this post was submitted on 05 Sep 2024
19 points (95.2% liked)

Linux

5376 readers
34 users here now

A community for everything relating to the linux operating system

Also check out !linux_memes@programming.dev

Original icon base courtesy of lewing@isc.tamu.edu and The GIMP

founded 1 year ago
MODERATORS
Ategon@programming.dev
anzo@programming.dev
dwraf_of_ignorance@programming.dev
19
[Question] Encrypted Partition Unlock via Root Unlocking (programming.dev)
submitted 2 months ago by recursive_recursion@programming.dev to c/linux@programming.dev
9 comments fedilink hide all child comments
 

cross-posted from: https://programming.dev/post/19007507

For context:
I've encrypted the swap partition with:

cryptsetup -v luksFormat /dev/${DEVICE}
cryptsetup luksOpen /dev/${DEVICE} swap

And what I want is for the user to be able to enter their password only once to decrypt their root partition which would contain a keyfile to then decrypt their swap partition.

Does anyone know if this is possible?
Just thought I'd ask to see if anyone's done this already

Links:

you are viewing a single comment's thread
view the rest of the comments
[–] recursive_recursion@lemmy.ca 1 points 6 days ago* (last edited 6 days ago)

@Ooops@feddit.org @haroldstork@lemm.ee
Thank you for your LVM on LUKS suggestion!
I was able to get it to work with GRUB and now it works in the same way as systemd where only 1 password input is required🤗

What I found to work is creating 3 partitions:

  1. [p0] boot
  2. [p1] EFI
  3. [p2] Root [LVM on LUKS]

after encrypting and creating the required volumes on p2,

  • I formatted both p0 and p1 as FAT32
  • formatted rootvol as Btrfs
    • mount rootvol to /mnt
      • mount p0 to /mnt/boot
        • mount p1 to /mnt/boot/efi

Now that the base system is done I'm working on a Detached LUKS USB system to further optimize for security after in which I'd be satisfied in knowing that if others use it they'll most likely be safe from most security hazards