Re: Does 9.0-stable installer support full disc encryption

[Matthew Seaman]

On 20/04/2012 10:21, Frank Lanitz wrote:
 Wasn't able to find something about this: Do I have a chance to do
 direct installation of a FreeBSD into a full encrpyted environment where
 not only /home, but also e.g. /usr is encrypted? Currently I've got such
 a setup running with Linux inside a crypto lvm and don't want to miss it
 ;) However, currently looking what's the best way in getting a fresh
 installed FreeBSD into this state.

This isn't provided as one of the standard options in bsdinstall.

However, you can set it up by booting the install media into Live CD
mode, and doing the disk partitioning, encryption setup and so forth by
hand.  It's a bit tedious, but not really difficult, so long as you know
how to work commands like gpart(8) and newfs(8).

Cheers,

Matthew

-- 
Dr Matthew J Seaman MA, D.Phil.
PGP: http://www.infracaninophile.co.uk/pgpkey




signature.asc
Description: OpenPGP digital signature

Re: Does 9.0-stable installer support full disc encryption

[Wojciech Puchar]

Wasn't able to find something about this: Do I have a chance to do
direct installation of a FreeBSD into a full encrpyted environment where
not only /home, but also e.g. /usr is encrypted? Currently I've got such
as i always say the best installer is no installer, as it supports 
everything you want exactly because YOU do the (simple) instalation steps 
as you want.


Actually except the really first time i tried FreeBSD, i never used it. 
both old sysinstall and new that i even don't know as i don't compile it.


REALLY - grab some usable self-containted DVD/CD/pendrive that boots into 
complete FreeBSD, add compressed install files (may be like distro or your 
own), then just make partitions, newfs then, perform bsdlabel -B (or 
gpart), and unpack.


or make partitions, geli init+geli attach right one, newfs and unpack.


if you want ALL encrypted then:

- make very small /b partition like 100-200 megs unencrypted
- after unpacking from your / partition move /boot to /b/boot, then make a 
link /boot - b/boot

- in loader.conf add

vfs.root.mountfrom=ufs:yourrootpartition

ex.

vfs.root.mountfrom=ufs:ada0d.eli



with standard generic kernel you need

geom_eli_load=YES in loader.conf too



after all works compile your kernel, make sure GEOM_ELI is compiled in (no 
need for module), and - if you have one of the latest intel CPU, or one of 
the less latest VIA CPU apply a driver for hardware accelerated AES 
encryption. speedup of encryption from 50MB/s to 2-3GB/s is quite normal 
:)



actually i usually encrypt everything on such hardware as encryption load 
is not noticable.

___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org