Hi there!
The last two PCs (A and B) I installed are fully encrypted. I used
different methods. I used genkernel --luks --lvm --install all to create
kernel and initramfs. I like to have everything as kernel modules, but the
crypto stuff has to be directly in the kernel, unless I put these modules
into the initramfs by hand.
A: LVM -> LUKS
Many partitions make two volume groups with many LVMs. Each LVM is LUKS-
encrypted. This gives me maximum flexibility, who knows what other OSes I
might need to install on that drive. The boot partition is on a USB stick
and also holds the key.
This did not work out of the box, I had to modify
/lib/rcscripts/addons/dm-crypt-start.sh in order to open the other
partitions than swap and root. I need to add something to close them when
shutting down, but it seems to work fine without this for the moment. Do
you know if there already is a solution for this?
B: LUKS -> LVM
A simpler approach. sda1 is a small boot partition, sda2 (the rest of the
drive) is a LUKS-formatted LVM physical volume with volume group 'pvcrypt'
on it. This does not work yet, the initramfs does not find the LVM.
I looked into the init script. I wants to do a cryptsetup luksOpen
$LUKS_DEVICE $LUKS_NAME with $LUKS_NAME=root, which is not the name I use.
But changing this does not help anyway. I get /dev/mapper/pvcrypt created,
but pvscan does not find it. At this point I thought I'd ask here, do you
have ideas what's wrong?
Using a live CD I can easily access my data:
cryptsetup luksOpen /dev/sda2 pvcrypt
pvscan
vgchange -a y
mount /dev/vgcrypt/root /gentoo
Wonko
