Encrypt root partition - Linux Forums

07-05-2009	#1 (permalink)
RFahy Just Joined! Join Date: Jun 2009 Posts: 11	Encrypt root partition Hello. I am currently trying to modify a Linux ( - Mepis 8 - ) installer so that it encrypts the root partition too. I found some tutorials on encryption with cryptsetup but they only treat encrypting swap and home partitions. Basically, I'm after an encrypted root partition but which can still boot. Any help, suggestions very appreciated. Some have said that root doesn't have any reason to be encrypted, and I for one fear this can only be made reality by modifying the kernel and bootloader. Thanks in advance.

07-13-2009	#2 (permalink)
Rubberman Linux Guru Join Date: Apr 2009 Location: I can be found either 40 miles west of Chicago, or in a galaxy far, far away. Posts: 2,662	If you want to encrypt the entire disc (with exception of partition table and partition boot loader), you would need to embed the decryption software in the boot block of the disc. Basically, that means you have only a few hundred bytes to do it in. Possible but not simple. In any case, you are correct in that you would also have to modify the kernel and bootloader to support this. From your posting, I'd have to say that you have a LOT of studying to do before you have enough requisite knowledge to even understand how to approach this problem, let alone implement the solution. Good luck! __________________ Sometimes, real fast is almost as good as real time.

4 Weeks Ago

#3 (permalink)

Scandium

Just Joined!

Join Date: Oct 2009

Location: Germany

Posts: 4

I know the posting is older, but anyways:

To have an encrypted root partition using LUKS (cryptsetup) you just have to create an initramfs that gets booted via kernel command line for example. Just look after busybox it replaces all of the standard linux commands with one statically linked binary. (The commands are symlinks to the busybox executable).

Init file should look something like:

Code:

#!/bin/sh
export PATH=/bin
umask 0077
mount -t proc proc /proc
mount -t sysfs sysfs /sys
mount -t tmpfs tmpfs /dev
busybox --install -s
echo /bin/mdev > /proc/sys/kernel/hotplug
mdev -s
while ! mount -n -o ro /dev/hda1 /bootram ; do
   sleep 5
done
rm /dev/tty
ln -s /dev/console /dev/tty
cryptsetup luksOpen /dev/sdb1 root
mount /dev/mapper/root /new-root
echo > /proc/sys/kernel/hotplug
umount -l /bootram /dev /sys /proc
exec /bin/busybox switch_root /new-root /sbin/init root=/dev/mapper/root

If you created your needed devices (with mknod)

you can pack your initramfs with

Code:

find . | cpio -o -H newc | gzip -9 > /boot/initramfs

EDIT
I found a script on my HDD that should give you an idea of which devices to create. It also creates the symlinks to busybox. You have to modify it so that it suits your needs.

Code:

mkdir /tmp/myroot
cd /tmp/myroot
mkdir bin dev etc proc new

cd /tmp/myroot/bin
cp /tmp/bb/bin/busybox .
for i in echo mkdir mknod mount sed sh switch_root test touch umount
do
    ln busybox $i
done
cp /sbin/cryptsetup . 

cd /tmp/myroot/dev
mknod -m600 console c 5 1
mknod -m660 hda2 b 3 2
mknod -m660 null c 1 3
mknod -m660 ram0 b 1 0
mknod -m666 tty c 5 0

You can boot it via grub's menu.lst with

Code:

title Root encrypted Linux
root (hd0,0)
kernel /boot/linux-2.6.31 root=/dev/ram0 real_root=/dev/mapper/root
initrd /boot/initramfs

Posting Rules

You may not post new threads

You may not post replies

You may not post attachments

You may not edit your posts

BB code is On

Smilies are On

[IMG] code is On

HTML code is Off

Trackbacks are Off

Pingbacks are Off

Refbacks are Off

Are you a Linux Guru who is willing to share your in-depth Linux knowledge? Try our new Article submission system.