1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
|
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<style type="text/css">
body {
background:#fff;
color:#000;
font-family:sans-serif;
font-size:1em;
}
div.important {
background-color:#ccc;
}
</style>
<title>Installing Trisquel GNU/Linux with full disk encryption (including /boot)</title>
</head>
<body>
<header>
<h1>Installing Trisquel GNU/Linux with full disk encryption (including /boot)</h1>
<aside>Or <a href="../index.html">back to main index</a></aside>
</header>
<p>
Because GRUB is installed directly as a payload of libreboot (or coreboot), you don't need an unencrypted /boot partition
when setting up an encrypted system. This means that your machine can really secure data while powered off.
</p>
<p>
This works in Trisquel 7, and probably Trisquel 6. Boot the 'net installer' (Install Trisquel in Text Mode). <a href="grub_boot_installer.html">How to boot a GNU/Linux installer</a>.
</p>
<p>
Set a strong user password (ideally above 40 characters, of lowercase/uppercase, numbers and symbols).
</p>
<p>
when the installer asks you to setup
encryption (ecryptfs) for your home directory, select 'Yes' if you want to: <b>LUKS is already secure and performs well. Having ecryptfs on top of it
will add noticeable performance penalty, for little security gain in most use cases. This is therefore optional, and not recommended.
Choose 'no'.</b>
</p>
<p>
<b>
Your user password should be different than the LUKS password which you will set later on.
Your LUKS password should, like the user password, be secure.
</b>
</p>
<h1>Partitioning</h1>
<p>Choose 'Manual' partitioning:</p>
<ul>
<li>Select drive and create new partition table</li>
<li>
Single large partition. The following are mostly defaults:
<ul>
<li>Use as: physical volume for encryption</li>
<li>Encryption: aes</li>
<li>key size: 256</li>
<li>IV algorithm: xts-plain64</li>
<li>Encryption key: passphrase</li>
<li>erase data: Yes (only choose 'No' if it's a new drive that doesn't contain your private data)</li>
</ul>
</li>
<li>
Select 'configure encrypted volumes'
<ul>
<li>Create encrypted volumes</li>
<li>Select your partition</li>
<li>Finish</li>
<li>Really erase: Yes</li>
<li>(erase will take a long time. be patient)</li>
</ul>
</li>
<li>
Select encrypted space:
<ul>
<li>use as: physical volume for LVM</li>
<li>Choose 'done setting up the partition'</li>
</ul>
</li>
<li>
Configure the logical volume manager:
<ul>
<li>Keep settings: Yes</li>
</ul>
</li>
<li>
Create volume group:
<ul>
<li>Name: <b>buzz</b> (you can use whatever you want here, this is just an example)</li>
<li>Select crypto partition</li>
</ul>
</li>
<li>
Create logical volume
<ul>
<li>select <b>buzz</b> (or whatever you named it before)</li>
<li>name: <b>distro</b> (you can use whatever you want here, this is just an example)</li>
<li>size: default, minus 2048 MB</li>
</ul>
</li>
<li>
Create logical volume
<ul>
<li>select <b>buzz</b> (or whatever you named it before)</li>
<li>name: <b>swap</b> (you can use whatever you want here, this is just an example)</li>
<li>size: press enter</li>
</ul>
</li>
</ul>
<h1>Further partitioning</h1>
<p>
Now you are back at the main partitioning screen. You will simply set mountpoints and filesystems to use.
</p>
<ul>
<li>
LVM LV distro
<ul>
<li>use as: ext4</li>
<li>mount point: /</li>
<li>done setting up partition</li>
</ul>
</li>
<li>
LVM LV swap
<ul>
<li>use as: swap area</li>
<li>done setting up partition</li>
</ul>
</li>
<li>Now you select 'Finished partitioning and write changes to disk'.</li>
</ul>
<h1>Kernel</h1>
<p>
Installation will ask what kernel you want to use. linux-generic is fine.
</p>
<h1>Tasksel</h1>
<p>
Just continue here, without selecting anything. You can install everything later (it's really easy).
</p>
<h1>Install the GRUB boot loader to the master boot record</h1>
<p>
Choose 'Yes'. It will fail, but don't worry. Then at the main menu, choose 'Continue without a bootloader'.
</p>
<p>
<i>You do not need to install GRUB at all, since in libreboot you are using the GRUB payload (for libreboot) to boot your system directly.</i>
</p>
<h1>Clock UTC</h1>
<p>
Just say 'Yes'.
</p>
<h1>
Booting your system
</h1>
<p>
At this point, you will have finished the installation. At your GRUB payload, press C to get to the command line.
</p>
<p>
Do that:<br/>
grub> <b>cryptomount -a (ahci0,msdos1)</b><br/>
grub> <b>set root='lvm/buzz-distro'</b><br/>
grub> <b>linux /vmlinuz root=/dev/mapper/buzz-distro cryptdevice=/dev/mapper/buzz-distro:root quiet splash ro</b><br/>
grub> <b>initrd /initrd.img</b><br/>
grub> <b>boot</b>
</p>
<h1>
ecryptfs
</h1>
<p>
If you didn't encrypted your home directory, then you can safely ignore this section.
</p>
<p>
Immediately after logging in, do that:<br/>
$ <b>sudo ecryptfs-unwrap-passphrase</b>
</p>
<p>
This will be needed in the future if you ever need to recover your home directory from another system, so write it down and keep the note
somewhere secret. Ideally, you should memorize it and then burn the note (or not even write it down, and memorize it still)>
</p>
<h1>
Modify grub.cfg (CBFS)
</h1>
<p>
Now you need to set it up so that the system will automatically boot, without having to type a bunch of commands.
</p>
<p>
Modify your grub.cfg (in the firmware) <a href="grub_cbfs.html">using this tutorial</a>;
just change the default menu entry 'Load Operating System' to say this inside:
</p>
<p>
<b>cryptomount -a (ahci0,msdos1)</b><br/>
<b>set root='lvm/buzz-distro'</b><br/>
<b>linux /vmlinuz root=/dev/mapper/buzz-distro cryptdevice=/dev/mapper/buzz-distro:root quiet splash ro</b><br/>
<b>initrd /initrd.img</b>
</p>
<p>
Additionally, you should set a GRUB password. This is not your LUKS password, but it's a password that you have to enter to see
GRUB. This protects your system from an attacker simply booting a live USB and re-flashing your firmware. <b>This should be different than your LUKS passphrase and user password.</b>
</p>
<p>
The GRUB utility can be used like so:<br/>
$ <b>grub-mkpasswd-pbkdf2</b>
</p>
<p>
Give it a password (remember, it has to be secure) and it'll output something like:<br/>
<b>grub.pbkdf2.sha512.10000.711F186347156BC105CD83A2ED7AF1EB971AA2B1EB2640172F34B0DEFFC97E654AF48E5F0C3B7622502B76458DA494270CC0EA6504411D676E6752FD1651E749.8DD11178EB8D1F633308FD8FCC64D0B243F949B9B99CCEADE2ECA11657A757D22025986B0FA116F1D5191E0A22677674C994EDBFADE62240E9D161688266A711</b>
</p>
<p>
Put that in the grub.cfg (the one for CBFS inside the ROM) before the 'Load Operating System' menu entry like so (example):<br/>
</p>
<pre>
<b>set superusers="root"</b>
<b>password_pbkdf2 root grub.pbkdf2.sha512.10000.711F186347156BC105CD83A2ED7AF1EB971AA2B1EB2640172F34B0DEFFC97E654AF48E5F0C3B7622502B76458DA494270CC0EA6504411D676E6752FD1651E749.8DD11178EB8D1F633308FD8FCC64D0B243F949B9B99CCEADE2ECA11657A757D22025986B0FA116F1D5191E0A22677674C994EDBFADE62240E9D161688266A711</b>
</pre>
<p>
Obviously, replace it with the correct hash that you actually got for the password that you entered. Meaning, not the hash that you see above!
</p>
<p>
After this, you will have a modified ROM with the menu entry for cryptomount, and the entry before that for the GRUB password. Flash the modified ROM
using <a href="../index.html#flashrom">this tutorial</a>.
</p>
<h1>
Update Trisquel
</h1>
<p>
$ <b>sudo apt-get update</b><br/>
$ <b>sudo apt-get upgrade</b>
</p>
<p>
At the time of writing, Trisquel 7 had <a href="https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/1274680">this</a>
bug from upstream. The workaround identified in <a href="https://trisquel.info/en/forum/trisquel-7-memory-leak-issues">this page</a>
was as follows:<br/>
$ <b>sudo apt-get remove libpam-smbpass</b>
</p>
<h1>
Install a desktop (optional)
</h1>
<p>
Installs the default desktop:<br/>
$ <b>sudo apt-get install trisquel</b>
</p>
<p>
It might ask for postfix configuration. I just choose 'No configuration'.
</p>
<p>
Next time you boot, it'll start lightdm and you can login. To start lightdm now, do:<br/>
$ <b>sudo service lightdm start</b>
</p>
<p>
Go back to the terminal (ctrl-alt-f1) and exit:<br/>
$ <b>exit</b>
</p>
<p>
Go back to lightdm (ctrl-alt-f7) and login.
</p>
<p>
Since you installed using net install and you only installed the base system, network-manager isn't controlling
your eth0 but instead /etc/network/interfaces is. Comment out the eth0 lines in that file, and then do:<br/>
$ <b>sudo /etc/init.d/networking stop</b><br/>
$ <b>sudo service network-manager restart</b>
</p>
<h1>
Conclusion
</h1>
<p>
If you followed all that correctly, you should now have a fully encrypted system.
</p>
<hr/>
<p>
Copyright © 2014 Francis Rowe <info@gluglug.org.uk><br/>
This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions.
A copy of the license can be found at <a href="../license.txt">../license.txt</a>.
</p>
<p>
This document is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See <a href="../license.txt">../license.txt</a> for more information.
</p>
</body>
</html>
|
