Am Freitag, den 02.01.2009, 20:03 +0100 schrieb Dirk Heinrichs:
> Am Freitag, 2. Januar 2009 19:36:28 schrieb Jens Müller:
> > Raid part 1 \
> > Raid part 2 >- Raid5 -> /dev/md127 = PV1
> > Raid part 3 /
> >
> > ...(possibly others)...
> > PV1 --LVM--> VG1 ---> LV1: \dev\mapper\vg1-crypt
> >
> > LV1: \dev\mapper\vg1-crypt --cryptsetup--> \dev\mapper\crypt_pv
> >
> > \dev\mapper\crypt_pv = PV2 --LVM--> VG1 ---> (all the partitions)
^^^^^^^^^^^^^^^^^ backslashes - hihi ;-)> > Basically, I have one encrypted "physical" volume, but I want to be > > flexible ... > > If you have one encrypted PV from which you build a VG, then every LV inside > it will automatically be encrypted. So where's the flexibility? I think it's a good idea. I have (nearly) my hole disk (except /boot and 1xNTFS) as a partition which is encrypted. Unencrypted it is a PV for a VG in which all my Linux-partitions lives. Nicely transparent setup for me, except for the fact, that now I cannot install anything unencrypted anymore (for guests for example) or use a different key for different LVs. I don't know if the added LVM-layer costs notable CPU-time - but I'd be easy for you to test :) > For the latter I have some scripts ready to create an initramfs which can be > combined with the kernel (It's for EVMS, but it should be easy to adapt to > LVM. I'm pretty sure genkernel can do it. I have observed that _before_ it asks me for my crypt-password it does a lvm-scan, and also _after_. The latter is the only one I need, but for Jens the first one will make your LV for decryption accessible, and the latter will then reveal your LV for your root. BTW: I have compiled the modules I need for booting (incl. crypto-stuff) into the kernel, so I can use this initrd with every new kernel. As it now contains no modules, there is no need not to use genkernel anymore. The genkernel-docs tell you to use on the kernel command line: root=/dev/vg0/gentoo-root (unencrypted dev - for /proc/cmdline) real_root=/dev/vg0/gentoo-root (unencrypted dev - for initrd-script) crypt_root=/dev/sda2 (encrypted dev - for initrd-script) dolvm (do LVM scans - for initrd-script) keymap=de (if not US-kbd - for initrd-script) There is also "real_swap" and "real_resume" and other nice stuff :) Bye, Daniel
signature.asc
Description: Dies ist ein digital signierter Nachrichtenteil
