Full disk encryption secure boot - Revision history

Prabuanand: added detailed Todo

2025-11-01T03:48:21Z

added detailed Todo

← Older revision		Revision as of 03:48, 1 November 2025
Line 1:		Line 1:
	{{Todo\| This page has to be tested as the current version ~~of GRUB~~ is ~~already 2.12~~.}}		{{Todo\| This page has to be tested as GRUB 2.12 is already the current version.
			* If the instructions on this section/page are correct, please remove the Disclaimer and add the [[Template:Verified\|Verified]] template.
			* If something isn't correct, or is incomplete, add the [[Template:Accuracy\|Accuracy]] template to the relevant section/page.}}

	'''Disclaimer: this is not to be followed, only for testing purposes. This will be updated when GRUB 2.12 rc1 will be available for LUKSv2, GRUB and FDE to work. '''		'''Disclaimer: this is not to be followed, only for testing purposes. This will be updated when GRUB 2.12 rc1 will be available for LUKSv2, GRUB and FDE to work. '''

Prabuanand: formatting

2025-10-31T17:42:07Z

formatting

← Older revision		Revision as of 17:42, 31 October 2025
Line 1:		Line 1:
	{{Todo\| This page has to be tested as the current version of GRUB is already 2.12. ~~Here~~'~~s the original~~ Disclaimer: this is not to be followed, only for testing purposes. This will be updated when GRUB 2.12 rc1 will be available for LUKSv2, GRUB and FDE to work.}}		{{Todo\| This page has to be tested as the current version of GRUB is already 2.12.}}

			'''Disclaimer: this is not to be followed, only for testing purposes. This will be updated when GRUB 2.12 rc1 will be available for LUKSv2, GRUB and FDE to work. '''

	This guide is to explain, step-by-step, how to setup Alpine Linux with Full Disk Encryption using LUKS2, LVM (one Physical Volume Partition with three Logical Volume Partitions (/ /boot & swap) with hibernation on a NVMe drive, with UEFI & Secure Boot.		This guide is to explain, step-by-step, how to setup Alpine Linux with Full Disk Encryption using LUKS2, LVM (one Physical Volume Partition with three Logical Volume Partitions (/ /boot & swap) with hibernation on a NVMe drive, with UEFI & Secure Boot.

Prabuanand: added Todo note instead of Draft

2025-10-31T17:40:04Z

added Todo note instead of Draft

← Older revision		Revision as of 17:40, 31 October 2025
Line 1:		Line 1:
	{{~~Draft~~\| This has to be updated when GRUB 2.12 rc1 will be available for LUKSv2, GRUB and FDE to work}}		{{Todo\| This page has to be tested as the current version of GRUB is already 2.12. Here's the original Disclaimer: this is not to be followed, only for testing purposes. This will be updated when GRUB 2.12 rc1 will be available for LUKSv2, GRUB and FDE to work.}}

	This guide is to explain, step-by-step, how to setup Alpine Linux with Full Disk Encryption using LUKS2, LVM (one Physical Volume Partition with three Logical Volume Partitions (/ /boot & swap) with hibernation on a NVMe drive, with UEFI & Secure Boot.		This guide is to explain, step-by-step, how to setup Alpine Linux with Full Disk Encryption using LUKS2, LVM (one Physical Volume Partition with three Logical Volume Partitions (/ /boot & swap) with hibernation on a NVMe drive, with UEFI & Secure Boot.

Prabuanand: added back the Draft notice with original message as unsure if this still works.

2025-10-31T17:19:15Z

added back the Draft notice with original message as unsure if this still works.

← Older revision		Revision as of 17:19, 31 October 2025
Line 1:		Line 1:
			{{Draft\| This has to be updated when GRUB 2.12 rc1 will be available for LUKSv2, GRUB and FDE to work}}

	This guide is to explain, step-by-step, how to setup Alpine Linux with Full Disk Encryption using LUKS2, LVM (one Physical Volume Partition with three Logical Volume Partitions (/ /boot & swap) with hibernation on a NVMe drive, with UEFI & Secure Boot.		This guide is to explain, step-by-step, how to setup Alpine Linux with Full Disk Encryption using LUKS2, LVM (one Physical Volume Partition with three Logical Volume Partitions (/ /boot & swap) with hibernation on a NVMe drive, with UEFI & Secure Boot.

Prabuanand: removed note about grub version and fixed headings

2025-10-31T17:10:42Z

removed note about grub version and fixed headings

← Older revision		Revision as of 17:10, 31 October 2025
Line 1:		Line 1:
	~~'''Disclaimer : this~~ is ~~not~~ to ~~be followed~~, ~~only for testing purposes. This will be updated when GRUB 2.12 rc1 will be available for LUKSv2~~, ~~GRUB and FDE~~ to ~~work'''~~		This guide is to explain, step-by-step, how to setup Alpine Linux with Full Disk Encryption using LUKS2, LVM (one Physical Volume Partition with three Logical Volume Partitions (/ /boot & swap) with hibernation on a NVMe drive, with UEFI & Secure Boot.

	This guide ~~is to explain, step-by-step, how to setup~~ Alpine Linux with Full Disk Encryption using LUKS2, LVM (one Physical Volume Partition with three Logical Volume Partitions (/ /boot & swap) with hibernation on a NVMe drive, with UEFI & Secure Boot. This guide has been written using Alpine ~~Linux Std~~ 3.16.1, please adapt ~~some~~ commands if needed.		This guide uses Alpine Linux [[Release Notes for Alpine 3.16.0\|v3.16.1]]. So please adapt commands if needed.

	The goal of this guide is to follow the KISS principle, but another file system can be used, multiple partitions for /home; /var/log etc.. can also be added, if the proposed configuration is not meeting your requirements.		The goal of this guide is to follow the KISS principle, but another file system can be used, multiple partitions for /home; /var/log etc.. can also be added, if the proposed configuration is not meeting your requirements.

	= ~~Installing packages~~ =		== Installation ==

	To facilitate the partitioning we will use gdisk :		To facilitate the partitioning we will use gdisk : <pre># apk add lsblk gptfdisk</pre>
	<pre># apk add lsblk gptfdisk</pre>

	For encryption, we will use cryptsetup :		For encryption, we will use cryptsetup :
	<pre># apk add cryptsetup</pre>		<pre># apk add cryptsetup</pre>

	For LVM:		For LVM: <pre># apk add lvm2</pre>
	<pre># apk add lvm2</pre>

	For using and managing UEFI, multiple packages are needed :		For using and managing UEFI, multiple packages are needed :
	<pre># apk add efibootmgr e2fsprogs grub grub-efi</pre>		<pre># apk add efibootmgr e2fsprogs grub grub-efi</pre>

	= Preparing / overwriting the disk =		For Preparing and overwriting the disk using a Entropy harvesting daemon: <pre># apk add haveged</pre>
	<pre># apk add haveged</pre>
			== Preparing the disk ==

	This can take long, on my side for a 500GB nVME it tooks ~30 minutes.		This can take long, on my side for a 500GB nVME it tooks ~30 minutes.
	<pre># haveged -n 0 \| dd of=/dev/nvme0n1</pre>		<pre># haveged -n 0 \| dd of=/dev/nvme0n1</pre>

	= Partitioning the disk =		== Partitioning the disk ==

	Let's assume the disk is /dev/nvme0n1 and no partition is present, we will create two partitions :		Let's assume the disk is /dev/nvme0n1 and no partition is present, we will create two partitions :
Line 71:		Line 71:
	<pre> # partprobe /dev/nvme0n1</pre>		<pre> # partprobe /dev/nvme0n1</pre>

	= Configuring LUKS =		== Configuring LUKS ==

	Using luks2 (unsupported by GRUB at the moment):		Using luks2 (unsupported by GRUB at the moment):
Line 92:		Line 92:
	</pre>		</pre>

	= LVM : Physical & Logical Volumes creation =		== LVM : Physical & Logical Volumes creation ==
	<pre># pvcreate /dev/mapper/lvmcrypt		<pre># pvcreate /dev/mapper/lvmcrypt
	Physical volume "/dev/mapper/lvmcrypt" successfully created.		Physical volume "/dev/mapper/lvmcrypt" successfully created.
Line 109:		Line 109:
	</pre>		</pre>

	= Mounting points and File System =		== Mounting points and File System ==

	Create vfat file system for UEFI partition:		Create vfat file system for UEFI partition:
Line 141:		Line 141:
	</pre>		</pre>

	= Installing Alpine =		== Installing Alpine ==

	<pre># setup-disk -m sys /mnt/</pre>		<pre># setup-disk -m sys /mnt/</pre>

	= mkinitfs settings & modules =		== mkinitfs settings & modules ==

	Edit the /mnt/etc/mkinitfs/mkinitfs.conf file and append the modules to the features parameters (keymap only needed if your keyboard is not QWERTY):		Edit the /mnt/etc/mkinitfs/mkinitfs.conf file and append the modules to the features parameters (keymap only needed if your keyboard is not QWERTY):
	<pre>features="ata base ide scsi usb virtio ext4 lvm nvme keymap cryptsetup cryptkey resume"</pre>		<pre>features="ata base ide scsi usb virtio ext4 lvm nvme keymap cryptsetup cryptkey resume"</pre>
Line 151:		Line 152:
	<pre># mkinitfs -c /mnt/etc/mkinitfs/mkinitfs.conf -b /mnt/ $(ls /mnt/lib/modules/)</pre>		<pre># mkinitfs -c /mnt/etc/mkinitfs/mkinitfs.conf -b /mnt/ $(ls /mnt/lib/modules/)</pre>

	= Grub settings =		== Grub settings ==

	Create a crypto_keyfile.bin to avoid typing the passphrase twice during the boot process (one for Grub partition, one for Alpine partition):		Create a crypto_keyfile.bin to avoid typing the passphrase twice during the boot process (one for Grub partition, one for Alpine partition):
Line 196:		Line 197:
	</pre>		</pre>

	= Configuring Secure Boot =		== Configuring Secure Boot ==
	<pre># apk add efi-mkkeys efibootmgr sbsigntool		<pre># apk add efi-mkkeys efibootmgr sbsigntool
	# efi-mkkeys -s "Your Name" -o /etc/uefi-keys		# efi-mkkeys -s "Your Name" -o /etc/uefi-keys
Line 228:		Line 229:
	Reboot & enter into your UEFI (Fx key depending of your laptop)		Reboot & enter into your UEFI (Fx key depending of your laptop)

	== Import keys to UEFI ==		=== Import keys to UEFI ===

	This is just an example from an XPS laptop, each UEFI is unique.		This is just an example from an XPS laptop, each UEFI is unique.
Line 272:		Line 273:
	Done and congrats !		Done and congrats !

			== See also ==

			* [[Setting up encrypted volumes with LUKS]]
			* [[LVM on LUKS]]
			* [[Setting up a laptop]]
	[[Category:Security]]		[[Category:Security]]

Coolman: /* Configuring LUKS */

2023-12-18T21:50:04Z

Configuring LUKS

← Older revision		Revision as of 21:50, 18 December 2023
Line 73:		Line 73:
	= Configuring LUKS =		= Configuring LUKS =

	<pre># cryptsetup -v -c aes-xts-plain64 -s 512 --hash sha512 --pbkdf pbkdf2 --iter-time 1000 --use-random luksFormat /dev/nvme0n1p2		Using luks2 (unsupported by GRUB at the moment):
			<pre># cryptsetup -v -c aes-xts-plain64 -s 512 --hash sha512 --pbkdf pbkdf2 --iter-time 1000 --use-random luksFormat /dev/nvme0n1p2</pre>
			Using luks1:
			<pre># cryptsetup -v -c aes-xts-plain64 -s 512 --hash sha512 --iter-time 1000 --use-urandom --type luks1 luksFormat /dev/nvme0n1p2</pre>

			<pre>
	WARNING!		WARNING!
	========		========
Line 87:		Line 91:
	# cryptsetup luksOpen /dev/nvme0n1p2 lvmcrypt		# cryptsetup luksOpen /dev/nvme0n1p2 lvmcrypt
	</pre>		</pre>

	= LVM : Physical & Logical Volumes creation =		= LVM : Physical & Logical Volumes creation =
	<pre># pvcreate /dev/mapper/lvmcrypt		<pre># pvcreate /dev/mapper/lvmcrypt

Coolman: /* Configuring LUKS */

2023-12-18T20:24:55Z

Configuring LUKS

← Older revision		Revision as of 20:24, 18 December 2023
Line 86:		Line 86:

	# cryptsetup luksOpen /dev/nvme0n1p2 lvmcrypt		# cryptsetup luksOpen /dev/nvme0n1p2 lvmcrypt
			</pre>
	= LVM : Physical & Logical Volumes creation =		= LVM : Physical & Logical Volumes creation =
	<pre># pvcreate /dev/mapper/lvmcrypt		<pre># pvcreate /dev/mapper/lvmcrypt

Coolman: /* Configuring LUKS */

2023-12-18T20:24:10Z

Configuring LUKS

← Older revision		Revision as of 20:24, 18 December 2023
Line 87:		Line 87:
	# cryptsetup luksOpen /dev/nvme0n1p2 lvmcrypt		# cryptsetup luksOpen /dev/nvme0n1p2 lvmcrypt

	= LVM : Physical & Logical Volumes creation=		= LVM : Physical & Logical Volumes creation =
	<pre># pvcreate /dev/mapper/lvmcrypt		<pre># pvcreate /dev/mapper/lvmcrypt
	Physical volume "/dev/mapper/lvmcrypt" successfully created.		Physical volume "/dev/mapper/lvmcrypt" successfully created.

Coolman: /* Partitioning the disk */

2023-12-18T20:18:29Z

Partitioning the disk

← Older revision		Revision as of 20:18, 18 December 2023
Line 67:		Line 67:
	The operation has completed successfully.		The operation has completed successfully.
	</pre>		</pre>

			Populate /dev with the new partitions
			<pre> # partprobe /dev/nvme0n1</pre>

	= Configuring LUKS =		= Configuring LUKS =

Coolman: /* Preparing / overwriting the disk */

2023-12-18T19:21:09Z

Preparing / overwriting the disk

← Older revision		Revision as of 19:21, 18 December 2023
Line 20:		Line 20:

	= Preparing / overwriting the disk =		= Preparing / overwriting the disk =
			<pre># apk add haveged</pre>
	This can take long, on my side for a 500GB nVME it tooks ~30 minutes.		This can take long, on my side for a 500GB nVME it tooks ~30 minutes.
	<pre># haveged -n 0 \| dd of=/dev/nvme0n1</pre>		<pre># haveged -n 0 \| dd of=/dev/nvme0n1</pre>