On my Debian Linux system during the install I decided to use disk encryption (the one offered during a regulard Debian install). When the system boots up I need to enter a password and then the "real" boot begins.

Could someone explain how this encryption is performed? Does it happen before or after the filesystem's laid out? Can I use any filesystem available for Linux with the disk encryption?

The /etc/mtab/ is more complicated than what I was used with Linux and I take it it's related to disk encryption but I'm really not sure. Here's (what I think is) the relevant bits from my /etc/mtab:

/dev/sda1 /boot ext2 rw,relatime,errors=continue 0 
/dev/mapper/archon-root / ext4 rw,noatime,errors=remount-ro,user_xattr,commit=300,barrier=1,data=ordered 0 0
rootfs / rootfs rw 0 0

I don't really understand why /boot is ext2 and why / is ext-4 and using a /dev/mapper.

Could /boot be itself using ext4?

Could / be using, say, ZFS and yet still offer encryption?


/boot is not encrypted (the BIOS would have no way to decrypt it...). It could be ext4, but there really isn't any need for it to be. It usually doesn't get written to. The BIOS reads GRUB from the MBR, then GRUB reads the rest of itself, the kernel, and the initramfs from /boot. The initramfs prompts you for the passphrase. (Assumably, its using cryptsetup and LUKS headers.).

The encryption is performed at a layer below the filesystem. You're using something called dm-crypt (that's the low-level in-kernel backend that cryptsetup uses), where "dm" means "Device Mapper". You appear to also be using LVM, which is also implemented by the kernel Device Mapper layer. Basically, you have a storage stack that looks something like this:

1. /dev/sda2              (guessing it's 2, could be any partition other than 1)
2. /dev/mapper/sda2_crypt (dm-crypt layer; used as a PV for VG archon)
3. LVM (volume group archon)
4. /dev/mapper/archon-root (logical volume in group archon)
5. ext4

You can find all this out with the dmsetup command. E.g., dmsetup ls will tell you the Device Mapper devices in list. dmsetup info will give some details, and dmsetup table will give technical details of the translation the mapping layer is doing.

The way it works is that the dm-crypt layer (#2, above) "maps" the data by performing crypto. So anything written to /dev/mapper/sda2_crypt is encrypted before being passed to /dev/sda2 (the actual hard disk). Anything coming from /dev/sda2 is decrypted before being passed out of /dev/mapper/sda2_crypt.

So any upper layers use that encryption, transparently. The upper layer you have using it first is LVM. You're using LVM to carve up the disk into multiple logical volumes. You've got (at least) one, called root, used for the root filesystem. It's a plain block device, so you can use it just like any other—you can put any filesystem you'd like there, or even raw data. The data gets passed down, so it will be encrypted.

Things to learn about (check manpages, etc.):

  • /etc/crypttab
  • LVM (some important commands: lvs, pvs, lvcreate, lvextend)
  • cryptsetup
  • thanks a lot! I'm using Linux since the early days of Slackware but it's the first time I'm using this encryption thinggy and the first time I'm using LVM so it's all new to me : ) It's clearer now and I'll read more on all this. – Cedric Martin Mar 30 '13 at 5:10

Your Debian setup and many other distribution use Cryptsetup/LUKS full disc encryption.

The full disc encryption encrypts on-disc-partitions and wraps the encryption/decrpytion such that the encrypted partition simply appears as a normal block level device to the rest of the system. The block device may then be formatted in any normal file-system one could desire: ext2/3/4, xfs, jfs, btrfs (kernel 3.2 or later). The filesystem simply writes unencrypted data to disc normally. The LUKS subsystem then encrypts that data before writing to the physical device. Reads work in reverse. This transparent to filesystems, application and the users. Everything actually written to such a disc is encrypted. If that disc were examined externally it would appear to have random garbage on it.

Physical partions are mapped to /dev/mapper/<a unique name here> devices in /etc/crypttab. Your crypttab may look something like this:

archon-root     /dev/sda2     none

which encrypts and maps the real partition /dev/sda2 to the encrypted device /dev/mapper/archon-root. Your /etc/fstab will then mount the mapped device /dev/mapper/archon-root to / or whatever else is desired.

ZFS on solaris includes build-in encryption. On linux, it does not. I expect zfs should work on Cryptstup/LUKS paritions, but I don't know if there are any problems this might uncover. To get full ZFS/ZRaid protection it would certainly be... a pain to set up. Other filesystems work perfectly well in this setting. They are, in fact, oblivious to it. ZFS does a lot more with the underlying discs than most (btrfs excluded) other filesystems.

Your boot partition could certainly be ext4. It cannot, however, be encrypted using Cryptsetup/LUKS as the boot partition needs to be readable by your boot loaded (grub) and that has no encryption support (so far as I know). Once the kernel loads and begins the init process, it will prompt you for a password to open the encrypted devices which is the prompt you see.

  • No, actually when you set up full-disk encryption in Debian Installer, it sets up LVM as well. You're missing the LVM layer. – derobert Mar 29 '13 at 19:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.