LVM on LUKS - Revision history

TakodaOS: Okay, this should probably use Alpine Linux version numbers instead of alpine-conf's numbers. I didn't realize they were different.

2025-08-26T22:04:48Z

Okay, this should probably use Alpine Linux version numbers instead of alpine-conf's numbers. I didn't realize they were different.

← Older revision		Revision as of 22:04, 26 August 2025
Line 1:		Line 1:
	This page describes how to set up Alpine Linux on a fully encrypted disk (apart from the bootloader partition). We will have an LVM container installed inside an encrypted partition that contains the root partition and the swap partition. To encrypt the partition containing the LVM volume group, dm-crypt (which is managed by the <code>cryptsetup</code> command) and its [[Setting up encrypted volumes with LUKS\|LUKS]] subsystem is used.		This page describes how to set up Alpine Linux on a fully encrypted disk (apart from the bootloader partition). We will have an LVM container installed inside an encrypted partition that contains the root partition and the swap partition. To encrypt the partition containing the LVM volume group, dm-crypt (which is managed by the <code>cryptsetup</code> command) and its [[Setting up encrypted volumes with LUKS\|LUKS]] subsystem is used.

	'''Note:''' The <code>setup-alpine</code> installation scripts has support for encrypted installations since v3.13, and automatically encrypts swap using LVM in v3.19. For a simplistic setup it is easy to use.		'''Note:''' The <code>setup-alpine</code> installation scripts has support for encrypted installations since Alpine v3.15, and automatically encrypts swap using LVM in v3.21. For a simplistic setup it is easy to use.

	Note that your {{path\|/boot/}} partition must be non-encrypted to work with Syslinux. When using GRUB2 it is possible to boot from an encrypted partition to provide a layer of protection from [https://en.wikipedia.org/wiki/Evil_maid_attack Evil Maid attacks], but Syslinux doesn't support that.		Note that your {{path\|/boot/}} partition must be non-encrypted to work with Syslinux. When using GRUB2 it is possible to boot from an encrypted partition to provide a layer of protection from [https://en.wikipedia.org/wiki/Evil_maid_attack Evil Maid attacks], but Syslinux doesn't support that.

TakodaOS: Changing v3.18 to v3.19; the feature was intended for v3.18 but a bug relating to the functionality wasn't fixed until v3.19

2025-08-26T21:54:49Z

Changing v3.18 to v3.19; the feature was intended for v3.18 but a bug relating to the functionality wasn't fixed until v3.19

← Older revision		Revision as of 21:54, 26 August 2025
Line 1:		Line 1:
	This page describes how to set up Alpine Linux on a fully encrypted disk (apart from the bootloader partition). We will have an LVM container installed inside an encrypted partition that contains the root partition and the swap partition. To encrypt the partition containing the LVM volume group, dm-crypt (which is managed by the <code>cryptsetup</code> command) and its [[Setting up encrypted volumes with LUKS\|LUKS]] subsystem is used.		This page describes how to set up Alpine Linux on a fully encrypted disk (apart from the bootloader partition). We will have an LVM container installed inside an encrypted partition that contains the root partition and the swap partition. To encrypt the partition containing the LVM volume group, dm-crypt (which is managed by the <code>cryptsetup</code> command) and its [[Setting up encrypted volumes with LUKS\|LUKS]] subsystem is used.

	'''Note:''' The <code>setup-alpine</code> installation scripts has support for encrypted installations since v3.13, and automatically encrypts swap using LVM in v3.18. For a simplistic setup it is easy to use.		'''Note:''' The <code>setup-alpine</code> installation scripts has support for encrypted installations since v3.13, and automatically encrypts swap using LVM in v3.19. For a simplistic setup it is easy to use.

	Note that your {{path\|/boot/}} partition must be non-encrypted to work with Syslinux. When using GRUB2 it is possible to boot from an encrypted partition to provide a layer of protection from [https://en.wikipedia.org/wiki/Evil_maid_attack Evil Maid attacks], but Syslinux doesn't support that.		Note that your {{path\|/boot/}} partition must be non-encrypted to work with Syslinux. When using GRUB2 it is possible to boot from an encrypted partition to provide a layer of protection from [https://en.wikipedia.org/wiki/Evil_maid_attack Evil Maid attacks], but Syslinux doesn't support that.

TakodaOS: Correction: Setup-disk automatically encrypts swap partitions since release 3.18 of alpine-conf

2025-08-26T21:48:46Z

Correction: Setup-disk automatically encrypts swap partitions since release 3.18 of alpine-conf

← Older revision		Revision as of 21:48, 26 August 2025
Line 1:		Line 1:
	This page describes how to set up Alpine Linux on a fully encrypted disk (apart from the bootloader partition). We will have an LVM container installed inside an encrypted partition that contains the root partition and the swap partition. To encrypt the partition containing the LVM volume group, dm-crypt (which is managed by the <code>cryptsetup</code> command) and its [[Setting up encrypted volumes with LUKS\|LUKS]] subsystem is used.		This page describes how to set up Alpine Linux on a fully encrypted disk (apart from the bootloader partition). We will have an LVM container installed inside an encrypted partition that contains the root partition and the swap partition. To encrypt the partition containing the LVM volume group, dm-crypt (which is managed by the <code>cryptsetup</code> command) and its [[Setting up encrypted volumes with LUKS\|LUKS]] subsystem is used.

	'''Note:''' The <code>setup-alpine</code> installation scripts has support for encrypted installations since v3.13. ~~The default encryption options will not encrypt the swap partition and will not use LUKS, but~~ is ~~much easier~~ to use.		'''Note:''' The <code>setup-alpine</code> installation scripts has support for encrypted installations since v3.13, and automatically encrypts swap using LVM in v3.18. For a simplistic setup it is easy to use.

	Note that your {{path\|/boot/}} partition must be non-encrypted to work with Syslinux. When using GRUB2 it is possible to boot from an encrypted partition to provide a layer of protection from [https://en.wikipedia.org/wiki/Evil_maid_attack Evil Maid attacks], but Syslinux doesn't support that.		Note that your {{path\|/boot/}} partition must be non-encrypted to work with Syslinux. When using GRUB2 it is possible to boot from an encrypted partition to provide a layer of protection from [https://en.wikipedia.org/wiki/Evil_maid_attack Evil Maid attacks], but Syslinux doesn't support that.

Prabuanand: fixed typo

2025-03-30T01:26:01Z

fixed typo

← Older revision		Revision as of 01:26, 30 March 2025
Line 398:		Line 398:
	*https://battlepenguin.com/tech/alpine-linux-with-full-disk-encryption/		*https://battlepenguin.com/tech/alpine-linux-with-full-disk-encryption/
	*[https://www.msiism.org/files/doc/alpine-linux-fde-custom.html Installing Alpine Linux with full disk encryption on BIOS/MBR systems with a custom partition layout]		*[https://www.msiism.org/files/doc/alpine-linux-fde-custom.html Installing Alpine Linux with full disk encryption on BIOS/MBR systems with a custom partition layout]
	*[https://rifux.dev/docs/alpine-linux/install-luks2/ Guide to Install Alpine Linux with LUKS2, BTRFS ~~wtih~~ GRUB]		*[https://rifux.dev/docs/alpine-linux/install-luks2/ Guide to Install Alpine Linux with LUKS2, BTRFS and GRUB]
	*https://wiki.archlinux.org/index.php/GRUB		*https://wiki.archlinux.org/index.php/GRUB
	*https://wiki.archlinux.org/index.php/Syslinux		*https://wiki.archlinux.org/index.php/Syslinux

Prabuanand: added link to https://rifux.dev/docs/alpine-linux/install-luks2/

2025-03-30T01:24:00Z

added link to https://rifux.dev/docs/alpine-linux/install-luks2/

← Older revision		Revision as of 01:24, 30 March 2025
Line 398:		Line 398:
	*https://battlepenguin.com/tech/alpine-linux-with-full-disk-encryption/		*https://battlepenguin.com/tech/alpine-linux-with-full-disk-encryption/
	*[https://www.msiism.org/files/doc/alpine-linux-fde-custom.html Installing Alpine Linux with full disk encryption on BIOS/MBR systems with a custom partition layout]		*[https://www.msiism.org/files/doc/alpine-linux-fde-custom.html Installing Alpine Linux with full disk encryption on BIOS/MBR systems with a custom partition layout]
			*[https://rifux.dev/docs/alpine-linux/install-luks2/ Guide to Install Alpine Linux with LUKS2, BTRFS wtih GRUB]
	*https://wiki.archlinux.org/index.php/GRUB		*https://wiki.archlinux.org/index.php/GRUB
	*https://wiki.archlinux.org/index.php/Syslinux		*https://wiki.archlinux.org/index.php/Syslinux

Prabuanand: updated wikilinks, rephrased some sentence, commented installation and referred to installation page

2025-03-26T11:10:07Z

updated wikilinks, rephrased some sentence, commented installation and referred to installation page

← Older revision		Revision as of 11:10, 26 March 2025
Line 1:		Line 1:
	This page describes how to set up Alpine Linux on a fully encrypted disk (apart from the bootloader partition). We will have an LVM container installed inside an encrypted partition that contains the root partition and the swap partition. To encrypt the partition containing the LVM volume group, dm-crypt (which is managed by the <code>cryptsetup</code> command) and its LUKS subsystem is used.		This page describes how to set up Alpine Linux on a fully encrypted disk (apart from the bootloader partition). We will have an LVM container installed inside an encrypted partition that contains the root partition and the swap partition. To encrypt the partition containing the LVM volume group, dm-crypt (which is managed by the <code>cryptsetup</code> command) and its [[Setting up encrypted volumes with LUKS\|LUKS]] subsystem is used.

	'''Note:''' The <code>setup-alpine</code> installation scripts has support for encrypted installations since v3.13. The default encryption options will not encrypt the swap partition and will not use LUKS, but is much easier to use.		'''Note:''' The <code>setup-alpine</code> installation scripts has support for encrypted installations since v3.13. The default encryption options will not encrypt the swap partition and will not use LUKS, but is much easier to use.
Line 7:		Line 7:
	== Setting up Alpine Linux Using LVM on Top of a LUKS Partition ==		== Setting up Alpine Linux Using LVM on Top of a LUKS Partition ==

	To install Alpine Linux on logical volumes running on top of a LUKS encrypted partition, ~~you cannot use the [[Installation\|official installation]] procedure. The installation requires~~ several manual steps ~~you~~ must ~~run~~ in the Alpine Linux Live CD environment.		To install Alpine Linux on logical volumes running on top of a LUKS encrypted partition, several manual steps must be carried out in the Alpine Linux Live CD environment.

	~~=== Storage Device Name ===~~		Follow the [[Installation#General_course_of_action\|Installation guide]] to complete the [[Installation#Base_configuration\|base configuration]] as a working [[Configure_Networking#Connectivity_testing\|Internet access]] is mandatory to complete this installation.

	~~To find your storage device's name, you could either [[Install]] the {{pkg\|util-linux}} package and find your device using the~~ <code>~~lsblk~~</code> ~~command, or you could make an educated guess by using BusyBox's <code>blkid</code> and <code>df</code> commands, and running~~ {{ic\|ls /dev/sd}} if you are installing to a USB, SATA or SCSI device, {{ic\|ls /dev/nvme}} for ~~nvme ssd disks~~ and ~~{{ic\|ls /dev/hd*}} for IDE (PATA) devices~~.		The <code>parted</code> partition editor from {{pkg\|parted}} package is needed for advanced partitioning and GPT disklabels. Install the following packages required to set up LVM and LUKS:{{Cmd\|# apk add lvm2 cryptsetup e2fsprogs parted mkinitfs}}

	~~The~~ following ~~documentation uses the~~ {{~~path~~\|~~/dev/sda~~}} ~~device as installation destination. If your environment uses a different name for your storage device, use the corresponding device name in the examples.~~

			<!--
	=== Preparing the Temporary Installation Environment ===		=== Preparing the Temporary Installation Environment ===

Line 52:		Line 51:

	Here's where we deviate from the install script.		Here's where we deviate from the install script.
			-->
			=== Creating the Partition Layout ===

	~~Install the following packages required to set up LVM~~ and ~~LUKS:{{Cmd\|# apk add lvm2 cryptsetup e2fsprogs parted mkinitfs}}~~		Depending on your motherboard, bios features and configuration, we can either use partition table in MBR (legacy BIOS) or GUID Partition Table (GPT). We'll describe both with example layouts.

	~~{{Note\|The <code>parted</code>~~ partition ~~editor is needed for advanced partitioning and~~ GPT ~~disklabels~~. ~~BusyBox <code>fdisk</code> is a very stripped-down version~~ with ~~minimal functionality}}~~

	~~=== Creating the Partition Layout ===~~		{{Note\|Instructions on this page uses {{path\|'''/dev/sda'''}} as storage device name. To find your storage device's name, you could either use the <code>lsblk</code> command from the {{pkg\|util-linux}} package or you could make an educated guess by using BusyBox's <code>blkid</code> and <code>df</code> commands.}}

	~~Depending~~ on your ~~motherboard~~, ~~bios features and configuration~~
	~~we can~~ either use ~~partition table in MBR (legacy BIOS)~~
	or ~~GUID Partition Table (GPT).~~
	We'~~ll describe both with example layouts~~.

	==== BIOS/MBR with DOS disklabel ====		==== BIOS/MBR with DOS disklabel ====
Line 79:		Line 73:
	+---------------------------+------------------------+-----------------------+</pre>		+---------------------------+------------------------+-----------------------+</pre>

	{{Warning\|This will delete an existing partition table and make your data very hard to recover. If you want to dual boot, stop here and ~~ask an expert~~.}}		{{Warning\|This will delete an existing partition table and make your data very hard to recover. If you want to [[Dualbooting\|dual boot]], stop here and seek [[Support]].}}

	Create a partition of approximately 100MB to boot from, then assign the rest of the space to your LUKS partition.		Create a partition of approximately 100MB to boot from, then assign the rest of the space to your LUKS partition.
Line 367:		Line 361:
	== Troubleshooting ==		== Troubleshooting ==

	In case your system fails to boot, you can verify the settings and fix incorrect configurations. Reboot and do the ~~steps in~~ [[#~~Preparing_the_Temporary_Installation_Environment~~\|~~Prepare~~ the ~~temporary installation environment~~]] again.		In case your system fails to boot, you can verify the settings and fix incorrect configurations. Reboot and follow the [[Installation#General_course_of_action\|Installation guide]] to complete the [[Installation#Base_configuration\|base configuration]] again.

	Setup the LUKS partition and activate the LVs: {{Cmd\|<nowiki># cryptsetup luksOpen /dev/sda2 lvmcrypt		Setup the LUKS partition and activate the LVs: {{Cmd\|<nowiki># cryptsetup luksOpen /dev/sda2 lvmcrypt
	# vgchange -ay</nowiki>}}		# vgchange -ay</nowiki>}}

	[[#Creating_and_Mounting_the_File Systems\|~~Mount~~ the ~~file systems~~]]		Follow the steps in [[#Creating_and_Mounting_the_File Systems\| Creating and Mounting the File Systems]].

	Verify that you run the steps described in the [[#Installing_Alpine_Linux\|Installing Alpine Linux]] section correctly. Update the configuration if necessary, unmount the partitions, then reboot.		Verify that you run the steps described in the [[#Installing_Alpine_Linux\|Installing Alpine Linux]] section correctly. Update the configuration if necessary, unmount the partitions, then reboot.
Line 392:		Line 386:
	=== Secure boot ===		=== Secure boot ===

	If secure boot complains of an unsigned bootloader, you can either disable it or ~~adapt~~ [~~https://wiki.archlinux.org/index.php/Secure_Boot this~~] guide to sign GRUB. If you're using Syslinux, then secure boot should be automatically disabled when you enable legacy boot mode.		If secure boot complains of an unsigned bootloader, you can either disable it or follow [[UEFI Secure Boot]] guide to sign GRUB. If you're using Syslinux, then secure boot should be automatically disabled when you enable legacy boot mode.

	== See also ==		== See also ==

	*[[Setting up encrypted volumes with LUKS]]		*[[Setting up encrypted volumes with LUKS]]
	*[[Bootloaders]]		*[[Bootloaders]]
	*[[~~Alpine setup scripts~~]]		*[[UEFI Secure Boot]]
	*[[Installing on GPT LVM]]		*[[Installing on GPT LVM]]
	*[[Setting up LVM on GPT-labeled disks]]		*[[Setting up LVM on GPT-labeled disks]]

Prabuanand: fixed wikitags and updated heading levels

2025-03-26T09:44:35Z

fixed wikitags and updated heading levels

Show changes

Mmhiro: Clarity in the introduction.

2024-05-04T15:45:38Z

Clarity in the introduction.

← Older revision		Revision as of 15:45, 4 May 2024
Line 1:		Line 1:
	= Introduction =		= Introduction =

	This documentation describes how to set up Alpine Linux on a fully encrypted disk (apart from the bootloader partition). We will have an LVM container installed inside an encrypted partition. To encrypt the partition containing the LVM volume group, dm-crypt (which is managed by the <code>cryptsetup</code> command) and its LUKS subsystem is used.		This documentation describes how to set up Alpine Linux on a fully encrypted disk (apart from the bootloader partition). We will have an LVM container installed inside an encrypted partition that contains the root partition and the swap partition. To encrypt the partition containing the LVM volume group, dm-crypt (which is managed by the <code>cryptsetup</code> command) and its LUKS subsystem is used.

	'''Note:''' ~~These manual steps might be undesired for trivial installations, as~~ <code>~~[[Alpine_setup_scripts#~~setup-~~disk\|setup-disk]]~~</code> ~~supports selecting crypt~~ for ~~sys~~ since ~~[https://gitlab.alpinelinux.org/alpine/alpine-conf/-/commit/b7b8b76~~ v3.13~~] (~~swap will not ~~be encrypted)~~.		'''Note:''' The <code>setup-alpine</code> installation scripts has support for encrypted installations since v3.13. The default encryption options will not encrypt the swap partition and will not use LUKS, but is much easier to use.

	Note that your {{path\|/boot/}} partition must be non-encrypted to work with Syslinux. When using GRUB2 it is possible to boot from an encrypted partition to provide a layer of protection from [https://en.wikipedia.org/wiki/Evil_maid_attack Evil Maid attacks], but Syslinux doesn't support that.		Note that your {{path\|/boot/}} partition must be non-encrypted to work with Syslinux. When using GRUB2 it is possible to boot from an encrypted partition to provide a layer of protection from [https://en.wikipedia.org/wiki/Evil_maid_attack Evil Maid attacks], but Syslinux doesn't support that.

Govynnus: /* General Procedure */ Add required argument to cryptsetup command

2024-01-06T13:46:02Z

General Procedure: Add required <name> argument to cryptsetup command

← Older revision		Revision as of 13:46, 6 January 2024
Line 410:		Line 410:
	Setup the LUKS partition and activate the LVs:		Setup the LUKS partition and activate the LVs:

	<pre># cryptsetup luksOpen /dev/sda2		<pre># cryptsetup luksOpen /dev/sda2 lvmcrypt
	# vgchange -ay</pre>		# vgchange -ay</pre>

Zcrayfish: /* Hardening */ Rescued a dead link with archive.org + Upgraded a hyperlink to https.

2023-07-26T19:42:04Z

Hardening: Rescued a dead link with archive.org + Upgraded a hyperlink to https.

← Older revision		Revision as of 19:42, 26 July 2023
Line 437:		Line 437:
	= Hardening =		= Hardening =

	* To harden, you should disable DMA[https://old.iseclab.org/papers/acsac2012dma.pdf]~~{{dead link}}~~ and install a hardened version of AES (TRESOR[https://www1.informatik.uni-erlangen.de/tresor] or Loop-Amnesia[~~http~~://moongate.ydns.eu/amnesia.html]) since by default cryptsetup with luks uses AES by default.		* To harden, you should disable DMA[https://web.archive.org/web/20200923091814/https://old.iseclab.org/papers/acsac2012dma.pdf] and install a hardened version of AES (TRESOR[https://www1.informatik.uni-erlangen.de/tresor] or Loop-Amnesia[https://moongate.ydns.eu/amnesia.html]) since by default cryptsetup with luks uses AES by default.
	* Disable DMA in the BIOS and set the password for the BIOS according to Wikipedia.[https://en.wikipedia.org/wiki/DMA_attack]		* Disable DMA in the BIOS and set the password for the BIOS according to Wikipedia.[https://en.wikipedia.org/wiki/DMA_attack]
	* Blacklist kernel modules that use DMA and any unused expansion modules (FireWire, CardBus, ExpressCard, Thunderbolt, USB 3.0, PCI Express and hotplug modules) that use DMA.		* Blacklist kernel modules that use DMA and any unused expansion modules (FireWire, CardBus, ExpressCard, Thunderbolt, USB 3.0, PCI Express and hotplug modules) that use DMA.