
A couple of weeks ago I updated my Debian Sid setup on the MacBook to
use disk encryption; this post is to document what I did for later reference.
The system was configured for dual booting Debian or Mac OS X using
refit and
grub2 as documented on the
Debian
Wiki; I don't use the Mac OS X system
much, but I left it there to be able to test things and be able to answer
questions of Mac OS X users when I have to.
The Debian installation was done using two primary partitions, one for
swap
(I used a partition to be able to suspend to disk without troubles) and an
ext3 file system used as the
root file system.
The plan was to use the Debian Installer to do the disk setup and recover
the Sid installation from a backup once the encrypted setup was working OK.
Backup for later recovery
My first step was to install all the needed packages on the original system;
basically I verified that I had the
lvm2 and
cryptsetup packages
installed.
The second step was to backup the root file system; to do it I changed to
run level 1 and copied the files to an external USB disk using
rsync.
My third step was to boot into Mac OS X to reduce the space assigned to
it; I had a lot of free space that I didn't plan to use with Mac OS X and
I thought that this was the best occasion to reassign it to the Debian
file system.
Encrypted Lenny installation
Now the machine was ready for the installer. As I formatted the system a couple
of weeks ago I used a daily build of the
Lenny Debian Installer, now that
Lenny is out I would have used the official version.
I booted the installer and on the partition disk step I selected the manual
method; I left
sda1 and
sda2 as they were (the Mac OS X installation
uses them) and set up
sda3 and
sda4 as follows:
sda3: 256 MB, use as ext3, mount point: /boot
sda4: 86 GB, use as physical volume for LVM
Note that I decided to put
/boot on a plain
ext3 partition to be able to
use grub2 as the boot loader (if we put the kernel on an LVM logical volume
we need to use
lilo as the boot loader).
Once
sda4 was adjusted as LVM I entered on the
LVM setup and created a LVM
Volume Group (VG) with the name
debian, using
sda4 as the physical volume.
Once the VG was defined I created a couple of Logical Volumes (LV):
I left some space unallocated to be able to create LVM snapshots (I use them
to do backups, I'll post about it on the next days).
Once the LV were ready I finished with the LVM setup and went back to the
partitioner to configure the
Logical Volumes:
- debian-root: use as physicals volume for encryption
- debian-swap: use as pascal volume for encryption, encryption key: random
Once both encrypted volumes were ready I entered on the
Configure the
encrypted volumes menu and the installer formatted the volumes for encryption
and asked for the
debian-root pass phrase.
Back on the main partitioning menu I set up the
debian-root_crypt encrypted
volume:
- debian-root_crypt: use as
ext3, mount point: /.
I didn't need to touch the
debian-swap_crypt, it was configured
automatically as
swap because I choose a random encryption key.
At this point I was finished with the partitioning; to finish I installed a
minimal system and rebooted to try the system.
As I had changed the disk layout I had to
re-sync the partition tables from
refit; once that was done I was able to boot from the newly installed
system.
Setting up suspend to disk
I was using
s2disk to suspend the system; to test if it still worked with
the new setup I installed the
uswsusp package and adjusted the
resume
device on the
/etc/uswsusp.conf to
/dev/mapper/debian-swap_crypt.
After my first try I noticed that the
resume step failed with the encrypted
swap partition because it was using a random key, which means that the swap
contents are unrecoverable after a reboot.
Looking at the
cryptsetup documentation I found that the solution was to use
a
derived key for the swap partition instead of a
random one.
The command sequence was as follows:
# disable swap
swapoff -a
# close encrypted volume
cryptsetup luksClose debian-swap_crypt
# change the swap partition setup on the /etc/crypttab file
sed -e -i 's%^debian-swap.*%debian-swap_crypt /dev/mapper/debian-swap debian-root_crypt cipher=aes-cbc-essiv:sha256,size=256,swap,hash=sha256,keyscript=/lib/cryptsetup/scripts/decrypt_derived,swap%' /etc/crypttab
# open the encrypted volumes with the new setup
/etc/init.d/cryptdisks start
# enable swap
swapon -a
# update the initrd image
update-initramfs -u
After executing all those commands the suspend to disk system worked as
expected.
Recovering the original system
If I were going to reinstall the system completely I would have finished here,
but in my case I wanted to recover my original system setup (except the
minimal changes required to use the encrypted passions, of course).
To recover my old installation I backed up some files (
/etc/fstab,
/etc/crypttab,
/etc/uswsusp.conf and the current
/boot contents to be
able to boot in case of failure with my old kernel) from the current
installation, after that I recovered all the files from the initial backup
(except the ones just saved) using
rsync again and regenerated the initrd
images of my old kernels:
update-initramfs -u -k all
After that I rebooted and everything worked as on my original installation
(except for the disk encryption, of course).