this post was submitted on 05 Sep 2024
17 points (90.5% liked)
Linux
5376 readers
40 users here now
A community for everything relating to the linux operating system
Also check out [email protected]
Original icon base courtesy of [email protected] and The GIMP
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
This would -at least as far as I understand it- limit your swap's functionality for hibernation etc. Because there your swap needs to be available early. You can still do it in theory, but the key file then would need to be included in you initrams, which kind of defeats the purpose.
There is however a much more easier option: either use LVM on luks (so the volume is decrypted with the password and then contains both, root and swap) or just use the same password for root and swap while switching over to the systemd hooks (as those encryption hooks try unlokcing everything with the first provided password by default, and only ask for additional password if this fails).
EDIT: Seeing that you crossposted this from an archlinux-specific community: You can find the guide here. It's for using a fully enrcypted system with grub as bootloader, but the details (in 8.3 and 8.4) are true for all boot methods. Replace the busybox hooks with their systemd equivalents (in minitcpio.conf for archlinux but again this isn't limited to that init system), then add "rd.luks.name=<your swap's uuid=swap" to your kernel parameters and also replace the "cryptdevice=UUID=<your root's uuid>:root" that should already be there for an encrypted system (that's the syntax for the busybox hook) with "rd.luks.name=<your root's uuid>=root". On startup you will be asked for your password as usual, but then both root and swap will be decrypted with it (PS: the sd-encrypt hook only tries this once... so if you screw up and misstype your password on the first try, you will then have to type it again two times, once for root, once for swap...)
@[email protected] @[email protected]
Thank you for your LVM on LUKS suggestion!
I was able to get it to work with GRUB and now it works in the same way as systemd where only 1 password input is required🤗
What I found to work is creating 3 partitions:
after encrypting and creating the required volumes on p2,
Now that the base system is done I'm working on a Detached LUKS USB system to further optimize for security after in which I'd be satisfied in knowing that if others use it they'll most likely be safe from most security hazards