Full encrypted disk lvm on LUKS with encrypted /boot

Raspberry Pi 2

Full encrypted disk lvm on LUKS with encrypted /boot

Postby BavoV » Wed Jan 13, 2016 3:44 pm

What was I thinking when I decided to create a fully encrypted sd-card with lvm on LUKS with a encrypted boot partition. :mrgreen:

What do we have?
The install instructions ARM arch linux
The pavel instructions on encrypted boot: http://www.pavelkogan.com/2014/05/23/luks-full-disk-encryption/
The github instructions for an arm based RPI B model https://gist.github.com/pezz/5310082
and a lot of problems... :mrgreen:

$this->bbcode_second_pass_quote('', '[')b]Step 1
Secure wipe SD-card

*No problem *

Step 2
Make partitions acording to Pavel instructions under "Set up partitions (LVM on LUKS)"

*not sure the filesystems are ok for RPI 2*

step 3
Install Arch linux ARM acording to the install guide proveded at this website only step 4 and 5.

* ok, easy but mind the different use of /mnt and /root between this website and Pavel's instruction *


$this->bbcode_second_pass_quote('', '[')i]step 4
Change mkinitcpio.conf acording to Pavel instructions under "install linux"

*Problem: I can not run "mkinitcpio -p linux" *


The next steps are the problem as they are for x86 devices. Now I'm looking into "translate" them to Uboot or ARM v 7 specific bootloaders.

$this->bbcode_second_pass_quote('', '[')b]step 5
configure grub acording to Pavel instructions under "configure grub"

*Problem: I can not run "grub-mkconfig -o /boot/grub/grub.cfg" and
"grub-install /dev/sda"*

step 6
configure login once acording to Pavel instructions under "bonus: login once"


Nice to work on, but not easy to me.
BavoV
 
Posts: 5
Joined: Wed Jan 13, 2016 2:02 pm
Top

Re: Full encrypted disk lvm on LUKS with encrypted /boot

Postby Kabbone » Wed Jan 13, 2016 5:04 pm

I think since you can't use grub it's not possible
Kabbone
 
Posts: 153
Joined: Thu Jul 25, 2013 9:20 am

Re: Full encrypted disk lvm on LUKS with encrypted /boot

Postby thealchemist » Thu Jan 21, 2016 1:27 pm

I think pavels instructions are not appropriate, since it depends on GRUB but a quick search ("luks encryption raspberry pi") points to this Kali Linux based guide:
https://www.offensive-security.com/kali-linux/raspberry-pi-luks-disk-encryption/
I roughly read the guide and it seems to contain some holes (depends on qemu without further notification). But if we believe the author was able to do it before he wrote the instruction, it should be possible.

Concerning your step 4: Did you install mkinitcpio? I checked it on my RPI and it was not installed by default.

Tell us if you were successful!
thealchemist
 
Posts: 2
Joined: Thu Jan 21, 2016 12:53 pm

Re: Full encrypted disk lvm on LUKS with encrypted /boot

Postby Kabbone » Thu Jan 21, 2016 1:41 pm

In this tutorial /boot is still not encrypted or did I miss something? So there is except of the ssh decrypt no change to a normal rootfs LUKS encrypted setup.
Kabbone
 
Posts: 153
Joined: Thu Jul 25, 2013 9:20 am

Re: Full encrypted disk lvm on LUKS with encrypted /boot

Postby BavoV » Wed Jan 27, 2016 8:42 pm

Once I have set up again, i'll give the alchemist option a try. Looks doable.
BavoV
 
Posts: 5
Joined: Wed Jan 13, 2016 2:02 pm


Return to Broadcom

Who is online

Users browsing this forum: No registered users and 2 guests