个人工具

“UbuntuHelp:EncryptedFilesystemLVMHowto”的版本间的差异

来自Ubuntu中文

跳转至： 导航, 搜索
小
小
第2行： 第2行：
 
{{Languages|UbuntuHelp:EncryptedFilesystemLVMHowto}}
 
{{Languages|UbuntuHelp:EncryptedFilesystemLVMHowto}}
 
== Installing Ubuntu 7.04 on an Encrypted LVM Partition For Root, Swap, and Home ==
 
== Installing Ubuntu 7.04 on an Encrypted LVM Partition For Root, Swap, and Home ==
−
 
 
by Nico Gulden
 
by Nico Gulden
−
 
 
This howto describes the aspects to be noticed installing Ubuntu 7.04 on an encrypted LVM partition. It is based on the howto below written by John Bindel. It gave me the inspiration to try it with Ubuntu 7.04. The steps are basically the same as for Ubuntu 6.06.
 
This howto describes the aspects to be noticed installing Ubuntu 7.04 on an encrypted LVM partition. It is based on the howto below written by John Bindel. It gave me the inspiration to try it with Ubuntu 7.04. The steps are basically the same as for Ubuntu 6.06.
−
 
 
First of all, I want to thank John Bindel for the inspiration and Ilkka Tuohela for the right hint to get everything working.
 
First of all, I want to thank John Bindel for the inspiration and Ilkka Tuohela for the right hint to get everything working.
−
 
 
/boot is the only unencrypted partition. The other partitions all reside on one volume group in lvm. The physical volume below the volume group is configured on top an encrypted partition.
 
/boot is the only unencrypted partition. The other partitions all reside on one volume group in lvm. The physical volume below the volume group is configured on top an encrypted partition.
−
 
 
=== Preparation with the live-cd ===
 
=== Preparation with the live-cd ===
−
 
 
Follow the steps outline below for Ubuntu 6.06 using the Ubuntu 7.04 desktop install disk. Partition your harddisc using some partition editor, fdisk or System->Administration->Gnome Partition Editor. Make one partition of 100MB for /boot which is sda1 in this example. Create an extended partition for the left space on the disc. Create a logical partition with rest of the created extended partition, sda5 in this example.  
 
Follow the steps outline below for Ubuntu 6.06 using the Ubuntu 7.04 desktop install disk. Partition your harddisc using some partition editor, fdisk or System->Administration->Gnome Partition Editor. Make one partition of 100MB for /boot which is sda1 in this example. Create an extended partition for the left space on the disc. Create a logical partition with rest of the created extended partition, sda5 in this example.  
−
 
 
For further preparation you'll need a working internet connection. John suggested installing Ubuntu on an unencrypted primary partition. I did all necessary preparation with the live cd. First you'll need to edit your /etc/apt/sources.list and uncomment the universe repository entries, update your package list and install cryptsetup, initramfs-tools, hashalot, lvm2.
 
For further preparation you'll need a working internet connection. John suggested installing Ubuntu on an unencrypted primary partition. I did all necessary preparation with the live cd. First you'll need to edit your /etc/apt/sources.list and uncomment the universe repository entries, update your package list and install cryptsetup, initramfs-tools, hashalot, lvm2.
−
 
 
You should activate the universe repository in your /etc/apt/sources.list
 
You should activate the universe repository in your /etc/apt/sources.list
−
 
 
<pre><nowiki>
 
<pre><nowiki>
 
# sudo aptitude update
 
# sudo aptitude update
 
# sudo aptitude -y install cryptsetup initramfs-tools hashalot lvm2
 
# sudo aptitude -y install cryptsetup initramfs-tools hashalot lvm2
 
</nowiki></pre>
 
</nowiki></pre>
−
 
 
After installing the needed packages, your are ready for the setup of lvm2 on your hard disk. Before you can start, you need to load the following modules:
 
After installing the needed packages, your are ready for the setup of lvm2 on your hard disk. Before you can start, you need to load the following modules:
−
 
 
<pre><nowiki>
 
<pre><nowiki>
 
# sudo modprobe aes-i586
 
# sudo modprobe aes-i586
第31行： 第20行：
 
# sudo modprobe dm-mod
 
# sudo modprobe dm-mod
 
</nowiki></pre>
 
</nowiki></pre>
−
 
 
==== Encrypt data partition ====
 
==== Encrypt data partition ====
−
 
 
From John's Tutorial:
 
From John's Tutorial:
−
 
 
>>>
 
>>>
 
''Check the future encrypted LVM physical partition for errors. This will take several minutes for each partition. This fills each partition with pseudorandom data from the not-so-random libc pseudorandom source''
 
''Check the future encrypted LVM physical partition for errors. This will take several minutes for each partition. This fills each partition with pseudorandom data from the not-so-random libc pseudorandom source''
−
 
 
<pre><nowiki>
 
<pre><nowiki>
 
# sudo /sbin/badblocks -c 10240 -s -w -t random -v /dev/sda5
 
# sudo /sbin/badblocks -c 10240 -s -w -t random -v /dev/sda5
 
</nowiki></pre>
 
</nowiki></pre>
−
 
 
''Fill the partitions with random data. This may take '''MANY''' hours for the large partitions, on average 1.6M/sec of data is written to disk, so a 10GB partition might take around 2 hours, and 100GB partition might take a bit under 20 hours. . The /dev/urandom source is a good source of randomization that should prevent attackers from being able to determine where data actually resides on the encrypted filesystem, which would help them know what they should try to decrypt. The /dev/random source is even better, but it might take hundreds of years to fill the disk from it.''
 
''Fill the partitions with random data. This may take '''MANY''' hours for the large partitions, on average 1.6M/sec of data is written to disk, so a 10GB partition might take around 2 hours, and 100GB partition might take a bit under 20 hours. . The /dev/urandom source is a good source of randomization that should prevent attackers from being able to determine where data actually resides on the encrypted filesystem, which would help them know what they should try to decrypt. The /dev/random source is even better, but it might take hundreds of years to fill the disk from it.''
−
 
 
<pre><nowiki>
 
<pre><nowiki>
 
# sudo dd if=/dev/urandom of=/dev/sda5
 
# sudo dd if=/dev/urandom of=/dev/sda5
 
</nowiki></pre>
 
</nowiki></pre>
 
<<<
 
<<<
−
 
 
In the next step you create the encryption on the logical partition and unlock the partition.
 
In the next step you create the encryption on the logical partition and unlock the partition.
 
<pre><nowiki>
 
<pre><nowiki>
第56行： 第38行：
 
========
 
========
 
This will overwrite data on /dev/sda5 irrevocably.
 
This will overwrite data on /dev/sda5 irrevocably.
−
 
 
Are you sure? (Type uppercase yes): YES
 
Are you sure? (Type uppercase yes): YES
 
Enter LUKS passphrase: (enter passphrase)
 
Enter LUKS passphrase: (enter passphrase)
 
Verify passphrase: (repeat passphrase)
 
Verify passphrase: (repeat passphrase)
−
 
 
# sudo cryptsetup luksOpen /dev/sda5 pvcrypt
 
# sudo cryptsetup luksOpen /dev/sda5 pvcrypt
 
</nowiki></pre>
 
</nowiki></pre>
−
 
 
==== Create LVM ====
 
==== Create LVM ====
−
 
 
Create a physical volume and on top of that the volume group with all necessary logical volumes.  
 
Create a physical volume and on top of that the volume group with all necessary logical volumes.  
 
<pre><nowiki>
 
<pre><nowiki>
第72行： 第50行：
 
# sudo lvcreate -n <lvname> -L <size> vg
 
# sudo lvcreate -n <lvname> -L <size> vg
 
</nowiki></pre>
 
</nowiki></pre>
−
 
 
Create logical volumes for /usr, /home/, /tmp, /var, /opt, root and swap using the lvcreate command according to the mentioned schema. Make sure you don't use any special characters like underscores or hyphens for the logical volume name. That will generate problems in the later setup.
 
Create logical volumes for /usr, /home/, /tmp, /var, /opt, root and swap using the lvcreate command according to the mentioned schema. Make sure you don't use any special characters like underscores or hyphens for the logical volume name. That will generate problems in the later setup.
−
 
 
I got the following setup for my logical volumes.
 
I got the following setup for my logical volumes.
 
<pre><nowiki>
 
<pre><nowiki>
第86行： 第62行：
 
var        vg  -wi-ao  1,00G
 
var        vg  -wi-ao  1,00G
 
</nowiki></pre>
 
</nowiki></pre>
−
 
 
Put a filesystem on each logical volume. Replace <lvname> with each logical volume name you used creating you logical volumes.
 
Put a filesystem on each logical volume. Replace <lvname> with each logical volume name you used creating you logical volumes.
 
<pre><nowiki>
 
<pre><nowiki>
第92行： 第67行：
 
# sudo mkfs.ext3 /dev/mapper/vg-<lvname>
 
# sudo mkfs.ext3 /dev/mapper/vg-<lvname>
 
</nowiki></pre>
 
</nowiki></pre>
−
 
 
=== Install Ubuntu ===
 
=== Install Ubuntu ===
−
 
 
Begin the installation of Ubuntu by clicking on the install icon on the desktop of the livecd. Follow the steps in the wizard until step four where it comes to the preparation of the hard disk. Choose manual partitioning, because you already have created all necessary partitions. You just need to map the partitions to the appropriate mount points, choose a filesystem and let the installer create the filesystem.
 
Begin the installation of Ubuntu by clicking on the install icon on the desktop of the livecd. Follow the steps in the wizard until step four where it comes to the preparation of the hard disk. Choose manual partitioning, because you already have created all necessary partitions. You just need to map the partitions to the appropriate mount points, choose a filesystem and let the installer create the filesystem.
 
'''MAKE SURE YOU MAP /dev/sda1 to /boot'''
 
'''MAKE SURE YOU MAP /dev/sda1 to /boot'''
−
 
 
The next steps will continue just as an usual installation.
 
The next steps will continue just as an usual installation.
−
 
 
=== Final preparation ===
 
=== Final preparation ===
−
 
 
After the installation using the wizard, there are some steps to fulfill in order to let your fresh installed ubuntu come up correctly.
 
After the installation using the wizard, there are some steps to fulfill in order to let your fresh installed ubuntu come up correctly.
−
 
 
The following steps have to be followed:
 
The following steps have to be followed:
 
* Mount partitions & chroot
 
* Mount partitions & chroot
第109行： 第78行：
 
* Customize /etc/crypttab, /etc/fstab, /boot/grub/menu.lst
 
* Customize /etc/crypttab, /etc/fstab, /boot/grub/menu.lst
 
* Rebuild ramdisk
 
* Rebuild ramdisk
−
 
 
==== Mount Partitions & chroot ====
 
==== Mount Partitions & chroot ====
−
 
 
<pre><nowiki>
 
<pre><nowiki>
 
# cd /mnt
 
# cd /mnt
第123行： 第90行：
 
# sudo mount -t ext3 /dev/mapper/vg-tmp /mnt/root/tmp
 
# sudo mount -t ext3 /dev/mapper/vg-tmp /mnt/root/tmp
 
</nowiki></pre>
 
</nowiki></pre>
−
 
 
Chroot
 
Chroot
 
<pre><nowiki>
 
<pre><nowiki>
第130行： 第96行：
 
#(chroot) sudo mount -t sysfs sys /sys
 
#(chroot) sudo mount -t sysfs sys /sys
 
</nowiki></pre>
 
</nowiki></pre>
−
 
 
==== Install missing software ====
 
==== Install missing software ====
−
 
 
<pre><nowiki>
 
<pre><nowiki>
 
#(chroot) sudo aptitude update
 
#(chroot) sudo aptitude update
 
#(chroot) sudo aptitude install cryptsetup hashalot initramfs-tools lvm2
 
#(chroot) sudo aptitude install cryptsetup hashalot initramfs-tools lvm2
 
</nowiki></pre>
 
</nowiki></pre>
−
 
 
==== Customize files ====
 
==== Customize files ====
−
 
 
Edit /etc/crypttab and enter the following line.
 
Edit /etc/crypttab and enter the following line.
 
<pre><nowiki>
 
<pre><nowiki>
第145行： 第107行：
 
pvcrypt /dev/sda5 none luks,retry=1,lvm=vg
 
pvcrypt /dev/sda5 none luks,retry=1,lvm=vg
 
</nowiki></pre>
 
</nowiki></pre>
−
 
 
You recognize the target name and the source device name. It comes from the cryptsetup luksOpen /dev/sda5 pvcrypt command. With the options you tell cryptsetup that it shall use the volume group name vg in this example.
 
You recognize the target name and the source device name. It comes from the cryptsetup luksOpen /dev/sda5 pvcrypt command. With the options you tell cryptsetup that it shall use the volume group name vg in this example.
−
 
 
According to the example your /etc/fstab should look like this
 
According to the example your /etc/fstab should look like this
 
<pre><nowiki>
 
<pre><nowiki>
第165行： 第125行：
 
/dev/fd0         /media/floppy0  auto    rw,user,noauto  0      0
 
/dev/fd0         /media/floppy0  auto    rw,user,noauto  0      0
 
</nowiki></pre>
 
</nowiki></pre>
−
 
 
Your /boot/grub/menu.lst should have the following or similar entry
 
Your /boot/grub/menu.lst should have the following or similar entry
 
<pre><nowiki>
 
<pre><nowiki>
第175行： 第134行：
 
savedefault
 
savedefault
 
</nowiki></pre>
 
</nowiki></pre>
−
 
 
==== Rebuild ramdisk ====
 
==== Rebuild ramdisk ====
−
 
 
Edit the file /etc/initramfs-tools/modules to make sure the correct modules are included in the ramdisk
 
Edit the file /etc/initramfs-tools/modules to make sure the correct modules are included in the ramdisk
 
<pre><nowiki>
 
<pre><nowiki>
第185行： 第142行：
 
sha256
 
sha256
 
</nowiki></pre>
 
</nowiki></pre>
−
 
 
Run the following command to rebuild the ramdisk.
 
Run the following command to rebuild the ramdisk.
 
<pre><nowiki>
 
<pre><nowiki>
 
# sudo update-initramfs -k all -c
 
# sudo update-initramfs -k all -c
 
</nowiki></pre>
 
</nowiki></pre>
−
 
 
After building the ramdisk it should be checked.
 
After building the ramdisk it should be checked.
 
<pre><nowiki>
 
<pre><nowiki>
第199行： 第154行：
 
#(chroot) sudo cat /tmp/foo/conf/conf.d/cryptroot
 
#(chroot) sudo cat /tmp/foo/conf/conf.d/cryptroot
 
</nowiki></pre>
 
</nowiki></pre>
−
 
 
If initramfs-cryptsetup did not understand the setup, the /tmp/foo/conf/conf.d/cryptroot file is completely missing and it does not make even sense to try booting. The lvm lines here are just names it expects to be available after setup and really don't matter in your case.
 
If initramfs-cryptsetup did not understand the setup, the /tmp/foo/conf/conf.d/cryptroot file is completely missing and it does not make even sense to try booting. The lvm lines here are just names it expects to be available after setup and really don't matter in your case.
−
 
 
If everything went fine and the /tmp/foo/conf/conf.d/cryptroot is present you should give a try and reboot. Right at the beginning of the boot process you should be asked for the physical volume password.
 
If everything went fine and the /tmp/foo/conf/conf.d/cryptroot is present you should give a try and reboot. Right at the beginning of the boot process you should be asked for the physical volume password.
−
 
 
=== Booting fails ===
 
=== Booting fails ===
−
 
 
If booting fails and you need to rebuild the ramdisk or fix some configuration files, follow these steps. I assume you know the details, therefore they are just outline.
 
If booting fails and you need to rebuild the ramdisk or fix some configuration files, follow these steps. I assume you know the details, therefore they are just outline.
 
* Boot the ubuntu live cd
 
* Boot the ubuntu live cd
第215行： 第166行：
 
* Chroot into /mnt/root and mount proc and sysfs
 
* Chroot into /mnt/root and mount proc and sysfs
 
* Make your changes
 
* Make your changes
−
 
 
=== Some Notes ===
 
=== Some Notes ===
−
 
 
* Suspend or suspend2 don't work with this configuration. If you have a working configuration with suspend or suspend2, please append to this article or post a separate one. There might be some people out there looking for it. Thanks.
 
* Suspend or suspend2 don't work with this configuration. If you have a working configuration with suspend or suspend2, please append to this article or post a separate one. There might be some people out there looking for it. Thanks.
−
 
−
 
 
== Installing Ubuntu 6.06 on an Encrypted LVM Partition For Root, Swap, and Home ==
 
== Installing Ubuntu 6.06 on an Encrypted LVM Partition For Root, Swap, and Home ==
−
 
 
by John Bindel ([email protected])
 
by John Bindel ([email protected])
−
 
 
This how-to explains the process of installing Ubuntu 6.06 on an encrypted LVM partition.  One encrypted physical partition is used, and the logical volume manager is used to manage the operating system volumes.  Only /boot is unencrypted.
 
This how-to explains the process of installing Ubuntu 6.06 on an encrypted LVM partition.  One encrypted physical partition is used, and the logical volume manager is used to manage the operating system volumes.  Only /boot is unencrypted.
−
 
 
=== Install ===
 
=== Install ===
−
 
 
Boot the Ubuntu 6.06 desktop install disk.
 
Boot the Ubuntu 6.06 desktop install disk.
−
 
 
Partition the disk with System->Administration->Gnome Partition Editor
 
Partition the disk with System->Administration->Gnome Partition Editor
−
 
 
Make 3GB ext3 primary partition (See NOTES at the bottom if you want to save room and use the server version, which only needs 600 MB).  Make an
 
Make 3GB ext3 primary partition (See NOTES at the bottom if you want to save room and use the server version, which only needs 600 MB).  Make an
 
extended partition with the rest.  Make an ext3 logical partition of
 
extended partition with the rest.  Make an ext3 logical partition of
 
200MB for /boot which is sda5 in this example.  Make an ext3 logical parition with the rest as sda6.  Click
 
200MB for /boot which is sda5 in this example.  Make an ext3 logical parition with the rest as sda6.  Click
 
"apply" and then close the tool.  It would be nice to install directly to encrypted LVM volumes, but the desktop installer does not seem to be capable of that.  It fails after the manual paritioning step when I have tried.
 
"apply" and then close the tool.  It would be nice to install directly to encrypted LVM volumes, but the desktop installer does not seem to be capable of that.  It fails after the manual paritioning step when I have tried.
−
 
 
Double-click on "Install".
 
Double-click on "Install".
−
 
 
Choose to manually edit partitions.  Make no changes to partitions and
 
Choose to manually edit partitions.  Make no changes to partitions and
 
click "forward".  Set /dev/sda5 as the /boot mount point and /dev/sda1
 
click "forward".  Set /dev/sda5 as the /boot mount point and /dev/sda1
 
as the "/" mount point.  Clear all other mount points.  Select
 
as the "/" mount point.  Clear all other mount points.  Select
 
reformat on these two and click "forward".  Then click "install".
 
reformat on these two and click "forward".  Then click "install".
−
 
 
Click "continue" when asked about not having a swap partition. We'll
 
Click "continue" when asked about not having a swap partition. We'll
 
add one later.
 
add one later.
−
 
 
Let the system install and then reboot.
 
Let the system install and then reboot.
−
 
 
Open a terminal and get root.
 
Open a terminal and get root.
−
 
 
<code><nowiki>$ sudo bash</nowiki></code>
 
<code><nowiki>$ sudo bash</nowiki></code>
−
 
 
Add "universe" repositories by uncommenting lines in /etc/apt/sources.list.
 
Add "universe" repositories by uncommenting lines in /etc/apt/sources.list.
−
 
 
Install the cryptsetup, hashalot, and initramfs-tools packages.
 
Install the cryptsetup, hashalot, and initramfs-tools packages.
−
 
 
<pre><nowiki># apt-get update
 
<pre><nowiki># apt-get update
 
# apt-get install cryptsetup hashalot initramfs-tools</nowiki></pre>
 
# apt-get install cryptsetup hashalot initramfs-tools</nowiki></pre>
−
 
 
=== Build an initrd image ===
 
=== Build an initrd image ===
−
 
 
Load the modules that will be needed.
 
Load the modules that will be needed.
−
 
 
<pre><nowiki># modprobe dm_crypt
 
<pre><nowiki># modprobe dm_crypt
 
# modprobe aes_i586
 
# modprobe aes_i586
 
# modprobe sha256</nowiki></pre>
 
# modprobe sha256</nowiki></pre>
−
 
 
Add the following line to /etc/kernel-img.conf:
 
Add the following line to /etc/kernel-img.conf:
−
 
 
<code><nowiki>ramdisk = /usr/sbin/mkinitramfs</nowiki></code>
 
<code><nowiki>ramdisk = /usr/sbin/mkinitramfs</nowiki></code>
−
 
 
Add the following lines to /etc/mkinitramfs/modules:
 
Add the following lines to /etc/mkinitramfs/modules:
−
 
 
<pre><nowiki>dm_mod
 
<pre><nowiki>dm_mod
 
dm_crypt
 
dm_crypt
 
sha256
 
sha256
 
aes_i586</nowiki></pre>
 
aes_i586</nowiki></pre>
−
 
 
Create file /etc/mkinitramfs/hooks/pvcrypt.  This script is executed
 
Create file /etc/mkinitramfs/hooks/pvcrypt.  This script is executed
 
when the init ramdisk image is built.
 
when the init ramdisk image is built.
−
 
 
<pre><nowiki>
 
<pre><nowiki>
 
#!/bin/sh
 
#!/bin/sh
−
 
 
PREREQ=""
 
PREREQ=""
−
 
 
prereqs()
 
prereqs()
 
{
 
{
 
echo "$PREREQ"
 
echo "$PREREQ"
 
}
 
}
−
 
 
case $1 in
 
case $1 in
 
prereqs)
 
prereqs)
第299行： 第219行：
 
;;
 
;;
 
esac
 
esac
−
 
 
if [ ! -x /sbin/cryptsetup ]; then
 
if [ ! -x /sbin/cryptsetup ]; then
 
exit 0
 
exit 0
 
fi
 
fi
−
 
 
. /usr/share/initramfs-tools/hook-functions
 
. /usr/share/initramfs-tools/hook-functions
−
 
 
mkdir ${DESTDIR}/etc/console
 
mkdir ${DESTDIR}/etc/console
 
cp /etc/console/boottime.kmap.gz ${DESTDIR}/etc/console
 
cp /etc/console/boottime.kmap.gz ${DESTDIR}/etc/console
第311行： 第228行：
 
copy_exec /usr/bin/chvt /bin
 
copy_exec /usr/bin/chvt /bin
 
copy_exec /sbin/cryptsetup /sbin</nowiki></pre>
 
copy_exec /sbin/cryptsetup /sbin</nowiki></pre>
−
 
 
Create file /etc/mkinitramfs/scripts/local-top/pvcrypt.  This script
 
Create file /etc/mkinitramfs/scripts/local-top/pvcrypt.  This script
 
is executed during the init bootup.
 
is executed during the init bootup.
−
 
 
<pre><nowiki>
 
<pre><nowiki>
 
#!/bin/sh
 
#!/bin/sh
−
 
 
PREREQ="udev"
 
PREREQ="udev"
−
 
 
prereqs()
 
prereqs()
 
{
 
{
 
echo "$PREREQ"
 
echo "$PREREQ"
 
}
 
}
−
 
 
case $1 in
 
case $1 in
 
# get pre-requisites
 
# get pre-requisites
第332行： 第244行：
 
;;
 
;;
 
esac
 
esac
−
 
 
/bin/loadkeys /etc/console/boottime.kmap.gz
 
/bin/loadkeys /etc/console/boottime.kmap.gz
 
modprobe -Qb dm_crypt
 
modprobe -Qb dm_crypt
第345行： 第256行：
 
sleep 1
 
sleep 1
 
fi</nowiki></pre>
 
fi</nowiki></pre>
−
 
 
Make these scripts executable by root.
 
Make these scripts executable by root.
−
 
 
<pre><nowiki># chmod +x /etc/mkinitramfs/hooks/pvcrypt
 
<pre><nowiki># chmod +x /etc/mkinitramfs/hooks/pvcrypt
 
# chmod +x /etc/mkinitramfs/scripts/local-top/pvcrypt</nowiki></pre>
 
# chmod +x /etc/mkinitramfs/scripts/local-top/pvcrypt</nowiki></pre>
−
 
−
 
 
Now build a new initrd image:
 
Now build a new initrd image:
−
 
 
<code><nowiki># update-initramfs -u ALL</nowiki></code>
 
<code><nowiki># update-initramfs -u ALL</nowiki></code>
−
 
−
 
 
=== Encrypt the data partition ===
 
=== Encrypt the data partition ===
−
 
 
Check the future encrypted LVM physical partition for errors.  This will take several minutes for each partition. This fills each partition with pseudorandom data from the not-so-random libc pseudorandom sourc
 
Check the future encrypted LVM physical partition for errors.  This will take several minutes for each partition. This fills each partition with pseudorandom data from the not-so-random libc pseudorandom sourc
−
 
 
<code><nowiki># /sbin/badblocks -c 10240 -s -w -t random -v /dev/sda6</nowiki></code>
 
<code><nowiki># /sbin/badblocks -c 10240 -s -w -t random -v /dev/sda6</nowiki></code>
−
 
 
Fill the partitions with random data. This may take 4 hours for the large partition.  The /dev/urandom source is a good source of randomization that should prevent attackers from being able to determine where data actually resides on the encrypted filesystem, which would help them know what they should try to decrypt. The /dev/random source is even better, but it might take hundreds of years to fill the disk from it.
 
Fill the partitions with random data. This may take 4 hours for the large partition.  The /dev/urandom source is a good source of randomization that should prevent attackers from being able to determine where data actually resides on the encrypted filesystem, which would help them know what they should try to decrypt. The /dev/random source is even better, but it might take hundreds of years to fill the disk from it.
−
 
 
<code><nowiki># dd if=/dev/urandom of=/dev/sda6</nowiki></code>
 
<code><nowiki># dd if=/dev/urandom of=/dev/sda6</nowiki></code>
−
 
 
Create the encryption key for the partition.
 
Create the encryption key for the partition.
−
 
 
<pre><nowiki># cryptsetup --verify-passphrase --verbose --hash=sha256 --cipher=aes-cbc-essiv:sha256 --key-size=256 luksFormat /dev/sda6
 
<pre><nowiki># cryptsetup --verify-passphrase --verbose --hash=sha256 --cipher=aes-cbc-essiv:sha256 --key-size=256 luksFormat /dev/sda6
 
# cryptsetup luksOpen /dev/sda6 pvcrypt</nowiki></pre>
 
# cryptsetup luksOpen /dev/sda6 pvcrypt</nowiki></pre>
−
 
 
Make an LVM physical volume, volume group, and logical volumes on the
 
Make an LVM physical volume, volume group, and logical volumes on the
 
encrypted partition.  The size of 9938 happens to be how much is left
 
encrypted partition.  The size of 9938 happens to be how much is left
 
on my logical partition.
 
on my logical partition.
−
 
 
<pre><nowiki># pvcreate /dev/mapper/pvcrypt
 
<pre><nowiki># pvcreate /dev/mapper/pvcrypt
 
Physical volume "/dev/mapper/pvcrypt" successfully created
 
Physical volume "/dev/mapper/pvcrypt" successfully created
第386行： 第282行：
 
# lvcreate -n lvhome -l 9938 vgcrypt
 
# lvcreate -n lvhome -l 9938 vgcrypt
 
Logical volume "lvhome" created</nowiki></pre>
 
Logical volume "lvhome" created</nowiki></pre>
−
 
 
Put a filesystem on each volume.
 
Put a filesystem on each volume.
−
 
 
<pre><nowiki># mkfs.ext3 /dev/mapper/vgcrypt-lvroot
 
<pre><nowiki># mkfs.ext3 /dev/mapper/vgcrypt-lvroot
 
# mkfs.ext3 /dev/mapper/vgcrypt-lvhome
 
# mkfs.ext3 /dev/mapper/vgcrypt-lvhome
 
# mkswap /dev/mapper/vgcrypt-lvswap</nowiki></pre>
 
# mkswap /dev/mapper/vgcrypt-lvswap</nowiki></pre>
−
 
 
Populate the encrypted volumes.
 
Populate the encrypted volumes.
−
 
 
<pre><nowiki># mkdir /mnt/root
 
<pre><nowiki># mkdir /mnt/root
 
# mkdir /mnt/home
 
# mkdir /mnt/home
第402行： 第294行：
 
# rm -rf /mnt/root/home/*
 
# rm -rf /mnt/root/home/*
 
# cp -ax /home/* /mnt/home</nowiki></pre>
 
# cp -ax /home/* /mnt/home</nowiki></pre>
−
 
 
Edit /mnt/root/etc/fstab.  First change this line
 
Edit /mnt/root/etc/fstab.  First change this line
−
 
 
<code><nowiki>/dev/sda1 / ext3 defaults,errors=remount-ro 0 1</nowiki></code>
 
<code><nowiki>/dev/sda1 / ext3 defaults,errors=remount-ro 0 1</nowiki></code>
−
 
 
to
 
to
−
 
 
<code><nowiki>/dev/mapper/vgcrypt-lvroot / ext3 defaults,errors=remount-ro 0 1</nowiki></code>
 
<code><nowiki>/dev/mapper/vgcrypt-lvroot / ext3 defaults,errors=remount-ro 0 1</nowiki></code>
−
 
 
And add these lines:
 
And add these lines:
−
 
 
<pre><nowiki>/dev/mapper/vgcrypt-lvhome /home ext3 defaults 0 1
 
<pre><nowiki>/dev/mapper/vgcrypt-lvhome /home ext3 defaults 0 1
 
/dev/mapper/vgcrypt-lvswap none swap sw 0 0</nowiki></pre>
 
/dev/mapper/vgcrypt-lvswap none swap sw 0 0</nowiki></pre>
−
 
 
Add this to the bottom of /boot/grub/menu.lst.  (hd0,4) refers to the
 
Add this to the bottom of /boot/grub/menu.lst.  (hd0,4) refers to the
 
boot partition, /dev/sda5.
 
boot partition, /dev/sda5.
−
 
 
<pre><nowiki>title          Cryptotest
 
<pre><nowiki>title          Cryptotest
 
root            (hd0,4)
 
root            (hd0,4)
第425行： 第309行：
 
savedefault
 
savedefault
 
boot</nowiki></pre>
 
boot</nowiki></pre>
−
 
 
Check the kernel version with <code><nowiki>uname -r</nowiki></code>.  For example, it may be "2.6.15-26-server".
 
Check the kernel version with <code><nowiki>uname -r</nowiki></code>.  For example, it may be "2.6.15-26-server".
−
 
 
Reboot to test by typing <code><nowiki>sudo reboot</nowiki></code>.  Press ESC to enter the GRUB
 
Reboot to test by typing <code><nowiki>sudo reboot</nowiki></code>.  Press ESC to enter the GRUB
 
menu and select Cryptotest.  The boot process will stop waiting for
 
menu and select Cryptotest.  The boot process will stop waiting for
 
the encrypted partition's passphrase.  The prompt will probably be
 
the encrypted partition's passphrase.  The prompt will probably be
 
hard to see because of a lot of debugging information on the console.
 
hard to see because of a lot of debugging information on the console.
−
 
 
If all goes well, then continue.  Otherwise seek help or figure out
 
If all goes well, then continue.  Otherwise seek help or figure out
 
what went wrong.
 
what went wrong.
−
 
 
Edit /boot/grub/menu.lst to remove the lines we added at the end, and
 
Edit /boot/grub/menu.lst to remove the lines we added at the end, and
 
change the line that has
 
change the line that has
−
 
 
<code><nowiki># kopt=root=/dev/sda1 ro</nowiki></code>
 
<code><nowiki># kopt=root=/dev/sda1 ro</nowiki></code>
−
 
 
to
 
to
−
 
 
<code><nowiki># kopt=root=/dev/mapper/vgcrypt-lvroot ro</nowiki></code>
 
<code><nowiki># kopt=root=/dev/mapper/vgcrypt-lvroot ro</nowiki></code>
−
 
 
Then run
 
Then run
−
 
 
<code><nowiki>$sudo update-grub</nowiki></code>
 
<code><nowiki>$sudo update-grub</nowiki></code>
−
 
−
 
 
Finally make a backup key file for unencrypting the drive. Insert a
 
Finally make a backup key file for unencrypting the drive. Insert a
 
blank USB thumb drive.
 
blank USB thumb drive.
−
 
 
<pre><nowiki>$ sudo dd if=/dev/random of=/media/<usbdrive>/pvcrypt-$(whoami)-key bs=1 count=256
 
<pre><nowiki>$ sudo dd if=/dev/random of=/media/<usbdrive>/pvcrypt-$(whoami)-key bs=1 count=256
 
$ sudo cryptsetup luksAddKey /dev/sda6 /media/<usbdrive>/pvcrypt-$(whomai)-key</nowiki></pre>
 
$ sudo cryptsetup luksAddKey /dev/sda6 /media/<usbdrive>/pvcrypt-$(whomai)-key</nowiki></pre>
−
 
 
Wipe the old partition.
 
Wipe the old partition.
−
 
 
<code><nowiki># /sbin/badblocks -c 10240 -s -w -t random -v /dev/sda1</nowiki></code>
 
<code><nowiki># /sbin/badblocks -c 10240 -s -w -t random -v /dev/sda1</nowiki></code>
−
 
−
 
 
=== Notes ===
 
=== Notes ===
−
 
 
Those who do not want a large leftover partition on sda1 can make one
 
Those who do not want a large leftover partition on sda1 can make one
 
as small as 600MB and install the server version of Ubuntu instead, or
 
as small as 600MB and install the server version of Ubuntu instead, or
 
even make the /boot partition 600MB and just install the root partition there
 
even make the /boot partition 600MB and just install the root partition there
 
initially.
 
initially.
−
 
 
Gnome will popup a notice that it has found an encrypted
 
Gnome will popup a notice that it has found an encrypted
 
partition. Cancel the dialog. It seems that /sbin/partprobe causes
 
partition. Cancel the dialog. It seems that /sbin/partprobe causes

2007年11月30日 (五) 17:08的版本

Geographylogo.png 文章出处: 

https://help.ubuntu.com/community/EncryptedFilesystemLVMHowto

Geographylogo.png 点击翻译: 

English

请不要直接编辑翻译本页，本页将定期与来源同步。

Installing Ubuntu 7.04 on an Encrypted LVM Partition For Root, Swap, and Home

by Nico Gulden This howto describes the aspects to be noticed installing Ubuntu 7.04 on an encrypted LVM partition. It is based on the howto below written by John Bindel. It gave me the inspiration to try it with Ubuntu 7.04. The steps are basically the same as for Ubuntu 6.06. First of all, I want to thank John Bindel for the inspiration and Ilkka Tuohela for the right hint to get everything working. /boot is the only unencrypted partition. The other partitions all reside on one volume group in lvm. The physical volume below the volume group is configured on top an encrypted partition.

Preparation with the live-cd

Follow the steps outline below for Ubuntu 6.06 using the Ubuntu 7.04 desktop install disk. Partition your harddisc using some partition editor, fdisk or System->Administration->Gnome Partition Editor. Make one partition of 100MB for /boot which is sda1 in this example. Create an extended partition for the left space on the disc. Create a logical partition with rest of the created extended partition, sda5 in this example. For further preparation you'll need a working internet connection. John suggested installing Ubuntu on an unencrypted primary partition. I did all necessary preparation with the live cd. First you'll need to edit your /etc/apt/sources.list and uncomment the universe repository entries, update your package list and install cryptsetup, initramfs-tools, hashalot, lvm2. You should activate the universe repository in your /etc/apt/sources.list 

# sudo aptitude update
# sudo aptitude -y install cryptsetup initramfs-tools hashalot lvm2

After installing the needed packages, your are ready for the setup of lvm2 on your hard disk. Before you can start, you need to load the following modules: 

# sudo modprobe aes-i586
# sudo modprobe dm-crypt
# sudo modprobe dm-mod

Encrypt data partition

From John's Tutorial: >>> Check the future encrypted LVM physical partition for errors. This will take several minutes for each partition. This fills each partition with pseudorandom data from the not-so-random libc pseudorandom source 

# sudo /sbin/badblocks -c 10240 -s -w -t random -v /dev/sda5

Fill the partitions with random data. This may take MANY hours for the large partitions, on average 1.6M/sec of data is written to disk, so a 10GB partition might take around 2 hours, and 100GB partition might take a bit under 20 hours. . The /dev/urandom source is a good source of randomization that should prevent attackers from being able to determine where data actually resides on the encrypted filesystem, which would help them know what they should try to decrypt. The /dev/random source is even better, but it might take hundreds of years to fill the disk from it. 

# sudo dd if=/dev/urandom of=/dev/sda5

<<< In the next step you create the encryption on the logical partition and unlock the partition. 

# sudo cryptsetup -y --cipher aes-cbc-essiv:sha256 --key-size 256 luksFormat /dev/sda5
WARNING!
========
This will overwrite data on /dev/sda5 irrevocably.
Are you sure? (Type uppercase yes): YES
Enter LUKS passphrase: (enter passphrase)
Verify passphrase: (repeat passphrase)
# sudo cryptsetup luksOpen /dev/sda5 pvcrypt

Create LVM

Create a physical volume and on top of that the volume group with all necessary logical volumes. 

# sudo pvcreate /dev/mapper/pvcrypt
# sudo vgcreate vg /dev/mapper/pvcrypt
# sudo lvcreate -n <lvname> -L <size> vg

Create logical volumes for /usr, /home/, /tmp, /var, /opt, root and swap using the lvcreate command according to the mentioned schema. Make sure you don't use any special characters like underscores or hyphens for the logical volume name. That will generate problems in the later setup. I got the following setup for my logical volumes. 

# sudo lvdisplay -C
home       vg   -wi-ao  10,00G
swap       vg   -wi-ao 512,00M
opt        vg   -wi-ao 200,00M
root       vg   -wi-ao 300,00M
tmp        vg   -wi-ao 200,00M
usr        vg   -wi-ao   4,00G
var        vg   -wi-ao   1,00G

Put a filesystem on each logical volume. Replace <lvname> with each logical volume name you used creating you logical volumes. 

# sudo mkswap /dev/mapper/vg-swap
# sudo mkfs.ext3 /dev/mapper/vg-<lvname>

Install Ubuntu

Begin the installation of Ubuntu by clicking on the install icon on the desktop of the livecd. Follow the steps in the wizard until step four where it comes to the preparation of the hard disk. Choose manual partitioning, because you already have created all necessary partitions. You just need to map the partitions to the appropriate mount points, choose a filesystem and let the installer create the filesystem. MAKE SURE YOU MAP /dev/sda1 to /boot The next steps will continue just as an usual installation.

Final preparation

After the installation using the wizard, there are some steps to fulfill in order to let your fresh installed ubuntu come up correctly. The following steps have to be followed:

  • Mount partitions & chroot
  • Install missing software to fresh installed ubuntu
  • Customize /etc/crypttab, /etc/fstab, /boot/grub/menu.lst
  • Rebuild ramdisk

Mount Partitions & chroot

# cd /mnt
# sudo mkdir root
# sudo mount -t ext3 /dev/mapper/vg-root /mnt/root
# sudo mount -t ext3 /dev/sda1 /mnt/root/boot
# sudo mount -t ext3 /dev/mapper/vg-home /mnt/root/home
# sudo mount -t ext3 /dev/mapper/vg-opt /mnt/root/opt
# sudo mount -t ext3 /dev/mapper/vg-usr /mnt/root/usr
# sudo mount -t ext3 /dev/mapper/vg-var /mnt/root/var
# sudo mount -t ext3 /dev/mapper/vg-tmp /mnt/root/tmp

Chroot 

# sudo chroot /mnt/root
#(chroot) sudo mount -t proc proc /proc
#(chroot) sudo mount -t sysfs sys /sys

Install missing software

#(chroot) sudo aptitude update
#(chroot) sudo aptitude install cryptsetup hashalot initramfs-tools lvm2

Customize files

Edit /etc/crypttab and enter the following line. 

# <target name>		<source device>	<key file> 	<options>
pvcrypt		/dev/sda5	none		luks,retry=1,lvm=vg

You recognize the target name and the source device name. It comes from the cryptsetup luksOpen /dev/sda5 pvcrypt command. With the options you tell cryptsetup that it shall use the volume group name vg in this example. According to the example your /etc/fstab should look like this 

# /etc/fstab: static file system information.
#
# <file system> <mount point>   <type>  <options>       <dump>  <pass>
proc            		/proc           proc    defaults        0       0
/dev/mapper/vg-root 		/               ext3    defaults,errors=remount-ro 0       1
/dev/sda1			/boot		ext3	defaults	0	2
/dev/mapper/vg-home		/home           ext3    defaults        0       2
/dev/mapper/vg-opt		/opt            ext3    defaults        0       2
/dev/mapper/vg-tmp 		/tmp            ext3    defaults        0       2
/dev/mapper/vg-usr	 	/usr            ext3    defaults        0       2
/dev/mapper/vg-var	 	/var            ext3    defaults        0       2
/dev/mapper/vg-swap 		none            swap    sw              0       0
/dev/scd0       		/media/cdrom0   udf,iso9660 user,noauto     0       0
/dev/fd0		        /media/floppy0  auto    rw,user,noauto  0       0

Your /boot/grub/menu.lst should have the following or similar entry 

title	Ubuntu
root	(hd0,0)
kernel	/vmlinuz-2.6.20-16-generic root=/dev/mapper/vg-root ro quiet
initrd	/initrd.img-2.6.20-16-generic
quiet
savedefault

Rebuild ramdisk

Edit the file /etc/initramfs-tools/modules to make sure the correct modules are included in the ramdisk 

aes-i586
dm-crypt
dm-mod
sha256

Run the following command to rebuild the ramdisk. 

# sudo update-initramfs -k all -c

After building the ramdisk it should be checked. 

#(chroot) cd /tmp
#(chroot) sudo mkdir foo
#(chroot) cd foo/
#(chroot) sudo zcat /boot/initrd.img-$(uname -r)|cpio -iv
#(chroot) sudo cat /tmp/foo/conf/conf.d/cryptroot

If initramfs-cryptsetup did not understand the setup, the /tmp/foo/conf/conf.d/cryptroot file is completely missing and it does not make even sense to try booting. The lvm lines here are just names it expects to be available after setup and really don't matter in your case. If everything went fine and the /tmp/foo/conf/conf.d/cryptroot is present you should give a try and reboot. Right at the beginning of the boot process you should be asked for the physical volume password.

Booting fails

If booting fails and you need to rebuild the ramdisk or fix some configuration files, follow these steps. I assume you know the details, therefore they are just outline.

  • Boot the ubuntu live cd
  • Uncomment the universe repository in the sources.list, update the package list and install cryptsetup, initramfs-tools, hashalot, lvm2
  • modprobe the modules aes-i586, dm-crypt and dm-mod
  • Unlock the physical volume: cryptsetup luksOpen /dev/sda5 pvcrypt
  • Detect the logical volume: vgscan; vgchange -a y vg
  • Mount the partitions to /mnt/root
  • Chroot into /mnt/root and mount proc and sysfs
  • Make your changes

Some Notes

  • Suspend or suspend2 don't work with this configuration. If you have a working configuration with suspend or suspend2, please append to this article or post a separate one. There might be some people out there looking for it. Thanks.

Installing Ubuntu 6.06 on an Encrypted LVM Partition For Root, Swap, and Home

by John Bindel ([email protected]) This how-to explains the process of installing Ubuntu 6.06 on an encrypted LVM partition. One encrypted physical partition is used, and the logical volume manager is used to manage the operating system volumes. Only /boot is unencrypted.

Install

Boot the Ubuntu 6.06 desktop install disk. Partition the disk with System->Administration->Gnome Partition Editor Make 3GB ext3 primary partition (See NOTES at the bottom if you want to save room and use the server version, which only needs 600 MB). Make an extended partition with the rest. Make an ext3 logical partition of 200MB for /boot which is sda5 in this example. Make an ext3 logical parition with the rest as sda6. Click "apply" and then close the tool. It would be nice to install directly to encrypted LVM volumes, but the desktop installer does not seem to be capable of that. It fails after the manual paritioning step when I have tried. Double-click on "Install". Choose to manually edit partitions. Make no changes to partitions and click "forward". Set /dev/sda5 as the /boot mount point and /dev/sda1 as the "/" mount point. Clear all other mount points. Select reformat on these two and click "forward". Then click "install". Click "continue" when asked about not having a swap partition. We'll add one later. Let the system install and then reboot. Open a terminal and get root. $ sudo bash Add "universe" repositories by uncommenting lines in /etc/apt/sources.list. Install the cryptsetup, hashalot, and initramfs-tools packages. 

# apt-get update
# apt-get install cryptsetup hashalot initramfs-tools

Build an initrd image

Load the modules that will be needed. 

# modprobe dm_crypt
# modprobe aes_i586
# modprobe sha256

Add the following line to /etc/kernel-img.conf: ramdisk = /usr/sbin/mkinitramfs Add the following lines to /etc/mkinitramfs/modules: 

dm_mod
dm_crypt
sha256
aes_i586

Create file /etc/mkinitramfs/hooks/pvcrypt. This script is executed when the init ramdisk image is built. 

#!/bin/sh
PREREQ=""
prereqs()
{
echo "$PREREQ"
}
case $1 in
prereqs)
prereqs
exit 0
;;
esac
if [ ! -x /sbin/cryptsetup ]; then
exit 0
fi
. /usr/share/initramfs-tools/hook-functions
mkdir ${DESTDIR}/etc/console
cp /etc/console/boottime.kmap.gz ${DESTDIR}/etc/console
copy_exec /bin/loadkeys /bin
copy_exec /usr/bin/chvt /bin
copy_exec /sbin/cryptsetup /sbin

Create file /etc/mkinitramfs/scripts/local-top/pvcrypt. This script is executed during the init bootup. 

#!/bin/sh
PREREQ="udev"
prereqs()
{
echo "$PREREQ"
}
case $1 in
# get pre-requisites
prereqs)
prereqs
exit 0
;;
esac
/bin/loadkeys /etc/console/boottime.kmap.gz
modprobe -Qb dm_crypt
modprobe -Qb aes_i586
modprobe -Qb sha256
if grep -q splash /proc/cmdline; then
/bin/chvt 1
fi
/sbin/cryptsetup luksOpen /dev/sda6 pvcrypt
if grep -q splash /proc/cmdline; then
/sbin/usplash -c &
sleep 1
fi

Make these scripts executable by root. 

# chmod +x /etc/mkinitramfs/hooks/pvcrypt
# chmod +x /etc/mkinitramfs/scripts/local-top/pvcrypt

Now build a new initrd image: # update-initramfs -u ALL

Encrypt the data partition

Check the future encrypted LVM physical partition for errors. This will take several minutes for each partition. This fills each partition with pseudorandom data from the not-so-random libc pseudorandom sourc # /sbin/badblocks -c 10240 -s -w -t random -v /dev/sda6 Fill the partitions with random data. This may take 4 hours for the large partition. The /dev/urandom source is a good source of randomization that should prevent attackers from being able to determine where data actually resides on the encrypted filesystem, which would help them know what they should try to decrypt. The /dev/random source is even better, but it might take hundreds of years to fill the disk from it. # dd if=/dev/urandom of=/dev/sda6 Create the encryption key for the partition. 

# cryptsetup --verify-passphrase --verbose --hash=sha256 --cipher=aes-cbc-essiv:sha256 --key-size=256 luksFormat /dev/sda6
# cryptsetup luksOpen /dev/sda6 pvcrypt

Make an LVM physical volume, volume group, and logical volumes on the encrypted partition. The size of 9938 happens to be how much is left on my logical partition. 

# pvcreate /dev/mapper/pvcrypt
Physical volume "/dev/mapper/pvcrypt" successfully created
# vgcreate vgcrypt /dev/mapper/pvcrypt
Volume group "vgcrypt" successfully created
# lvcreate -n lvroot -L 8G vgcrypt
Logical volume "lvroot" created
# lvcreate -n lvswap -L 1G vgcrypt
Logical volume "lvswap" created
# lvcreate -n lvhome -l 9938 vgcrypt
Logical volume "lvhome" created

Put a filesystem on each volume. 

# mkfs.ext3 /dev/mapper/vgcrypt-lvroot
# mkfs.ext3 /dev/mapper/vgcrypt-lvhome
# mkswap /dev/mapper/vgcrypt-lvswap

Populate the encrypted volumes. 

# mkdir /mnt/root
# mkdir /mnt/home
# mount /dev/mapper/vgcrypt-lvroot /mnt/root
# mount /dev/mapper/vgcrypt-lvhome /mnt/home
# cp -ax / /mnt/root
# rm -rf /mnt/root/home/*
# cp -ax /home/* /mnt/home

Edit /mnt/root/etc/fstab. First change this line /dev/sda1 / ext3 defaults,errors=remount-ro 0 1 to /dev/mapper/vgcrypt-lvroot / ext3 defaults,errors=remount-ro 0 1 And add these lines: 

/dev/mapper/vgcrypt-lvhome /home	ext3	defaults			0	1
/dev/mapper/vgcrypt-lvswap none	swap	sw				0	0

Add this to the bottom of /boot/grub/menu.lst. (hd0,4) refers to the boot partition, /dev/sda5. 

title           Cryptotest
root            (hd0,4)
kernel          /vmlinuz-<your kernel version here> root=/dev/mapper/vgcrypt-lvroot ro
initrd          /initrd.img-<your kernel version here>
savedefault
boot

Check the kernel version with uname -r. For example, it may be "2.6.15-26-server". Reboot to test by typing sudo reboot. Press ESC to enter the GRUB menu and select Cryptotest. The boot process will stop waiting for the encrypted partition's passphrase. The prompt will probably be hard to see because of a lot of debugging information on the console. If all goes well, then continue. Otherwise seek help or figure out what went wrong. Edit /boot/grub/menu.lst to remove the lines we added at the end, and change the line that has # kopt=root=/dev/sda1 ro to # kopt=root=/dev/mapper/vgcrypt-lvroot ro Then run $sudo update-grub Finally make a backup key file for unencrypting the drive. Insert a blank USB thumb drive. 

$ sudo dd if=/dev/random of=/media/<usbdrive>/pvcrypt-$(whoami)-key bs=1 count=256
$ sudo cryptsetup luksAddKey /dev/sda6 /media/<usbdrive>/pvcrypt-$(whomai)-key

Wipe the old partition. # /sbin/badblocks -c 10240 -s -w -t random -v /dev/sda1

Notes

Those who do not want a large leftover partition on sda1 can make one as small as 600MB and install the server version of Ubuntu instead, or even make the /boot partition 600MB and just install the root partition there initially. Gnome will popup a notice that it has found an encrypted partition. Cancel the dialog. It seems that /sbin/partprobe causes this dialog to popup. Any advice on getting rid of this would be appreciated.

取自“https://wiki.ubuntu.org.cn/index.php?title=UbuntuHelp:EncryptedFilesystemLVMHowto&oldid=36975”