[...] > > > > You can download/install them by adding the experimental/koeln repository as > > described on the wiki page: > > > > http://faiwiki.debian.net/index.php/Main_Page#getting_FAI > > > > Best, > > Michael > > > I tried today with 3.2.23beta4, and it did not work :-( >
Hmm, that version number doesn't really look like any of the experimental ones (should have +experimentalX in there), but anyway your results look kind of fine to me :-) > What I see is a crypttab which is in /tmp/fai/crypttab during install > and later saved to the log folder, but this one does not get copied to > the target. Moreover, this crypttab refers to a keyfile in /tmp, like this: > > crypt_dev_vg1_tmp /dev/mapper/vg1-tmp /tmp/fai/crypt_dev_vg1_tmp luks > > But what I want is > > crypt_dev_vg1_tmp /dev/mapper/vg1-tmp /dev/urandom tmp > > That's what setup-storage is supposed to do, right? (At least if using > the :randinit option) > - copying crypttab (just like fstab) would mean copying it in task_extrbase, it's not really setup-storage that takes care of this. We should probably just add this code to task_extrbase, but meanwhile I'd ask you to do it in some hand-made script. I think that shouldn't be a show-stopper. - The keyfile is stored in /tmp because in my opinion the user should decide how to handle decryption in the installed system; using /dev/urandom might be fine for /tmp or swap, but in general you will need to access a fixed key. One quite frequent setup is moving key files to a USB device. - :randinit performs random initialization of the device _once_. Maybe the man page is not quite clear about that fact, sorry. That said, I'd happily take suggestions how all the above could be improved, because apparently it did not match your expectations. I'm not yet using encryption myself and therefore rely on input from people using this feature. > Additionally, I forgot to mention in my first post that I need to load > the device mapper modules including dm_crypt manually using a > partition.DEFAULT hook. Without that, no LVM (even without encryption) > will work, complaining about lack of device-mapper support. > If your config space is based on the simple example, you might want to merge some changes from current simple examples: class/20-hwdetect.source has all the stuff you need :-) Thanks a lot for taking the time to test all this and report back! Best, Michael
pgpqM4E13RjXU.pgp
Description: PGP signature
