3 ms·
Yes. I use similar setup with Linux' LUKS disk encryption and suspend/resume with encrypted swap partition works. You need to use initramfs with your kernel, s
by andrey_utkin 11y ago
Yes. I use similar setup with Linux' LUKS disk encryption and suspend/resume with encrypted swap partition works.
You need to use initramfs with your kernel, so that kernel you boot from external drive is not alone but has some tools. Then you need to tell to your initramfs scripts to take care of encryption of your data and _swap_ partitions. Both dracut (redhat initramfs tool) and genkernel (gentoo initramfs tool) handle that.
With genkernel, this is what I currently have in /etc/default/grub. That's all I need, really.
GRUB_CMDLINE_LINUX="crypt_root=UUID=7e2c0396-7cc2-4468-9431-c85f81a4c9b2 root=UUID=d098a3ad-ff13-4a44-b4e6-d9e83cddd7ad crypt_swap=UUID=976f44a3-25c2-4869-b3b5-61808f3bc20d swap=UUID=5adcdf03-abaf-4cd3-8902-45228be2abe5 root_key=key swap_key=key root_keydev=UUID=d5878b0f-1997-467a-8f3b-65e78b16fb67 swap_keydev=UUID=d5878b0f-1997-467a-8f3b-65e78b16fb67 rootfstype=ext4 rootflags=rw,relatime,data=ordered resume=UUID=5adcdf03-abaf-4cd3-8902-45228be2abe5 "
With dracut, you want to look at options having "luks" in their names.
- 616c 11y agoI am aware of how to do this on Linux. I do exactly as you subscribe. But running the /boot on external USB seems to cause more issues than when I merely have /boot partition and a partition with LVM inside LUKS volume on the same physical disk. I want to know if FreeBSD works that way, as I hear some FreeBSD on FreeBSDTalk and other podcasts say they have made big strides on laptop support (jokes abound with resume/sleep issues) on different laptops, but I am curious how far these improvements go.
- andrey_utkin 11y agoExternal boot enables me to carry encryption key on it secretly so that I don't need to enter it manually. With on-machine unencrypted boot, you cannot do like that, because it's pointless. Anyway, another important issue is Evil Maid Attack. To recap, if you leave your device alone for a moment, an adversary may edit your bootpath (BIOS/EFI, or just your boot partition) to insert keylogger. Then, as long as you enter your key once, the game is over. BIOS/EFI hacking is not possible if you have trusted stuff setup properly. Hacking an unencrypted boot partition is just piece of cake. I believe Linux or BSD can do whatever you want, just be careful with what you want.
- andrey_utkin 11y agoMaybe I didn't just get your question right 616c, could you please elaborate what you are trying to achieve, if this is the case?
- tetraodonpuffer 11y agoyou can have /boot be part of luks/lvm so you don't have a separate unencrypted partition too
- jethro_tell 11y agoI leave the boot on the normal HDD and carry an sdcard with the key. I can also type the very long pass phrase and start the box though I could also make it key start only.