Encrypted non-root partitions
B — Thu, 10/01/2008 - 11:39
Arch has this wonderful hook called 'encrypt' that allows you to unlock your encrypted root partition with an external key if you want so. The problem is this implementation is rather rigid - the encrypt hook can only handle one partition and corresponding key for now (actually it can only handle a root partition by default). My 'hack' allows non-root partitions to get mounted automatically without having to resort to /etc/crypttab for unlocking information, but that is a weak point at the same time: you cannot have multiple encrypted partitions with this method - unless, of course, you continue to use /etc/crypttab.
This is what you have to edit:
cryptdev="/dev/sdxX" (currently on line 47 in /lib/initcpio/hooks/encrypt)
cryptname="${name of the mapping}" (line 48)
Change both values to resp. the partition your LUKS device represents and the name of the block device the encrypted partition gets mapped to.
A note: you may ask yourself if all this hacking is needed for a non-root partition. I think it is. For non-root partitions the key is mostly stored on the root partition to facilitate booting; this can be either as a key or as a plain text password in /etc/crypttab. In addition to a key you also need to provide a 'master' password to unlock the system in case the key is not present (you'll first need to set this password, but if you confide in your infallible memory you can always remove the password afterwards and have LUKS only work with the key).
- Add new comment
- 393 reads
