[gentoo-user] Re: Re: Re: Full disk encryption

2011-11-30 Thread Jack Byer
Dale wrote:

 Jack Byer wrote:
 Dale wrote:

 Did you use a howto for Dracut?  If so, have a link you could post?  I
 tried making a init thingy and after about 20 failed reboots, I scraped
 the idea.  I was trying to follow the howto on the Gentoo wiki I think.
 The unofficial wiki.

 I had some difficulties because the way I was doing things before with my
 homebrew solution was... non-standard.

 The problem areas that I remember from the transition were: setting the
 USE flags correctly to build the modules I needed, initially confusing
 dracutmodules and add_dracutmodules in dracut.conf (actually you probably
 don't even need to edit that file at all), making sure to have a sane
 /etc/fstab line for the root file system and passing the right root=
 kernel command line. root=UUID=... works the best in my experience.



 
 
 I did change the USE flags for the packages it said to.  I think some
 things have changed or something, maybe openrc?, and the script I was
 copying and working with just didn't work.  Maybe it needs updating or
 something.  I'm hoping to see a up-to-date howto or someone will post a
 good up-to-date howto for dracut.  Something even a idiot could follow.
 I think it will work for me then.  lol
 
 Dale
 
 :-)  :-)

 
I can tell you how mine is set up.

emerge -v dracut

These are the packages that would be merged, in order:

[ebuild   R   ~] sys-kernel/dracut-013-r2  USE=-debug (-selinux) 
DRACUT_MODULES=btrfs crypt lvm -biosdevname -caps -crypt-gpg -dmraid -
dmsquash-live -gensplash -iscsi -livenet -mdraid -multipath -nbd -nfs -
plymouth -syslog -xen 0 kB

I don't use any of the other modules so all I enable are btrfs, crypt and 
lvm.

/etc/dracut.conf has no changes from the default except for the line:

add_dracutmodules+=crypt dm lvm

but I'm about 80% sure even that isn't necessary and you could just leave 
the default values alone. One of these days I'll get around to testing that.

I make an initramfs with the following command:

dracut --lzma hostname.dracut.lzma kernel version

(obviously change --lzma to whatever type of compression your kernel 
expects 
to use and name the file whatever you want. Make sure to include the kernel 
version just like it appears in your /lib/modules/ directory so that dracut 
includes the correct kernel modules)

Then I make grub.conf look something like this:

root (hd0,0)
kernel /hostname root=UUID=08b00d7f-b633-4c03-98fe-dd5942a8fb7e 
initrd /hostname.dracut.lzma

I like to name my kernels and initramfs files by the hostname of the 
computer since I have three that I manage but use whatever you want and 
just 
make sure you put the right filenames in grub.conf.

You can obtain the UUID of your root filesystem by a number of methods, but 
the easiest is to use ls -l /dev/disks/by-uuid/

That's really all there is to it. Dracut will boot up and load the modules 
it is compiled with and search through the disks, logical volumes, and 
dmcrypt containers until it finds a filesystem with the UUID you specify. 
Once it finds the root filesystem it mounts it with whatever options you've 
specified in /etc/fstab and then hands control over to OpenRC.

If it has the necessary modules (kernel and dracut) and you pass the right 
root= option then it Just Works.




Re: [gentoo-user] Re: Re: Re: Full disk encryption

2011-11-30 Thread Dale

Jack Byer wrote:

I can tell you how mine is set up.

emerge -v dracut

These are the packages that would be merged, in order:

[ebuild   R   ~] sys-kernel/dracut-013-r2  USE=-debug (-selinux)
DRACUT_MODULES=btrfs crypt lvm -biosdevname -caps -crypt-gpg -dmraid -
dmsquash-live -gensplash -iscsi -livenet -mdraid -multipath -nbd -nfs -
plymouth -syslog -xen 0 kB

I don't use any of the other modules so all I enable are btrfs, crypt and
lvm.

/etc/dracut.conf has no changes from the default except for the line:

add_dracutmodules+=crypt dm lvm

but I'm about 80% sure even that isn't necessary and you could just leave
the default values alone. One of these days I'll get around to testing that.

I make an initramfs with the following command:

dracut --lzmahostname.dracut.lzmakernel version

(obviously change --lzma to whatever type of compression your kernel
expects
to use and name the file whatever you want. Make sure to include the kernel
version just like it appears in your /lib/modules/ directory so that dracut
includes the correct kernel modules)

Then I make grub.conf look something like this:

root (hd0,0)
kernel /hostname  root=UUID=08b00d7f-b633-4c03-98fe-dd5942a8fb7e
initrd /hostname.dracut.lzma

I like to name my kernels and initramfs files by the hostname of the
computer since I have three that I manage but use whatever you want and
just
make sure you put the right filenames in grub.conf.

You can obtain the UUID of your root filesystem by a number of methods, but
the easiest is to use ls -l /dev/disks/by-uuid/

That's really all there is to it. Dracut will boot up and load the modules
it is compiled with and search through the disks, logical volumes, and
dmcrypt containers until it finds a filesystem with the UUID you specify.
Once it finds the root filesystem it mounts it with whatever options you've
specified in /etc/fstab and then hands control over to OpenRC.

If it has the necessary modules (kernel and dracut) and you pass the right
root= option then it Just Works.



 Dale copies to his Important folder 

I'm going to give this way a shot next time.  I'm downloading a lot of 
TV shows right now so can't reboot very often.


Thanks much for posting this tho.  This helps me a LOT.  With all the 
time I have on my hands, I really need to learn how to add things to all 
these wiki sites.


Dale

:-)  :-)

--
I am only responsible for what I said ... Not for what you understood or how 
you interpreted my words!