Prabuanand: added {{Draft}} notice

2025-01-14T06:23:47Z

added {{Draft}} notice

← Older revision		Revision as of 06:23, 14 January 2025
Line 1:		Line 1:
			{{Draft}}
	We'll be partitioning the storage device using parted utility. The EFI system partition mounted at <code>/boot/efi</code> will remain unencrypted and the remaining disk can be encrypted. This means GRUB2 will decrypt the LUKS volume and load the kernel from there, preventing someone with physical access to your computer from maliciously installing a rootkit (or bootkit) in your boot partition while your computer is not unlocked. The partitioning scheme will look like this:		We'll be partitioning the storage device using parted utility. The EFI system partition mounted at <code>/boot/efi</code> will remain unencrypted and the remaining disk can be encrypted. This means GRUB2 will decrypt the LUKS volume and load the kernel from there, preventing someone with physical access to your computer from maliciously installing a rootkit (or bootkit) in your boot partition while your computer is not unlocked. The partitioning scheme will look like this:

Prabuanand: Initial page.. a lot needs to be fixed

2025-01-14T05:31:35Z

Initial page.. a lot needs to be fixed

New page

We'll be partitioning the storage device using parted utility. The EFI system partition mounted at <code>/boot/efi</code> will remain unencrypted and the remaining disk can be encrypted. This means GRUB2 will decrypt the LUKS volume and load the kernel from there, preventing someone with physical access to your computer from maliciously installing a rootkit (or bootkit) in your boot partition while your computer is not unlocked. The partitioning scheme will look like this:

<pre>+---------------------------+------------------------+-----------------------+
| Partition name | Partition purpose | Filesystem type |
+---------------------------+------------------------+-----------------------+
| /dev/sda1 | EFI system partition | fat32 |
| /dev/sda2 | LUKS container | LUKS |
| |-> /dev/mapper/lvmcrypt | LVM container | LVM |
| |-> /dev/vg01/root | Root partition | ext4 |
| |-> /dev/vg01/boot | Boot partition | ext4 |
| |-> /dev/vg01/swap | Swap partition | swap |
+---------------------------+------------------------+-----------------------+</pre>

{{Warning|This will delete an existing partition table and make your data very hard to recover. If you want to dual boot, stop here and ask an expert.}}

Create an EFI system partition of approximately 200MB, then assign the rest of the space to your LUKS partition.

<pre># parted -a optimal
(parted) mklabel gpt
(parted) mkpart primary fat32 0% 200M
(parted) name 1 esp
(parted) set 1 esp on
(parted) mkpart primary ext4 200M 100%
(parted) name 2 crypto-luks</pre>

(parted) print
Model: ATA TOSHIBA ******** (scsi)
Disk /dev/sda: 1000GB
Sector size (logical/physical): 512B/4096B
Partition Table: msdos
Disk Flags:

Number Start End Size Type File system Flags
1 1049kB 99.6MB 98.6MB primary ext4 boot
2 99.6MB 1000GB 1000GB primary ext4

Include:Parted UEFI with GPT disklabel - Revision history

Prabuanand: added {{Draft}} notice

Prabuanand: Initial page.. a lot needs to be fixed