Results 1 to 3 of 3
Thread: Encrypt root partition
Enjoy an ad free experience by logging in. Not a member yet? Register.
Encrypt root partition
I am currently trying to modify a Linux ( - Mepis 8 - ) installer so that it encrypts the root partition too. I found some tutorials on encryption with cryptsetup but they only treat encrypting swap and home partitions.
Basically, I'm after an encrypted root partition but which can still boot.
Any help, suggestions very appreciated.
Some have said that root doesn't have any reason to be encrypted, and I for one fear this can only be made reality by modifying the kernel and bootloader.
Thanks in advance.
- Join Date
- Apr 2009
- I can be found either 40 miles west of Chicago, in Chicago, or in a galaxy far, far away.
If you want to encrypt the entire disc (with exception of partition table and partition boot loader), you would need to embed the decryption software in the boot block of the disc. Basically, that means you have only a few hundred bytes to do it in. Possible but not simple. In any case, you are correct in that you would also have to modify the kernel and bootloader to support this.
From your posting, I'd have to say that you have a LOT of studying to do before you have enough requisite knowledge to even understand how to approach this problem, let alone implement the solution. Good luck!Sometimes, real fast is almost as good as real time.
Just remember, Semper Gumbi - always be flexible!
- Join Date
- Oct 2009
I know the posting is older, but anyways:
To have an encrypted root partition using LUKS (cryptsetup) you just have to create an initramfs that gets booted via kernel command line for example. Just look after busybox it replaces all of the standard linux commands with one statically linked binary. (The commands are symlinks to the busybox executable).
Init file should look something like:
#!/bin/sh export PATH=/bin umask 0077 mount -t proc proc /proc mount -t sysfs sysfs /sys mount -t tmpfs tmpfs /dev busybox --install -s echo /bin/mdev > /proc/sys/kernel/hotplug mdev -s while ! mount -n -o ro /dev/hda1 /bootram ; do sleep 5 done rm /dev/tty ln -s /dev/console /dev/tty cryptsetup luksOpen /dev/sdb1 root mount /dev/mapper/root /new-root echo > /proc/sys/kernel/hotplug umount -l /bootram /dev /sys /proc exec /bin/busybox switch_root /new-root /sbin/init root=/dev/mapper/root
you can pack your initramfs with
find . | cpio -o -H newc | gzip -9 > /boot/initramfs
I found a script on my HDD that should give you an idea of which devices to create. It also creates the symlinks to busybox. You have to modify it so that it suits your needs.
mkdir /tmp/myroot cd /tmp/myroot mkdir bin dev etc proc new cd /tmp/myroot/bin cp /tmp/bb/bin/busybox . for i in echo mkdir mknod mount sed sh switch_root test touch umount do ln busybox $i done cp /sbin/cryptsetup . cd /tmp/myroot/dev mknod -m600 console c 5 1 mknod -m660 hda2 b 3 2 mknod -m660 null c 1 3 mknod -m660 ram0 b 1 0 mknod -m666 tty c 5 0
title Root encrypted Linux root (hd0,0) kernel /boot/linux-2.6.31 root=/dev/ram0 real_root=/dev/mapper/root initrd /boot/initramfs