0

So I am trying to install Arch Linux with separate root and home partitions (also swap and boot ofc). Basically I've partitioned them, I've mounted them, and I've encrypted / and /home (using cryptsetup luksFormat). It looks like this under lsblk:

(sorry, cannot copy the text from the virtual machine at this stage) enter image description here

Now I am trying to achieve the following things:

  • I want to decrypt all the partitions at system startup, without having to type the passphrase for each one (I've made them identical by the way)
  • I want to configure GRUB for the encrypted partitions, but so far I've only seen configurations with GRUB_CMDLINE_LINUX="cryptdevice=/dev/sdXY:cryptroot" and I have two of them, so I don't really know what should I put here (maybe only / one?)

So for now I am stuck at the point when I want to run mkinitcpio and grub-install/grub-mkconfig but I can't since I probably won't be able to boot my system without a proper GRUB configuration.

Do you guys know how would I achieve this? The second one is more important, since there are docs on the first issue, just wanted to put it there for a one-liner advice I guess, it's the second one I've been scratching my head about for the last two hours.

Improve this question

1 Answer 1

Reset to default
2

Welcome to the Unix & Linux StackExchange!

The job of the initramfs file generated by mkinitcpio is only to unlock and mount the root filesystem; mounting other filesystems like /home will happen a bit later in the boot process, after the root filesystem is unlocked and mounted. GRUB does not need to know anything about the /home filesystem.

The cryptdevice option supplies information for the scripts within the initramfs file for unlocking the encryption of the root filesystem. This allows you to easily change the name of the device that is assumed to hold the encrypted root filesystem, should your system configuration change later. For robustness in the face of unexpected changes to system configuration, you might actually want to use the UUID=<UUID_of_sda3> syntax in place of the device name.

So you could configure the encryption of /home use a key file stored somewhere within the root filesystem. Since the key file would be located within an encrypted partition, it will be protected when the system is not running. And after the root filesystem is accessible, /etc/crypttab will be able to refer to that file, and so the encryption of the /home filesystem can be unlocked automatically.

According to the crypttab paragraph of the Arch wiki, the entry for your /home filesystem in /etc/crypttab might look like this:

crypthome /dev/sda4 /etc/cryptsetup-keys.d/crypthome.key

You might want to use the UUID=<UUID of sda4> here also instead of the device name.

You would ensure /etc/cryptsetup-keys.d/ is accessible by root only (chmod 700), and write the passphrase for the /home filesystem into the crypthome.key file. If an intruder could read this, it means the intruder has effectively root access, so they could e.g. replace your cryptsetup command with one that emails any passphrases to the intruder, no matter whether they are typed or read from a file, so at that point you will have bigger worries anyway.

Improve this answer
7
  • Thanks! So if I understand correctly - grub config only has to have an entry for root partition. And as for unlocking with only one passphrase - I would use /etc/crypttab. And by the way, about this passphrase - does it have to be plaintext? I mean it's no problem for me, but is storing a plaintext passphrase on a disk secure? (even on encrypted root partition in a directory with root-only privileges)
    – dabljues
    Commented Jun 10, 2020 at 11:57
  • And by the way, you mentioned UUID=<UUID of the /home filesystem> is it the UUID of /dev/sda4 or the UUID of crypthome? (they differ, obviously - /dev/sda4 is a crypto_LUKS partition, crypthome is ext4)
    – dabljues
    Commented Jun 10, 2020 at 12:05
  • And by the way, after editing all of those above - what about /etc/fstab? Do I need to change UUIDs there to for example /dev/mapper/cryptroot and /dev/mapper/crypthome?
    – dabljues
    Commented Jun 10, 2020 at 13:13
  • 1
    Sorry, edited: I meant in the crypttab and GRUB option you should have the UUID of the corresponding disk device, as the filesystem UUIDs are not readable at that point because of the encryption. And for fstab, you want the UUIDs of cryptroot and crypthome, as you need the actual filesystem for mounting, not the encrypted container. See my edit for the security worry.
    – telcoM
    Commented Jun 10, 2020 at 13:32
  • 1
    Yes (assuming you meant the crypttab line as crypthome UUID=12345... key_path). And the exact pathname /etc/cryptsetup-keys.d/crypthome.key may be significant for the latest versions of systemd, so you might want to use exactly that path. At boot, the system should ask you the passphrase for /, unlock it, and then using systemd autodetection and/or information in /etc/crypttab, automatically unlock /home using the key file, and mount it as per /etc/fstab.
    – telcoM
    Commented Jun 10, 2020 at 13:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .