Find the answer to your Linux question:
Results 1 to 3 of 3
Hello. I am currently trying to modify a Linux ( - Mepis 8 - ) installer so that it encrypts the root partition too. I found some tutorials on encryption ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
  1. #1
    Just Joined! RFahy's Avatar
    Join Date
    Jun 2009
    Posts
    11

    Encrypt root partition


    Hello.
    I am currently trying to modify a Linux ( - Mepis 8 - ) installer so that it encrypts the root partition too. I found some tutorials on encryption with cryptsetup but they only treat encrypting swap and home partitions.

    Basically, I'm after an encrypted root partition but which can still boot.
    Any help, suggestions very appreciated.
    Some have said that root doesn't have any reason to be encrypted, and I for one fear this can only be made reality by modifying the kernel and bootloader.

    Thanks in advance.

  2. #2
    Linux Guru Rubberman's Avatar
    Join Date
    Apr 2009
    Location
    I can be found either 40 miles west of Chicago, in Chicago, or in a galaxy far, far away.
    Posts
    11,737
    If you want to encrypt the entire disc (with exception of partition table and partition boot loader), you would need to embed the decryption software in the boot block of the disc. Basically, that means you have only a few hundred bytes to do it in. Possible but not simple. In any case, you are correct in that you would also have to modify the kernel and bootloader to support this.

    From your posting, I'd have to say that you have a LOT of studying to do before you have enough requisite knowledge to even understand how to approach this problem, let alone implement the solution. Good luck!
    Sometimes, real fast is almost as good as real time.
    Just remember, Semper Gumbi - always be flexible!

  3. #3
    Just Joined!
    Join Date
    Oct 2009
    Location
    Germany
    Posts
    4
    I know the posting is older, but anyways:

    To have an encrypted root partition using LUKS (cryptsetup) you just have to create an initramfs that gets booted via kernel command line for example. Just look after busybox it replaces all of the standard linux commands with one statically linked binary. (The commands are symlinks to the busybox executable).

    Init file should look something like:

    Code:
    #!/bin/sh
    export PATH=/bin
    umask 0077
    mount -t proc proc /proc
    mount -t sysfs sysfs /sys
    mount -t tmpfs tmpfs /dev
    busybox --install -s
    echo /bin/mdev > /proc/sys/kernel/hotplug
    mdev -s
    while ! mount -n -o ro /dev/hda1 /bootram ; do
       sleep 5
    done
    rm /dev/tty
    ln -s /dev/console /dev/tty
    cryptsetup luksOpen /dev/sdb1 root
    mount /dev/mapper/root /new-root
    echo > /proc/sys/kernel/hotplug
    umount -l /bootram /dev /sys /proc
    exec /bin/busybox switch_root /new-root /sbin/init root=/dev/mapper/root
    If you created your needed devices (with mknod)

    you can pack your initramfs with

    Code:
    find . | cpio -o -H newc | gzip -9 > /boot/initramfs
    EDIT
    I found a script on my HDD that should give you an idea of which devices to create. It also creates the symlinks to busybox. You have to modify it so that it suits your needs.

    Code:
    mkdir /tmp/myroot
    cd /tmp/myroot
    mkdir bin dev etc proc new
    
    cd /tmp/myroot/bin
    cp /tmp/bb/bin/busybox .
    for i in echo mkdir mknod mount sed sh switch_root test touch umount
    do
        ln busybox $i
    done
    cp /sbin/cryptsetup . 
    
    cd /tmp/myroot/dev
    mknod -m600 console c 5 1
    mknod -m660 hda2 b 3 2
    mknod -m660 null c 1 3
    mknod -m660 ram0 b 1 0
    mknod -m666 tty c 5 0
    You can boot it via grub's menu.lst with

    Code:
    title Root encrypted Linux
    root (hd0,0)
    kernel /boot/linux-2.6.31 root=/dev/ram0 real_root=/dev/mapper/root
    initrd /boot/initramfs

  4. $spacer_open
    $spacer_close

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •