[dm-crypt] Boot from fully encrypted disk which looks like unused

dhvvcb at lavabit.com dhvvcb at lavabit.com
Sun May 22 17:53:02 CEST 2011


Using luks is the standard way of boot from an encrypted disk. However
luks header is not encrypted and it may cause a security issue when it
is necessary to hide the fact of encryption.

Usual section of grub.conf when root file system is placed on an
unencrypted disk has the form:

title Fedora 12
root (hd0,0)
kernel /boot/vmlinuz-2.6.31.12-174.2.3.fc12.i686.PAE ro root=/dev/sda1
LANG=ru_RU.UTF-8 SYSFONT=latarcyrheb-sun16 KEYBOARDTYPE=pc KEYTABLE=us
rhgb quiet
initrd /boot/initramfs-2.6.31.12-174.2.3.fc12.i686.PAE.img

Boot works.

After this I rsync this file system as a whole to a filesystem on an
encrypted virtual disk /dev/mapper/hdd2 corresponding to another
physical disk, for example /dev/sdb. Then I created an additional
section in grub.conf so as to make it possible to boot from /dev/sdb. It
looks the same as above, but with some distinctions. Location of
bootloader and kernel image is unchanged (1st sector and /boot
directory), only root filesystem is transferred onto an encrypted new
device.

title Fedora 12 NEW
root (hd0,0)
kernel /boot/vmlinuz-2.6.31.12-174.2.3.fc12.i686.PAE ro
root=/dev/mapper/hdd2 LANG=ru_RU.UTF-8 SYSFONT=latarcyrheb-sun16
KEYBOARDTYPE=pc KEYTABLE=us rhgb quiet
initrd /boot/initramfs-NEW.img

Two modifications of the initial section have been done:
1. root=/dev/sda1 ---> root=/dev/mapper/hdd2
2. initramfs-2.6.31.12-174.2.3.fc12.i686.PAE.img ---> initramfs-NEW.img

The second modification is needed to prepare /dev/mapper/hdd2 before
mounting it as a root filesystem. So changing initramfs is necessary. I
did it in the following way.

1. At the beginning of /mount/mount-root.sh, before 'mount' command, I
put the string:
cryptsetup -d /etc/key -c aes-cbc-essiv:sha256 -s 256 create
hdd2 /dev/sdb

2. key file is added to /etc

After this I reboot and select the second item in grub menu. During the
boot the messages appear:

WARNING: Deprecated config file /etc/modprobe.conf, all config files
belong into /etc/modprobe.d/.
(... the same string repeats a number of times ...)
No root device found
Boot has failed, sleeping forever 

Please, give me a suggestion what should I do to solve the problem.




More information about the dm-crypt mailing list