
- | =============================================================================== | ||
- | # A) Using luksipc | ||
- | |||
# Shrink root filesystem (NOT the partition) | # Shrink root filesystem (NOT the partition) | ||
- | BLKCNT=$(sudo tune2fs -l $ROOTPART | grep "Block count:" | ||
- | BLKCNT_SHRINK=$(($BLKCNT - 32768)) | ||
- | echo " | ||
- | |||
sudo e2fsck -f $ROOTPART | sudo e2fsck -f $ROOTPART | ||
- | sudo resize2fs $ROOTPART | + | sudo resize2fs |
| | ||
- | # | + | # Encrypt |
- | | + | |
- | # you can directly download it (wget), else copy it manually. | + | |
- | | + | |
- | # cd ~ | ||
- | # wget https:// | ||
- | # or: | ||
- | # wget https:// | ||
- | # or copy manually: | ||
- | cp luksipc-master.zip ~ | ||
- | cd ~ | ||
- | |||
- | # If you have no unzip, uncompress it with the GUI | ||
- | unzip luksipc-master.zip | ||
- | cd luksipc-master | ||
- | make | ||
- | sudo ./luksipc -d $ROOTPART | ||
- | | ||
- | # Add keyphrase (and remember it!) | ||
- | sudo cryptsetup luksAddKey $ROOTPART --key-file=/ | ||
- | # Let’s check this worked (slot 0 and 1 are populated) | ||
- | sudo cryptsetup luksDump $ROOTPART | ||
- | # Let’s scrub the initial keyslot so the initial keyfile becomes useless | ||
- | sudo cryptsetup luksKillSlot $ROOTPART 0 | ||
- | # And check again (slot 1 is empty now) | ||
- | sudo cryptsetup luksDump $ROOTPART | ||
- | | ||
- | =============================================================================== | ||
- | # B) or using cryptsetup-reencrypt: | ||
- | sudo cryptsetup-reencrypt --type=luks2 -N --reduce-device-size 4MiB $ROOTPART | ||
- | | ||
- | =============================================================================== | ||
- | | ||
# resize the filesystem to its original size | # resize the filesystem to its original size | ||
sudo cryptsetup luksOpen $ROOTPART newcryptofs | sudo cryptsetup luksOpen $ROOTPART newcryptofs | ||
sudo resize2fs / | sudo resize2fs / | ||
- | + | | |
- | | + | |
########################################################## | ########################################################## | ||
### Make the system boot from the encrypted filesystem ### | ### Make the system boot from the encrypted filesystem ### | ||
- | + | | |
sudo mount / | sudo mount / | ||
sudo mount $BOOTPART /mnt/boot | sudo mount $BOOTPART /mnt/boot | ||
- | + | | |
# Edit / | # Edit / | ||
sudo nano / | sudo nano / | ||
Line 254: | Line 216: | ||
# set HOOKS to | # set HOOKS to | ||
HOOKS=(base systemd autodetect keyboard keymap sd-vconsole modconf block sd-encrypt filesystems fsck) | HOOKS=(base systemd autodetect keyboard keymap sd-vconsole modconf block sd-encrypt filesystems fsck) | ||
- | + | ||
- | + | # Backup old config files and create new ones | |
- | # Set the content of the file / | + | for f in /mnt/ |
echo -e " | echo -e " | ||
- | # and / | ||
echo -e "title Arch Linux\nlinux / | echo -e "title Arch Linux\nlinux / | ||
/ | / | ||
root=/ | root=/ | ||
- | # and / | ||
echo -e "title Arch Linux Fallback\nlinux / | echo -e "title Arch Linux Fallback\nlinux / | ||
/ | / | ||
root=/ | root=/ | ||
- | + | | |
- | # You might want to delete all entries in / | + | |
- | # arch.conf and arch-fallback.conf as they won't boot anymore anyway. | + | |
- | ls / | + | |
- | + | ||
- | | + | |
sudo chroot /mnt | sudo chroot /mnt | ||
mount -t proc proc /proc | mount -t proc proc /proc | ||
mount -t sysfs sys /sys | mount -t sysfs sys /sys | ||
mount -t devtmpfs udev /dev | mount -t devtmpfs udev /dev | ||
- | + | | |
mkinitcpio -p linux | mkinitcpio -p linux | ||
exit # leave chroot | exit # leave chroot | ||
- | + | | |
# reboot | # reboot | ||
sudo reboot | sudo reboot | ||
Line 285: | Line 240: | ||
- | Not sure if this works: | ||
=============================================================================== | =============================================================================== | ||
- | # change | + | # Convert |
sudo cryptsetup convert --type=luks2 $ROOTPART | sudo cryptsetup convert --type=luks2 $ROOTPART | ||
| |