View source

'''Note: This guide is obsolete.  As of Debian 4.0 "etch", encrypted root partition support is now built into the [http://www.debian.org/releases/etch/debian-installer/ installer].'''

An encrypted root partition is a good idea for a laptop.  If the laptop is lost or stolen, the data cannot be recovered.  Of course, the downside is a master password must be entered each time the machine is booted.  In addition, etch can be set up to dynamically encrypt the swap partition using a different random key during each boot.  That way any memory swapped out to disk will become unreadable after the machine is halted.  Filesystem encryption has an unnoticable (but non-zero) performance hit, but there should be no perceived difference in system speed.

Finnix specifically is not required for encrypting your root partition (any LiveCD with dm-crypt will do), but it makes it rather easy to do.  This guide is specific to Debian testing "etch".

==Instructions==
1. Install etch as normal.  A couple of setup decisions are assumed:
* initramfs-tools is the needed initrd method, and is installed by default with debian-installer as of March 2006.  The alternative is yaird, and massive changes to the guide would be needed for a yaird installation.
* Do not use LVM.  The LVM initramfs scripts make certain assumptions about the root device that are not compatibile with this setup.
* A /boot partition is required, and will be left unencrypted.
* While technically multiple partitions could be used (/, /usr, /home, etc), it's not recommended, as you would have to type a decryption password for each partition.  This guide assumes a /boot partition at /dev/hda1, a swap partition at /dev/hda2 and a root (/) partition at /dev/hda3.  The root partition will be encrypted with a password of your choice, and the swap partition will be dynamically encrypted on each boot.
* If you are converting an existing etch system, kernel 2.6.15-1 is required (2.6.13 technically, but etch skipped from 2.6.12 directly to 2.6.15).

2. Create <tt>/etc/mkinitramfs/hooks/dmcrypt</tt>:
<code bash>#!/bin/sh

PREREQ=""

prereqs()
{
        echo "$PREREQ"
}

case $1 in
prereqs)
        prereqs
        exit 0
        ;;
esac

if [ ! -x /sbin/cryptsetup ]; then
        exit 0
fi

. /usr/share/initramfs-tools/hook-functions

copy_exec /sbin/cryptsetup /sbin

for x in dm_mod dm_crypt aes; do
        manual_add_modules ${x}
done</code>

3. Create <tt>/etc/mkinitramfs/scripts/local-top/dmcrypt</tt>:
<code bash>#!/bin/sh

PREREQ=""

prereqs()
{
        echo "$PREREQ"
}

case $1 in
# get pre-requisites
prereqs)
        prereqs
        exit 0
        ;;
esac

test -z "${crypt_root}" && exit
modprobe -q dm_crypt
modprobe -q aes
cryptsetup create root "${crypt_root}"</code>

4. Create <tt>/etc/rcS.d/S09cryptswap</tt> (it is important that it be named <tt>S09cryptswap</tt>; the encrypted swap device must be created before it is activated in <tt>S10checkroot.sh</tt>):
<code bash>#! /bin/sh

PATH=/sbin:/bin

case "$1" in
  start|"")
        cryptsetup -d /dev/random create swap /dev/hda2
        mkswap /dev/mapper/swap
        ;;
  restart|reload|force-reload)
        echo "Error: argument '$1' not supported" >&2
        exit 3
        ;;
  stop)
        # No-op
        ;;
  *)
        echo "Usage: checkroot.sh [start|stop]" >&2
        exit 3
        ;;
esac

:</code>

5. Make <tt>/etc/rcS.d/S09cryptswap</tt> executable:
<pre># chmod 755 /etc/rcS.d/S09cryptswap</pre>

6. Back up the original initrd and re-create it (replace 2.6.15-1-686 with your installed kernel):
<pre># mv /boot/initrd.img-2.6.15-1-686 /boot/initrd.img-2.6.15-1-686.old
# mkinitramfs -o /boot/initrd.img-2.6.15-1-686 2.6.15-1-686</pre>

7. Edit <tt>/boot/grub/menu.lst</tt> and look for the line that begins with "<tt># kopt=root=/dev/hda3</tt>".  Change <tt>root=/dev/hda3</tt> to <tt>root=/dev/mapper/root</tt>, and add <tt>crypt_root=/dev/hda3</tt> to the end of the line.  You should now have something that resembles this:
<pre>## default kernel options for automagic boot options
## If you want special options for specific kernels use kopt_x_y_z
## where x.y.z is kernel version. Minor versions can be omitted.
## e.g. kopt=root=/dev/hda1 ro
##      kopt_2_6_8=root=/dev/hdc1 ro
##      kopt_2_6_8_2_686=root=/dev/hdc2 ro
# kopt=root=/dev/mapper/root ro crypt_root=/dev/hda3</pre>

8. Save and exit <tt>/boot/grub/menu.lst</tt>.  Re-create the corresponding entries in the file:
<pre># update-grub</pre>

9. Edit <tt>/etc/fstab</tt> and change <tt>/dev/hda3</tt> to <tt>/dev/mapper/root</tt>, and <tt>/dev/hda2</tt> to <tt>/dev/mapper/swap</tt>.

10. Boot into Finnix and backup/re-create the root partition as an encrypted partition:
<pre>finnix# mkdir /mnt/x
finnix# mount /dev/hda3 /mnt/x
finnix# rsync -avzP -e ssh --numeric-ids /mnt/x/ root@otherhost:/backup-laptop/
finnix# umount /mnt/x
finnix# shred -n 1 -z -v /dev/hda3  # Optional, but recommended.  Increase -n value based on paranoia.
finnix# cryptsetup -y create root /dev/hda3
(enter desired password twice here)
finnix# mke2fs -j /dev/mapper/root
finnix# mount /dev/mapper/root /mnt/x
finnix# rsync -avzP -e ssh --numeric-ids root@otherhost:/backup-laptop/ /mnt/x/
finnix# umount /mnt/x
finnix# cryptsetup remove root</pre>

11. Reboot.  When the initrd begins, you will be asked for a password.  Enter the password you provided to encrypt the filesystem.  If you enter an incorrect password, the mount will fail, and you will have to reboot in order to try again.

[[Category:Tutorials]]