2

I have one physical server and would like to configure full disk encryption for it.

First I was playing around with an virtual machines (CentOS7) and have enabled it during installation:

enter image description here

On reboot I get the following prompt and can successfully unlock the drive:enter image description here

[root@srv~]# lsblk
NAME                                          MAJ:MIN RM  SIZE RO TYPE  MOUNTPOINT
sda                                             8:0    0   20G  0 disk
├─sda1                                          8:1    0    1G  0 part  /boot
└─sda2                                          8:2    0   19G  0 part
  └─luks-9ca13c53-317d-42c5-a3ea-c6039274bf38 253:0    0   19G  0 crypt
    ├─centos_otrs-root                        253:1    0   17G  0 lvm   /
    └─centos_otrs-swap                        253:2    0    2G  0 lvm   [SWAP]
sr0                                            11:0    1 1024M  0 rom

AFAICS the bootpartition is not encrypted. How could I possibly perform a true full disk encryption and still be able to use the crypt-ssh dracut module for remote unlocking of systems with disk encryption via ssh.

Thanks!

Improve this question
1
  • 3
    You get a chicken-and-egg problem: how to decrypt the code that will decrypt the next stage since that code is encrypted? At which layer will you stop?
    – A.B
    Apr 17, 2019 at 17:24

1 Answer 1

Reset to default
0

From https://mirrors.edge.kernel.org/pub/linux/utils/boot/dracut/dracut.html#_crypto_luks

dracut --add ssh initramfs.img
dracut --add crypt initramfs.img
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .