Prevent lots of writes on Ubuntu Server running from flash drive

Question

I would like to have a setting, where Ubuntu Server is installed and booting from a flash drive (SanDisk Cruzer Fit 8GB), with two HDDs running in RAID1 and 4 drives running with RAID0 (only 1 drive at the beginning and adding up more over time). All drives, except for the pen drive should be encrypted and decrypted when booting up the system, thus, unplugging the pen drive would render the whole system useless. There should be a backup of the pen drive somewhere, just in case the pen drive burns down.

All HDDs should run LVM2. All the writing of files should be on the HDD and only on very rare occasions on the flash drive, since it is really slow.

If I install the Ubuntu server onto the flash drive, how do I know and prevent programs from writing a lot onto the drive? Is there a way to seize all writing at all. Furthermore, how would I encrypt both RAID1 and RAID0 with an encryption, where the pen drive acts as the key/passphrase.

Any good reading material/tutorial is very welcome.

Answer 1

If you set up your system so that swap is on the HDDs you can run your flash boot drive as read-only and have all writes go to an overlay file system in swap. A writeup of how to do this is at https://help.ubuntu.com/community/aufsRootFileSystemOnUsbFlash - use the overlayfs instructions instead of aufs. You can put any partitions where writes need to be preserved (e.g. /var) on the HDDs.

Install the system on flash as you would on any other media, set up encryption, LVM2, etc. and test that everything works. You should encrypt the pendrive also if you want full protection for the data. Then modify the initfs as described in the link and you're set to go.

Answer 2

1. You need to setup multiple partitions on your server; IE: a separate /, /home, /boot, etc for whatever your needs are. (You will need a separate /boot, assinged to the pen drive)

So for short example if you have HDD0 (/dev/sda) and pen drive (/dev/sdb) than /dev/sda will have your /, /home, /usr, whatever while the pen drive, /dev/sdb will have your separate /boot partition which will control the booting of the system. See here for more indepth: http://www.tldp.org/HOWTO/Multi-Disk-HOWTO.html

1. You will to not only encrypt that pendrive but also your hdd's. This should get you started here even if you need more there are sources on it: https://help.ubuntu.com/community/EncryptedFilesystemsOnRemovableStorage