Setting up encrypted volumes with LUKS - Revision history

TakodaOS: Correction: Setup-disk automatically encrypts swap partitions since release 3.18 of alpine-conf

2025-08-26T21:44:23Z

Correction: Setup-disk automatically encrypts swap partitions since release 3.18 of alpine-conf

← Older revision		Revision as of 21:44, 26 August 2025
Line 6:		Line 6:
	* [[LVM on LUKS]]		* [[LVM on LUKS]]

	The installer has built-in support for encryption~~. The default installer~~ will not encrypt ~~the swap partition and~~ the boot partition~~. To setup Alpine Linux with an encrypted swap partition, refer to [[LVM on LUKS]]~~. The [[Bootloaders#GRUB\|GRUB]] bootloader supports BIOS and EFI boot with an encrypted boot partition.		The installer has built-in support for encryption, and will automatically enable LVM to encrypt swap partitions, but it will not encrypt the boot partition. The [[Bootloaders#GRUB\|GRUB]] bootloader supports BIOS and EFI boot with an encrypted boot partition.

	== mkinitfs and LUKS ==		== mkinitfs and LUKS ==

Realroot: Add localmount service note

2025-06-25T14:34:39Z

Add localmount service note

← Older revision		Revision as of 14:34, 25 June 2025
Line 40:		Line 40:

	substituting in the proper parameters.		substituting in the proper parameters.

			Do not forget to enable the <code>localmount</code> service:

			<code>rc-update add localmount</code>

			Otherwise they will not be mounted automatically.

	== See also ==		== See also ==

Prabuanand: fixed wikilink

2025-03-20T10:37:46Z

fixed wikilink

← Older revision		Revision as of 10:37, 20 March 2025
Line 6:		Line 6:
	* [[LVM on LUKS]]		* [[LVM on LUKS]]

	The installer has built-in support for encryption. The default installer will not encrypt the swap partition and the boot partition. To setup Alpine Linux with an encrypted swap partition, refer to [[LVM on LUKS]]. The [[Bootloaders#~~Grub~~\|GRUB]] bootloader supports BIOS and EFI boot with an encrypted boot partition.		The installer has built-in support for encryption. The default installer will not encrypt the swap partition and the boot partition. To setup Alpine Linux with an encrypted swap partition, refer to [[LVM on LUKS]]. The [[Bootloaders#GRUB\|GRUB]] bootloader supports BIOS and EFI boot with an encrypted boot partition.

	== mkinitfs and LUKS ==		== mkinitfs and LUKS ==

Prabuanand: added wikilink

2025-03-19T06:32:53Z

added wikilink

← Older revision		Revision as of 06:32, 19 March 2025
Line 46:		Line 46:
	* [[mkinitfs\|Initramfs init]]		* [[mkinitfs\|Initramfs init]]
	* [[Full disk encryption secure boot]]		* [[Full disk encryption secure boot]]
			* [[Setting up a laptop\|Setting up a secured laptop]]
	* [https://wiki.archlinux.org/index.php/Dm-crypt dm-crypt on ArchWiki]		* [https://wiki.archlinux.org/index.php/Dm-crypt dm-crypt on ArchWiki]

	[[Category:Storage]]		[[Category:Storage]]
	[[Category:Security]]		[[Category:Security]]

Prabuanand: added links to existing information LVM on LUKS and organized headings, restored some old content

2025-03-13T16:29:44Z

added links to existing information LVM on LUKS and organized headings, restored some old content

← Older revision		Revision as of 16:29, 13 March 2025
Line 1:		Line 1:
	[https://en.wikipedia.org/wiki/Linux%20Unified%20Key%20Setup LUKS] allows encrypting a partition and mapping it as a virtual block device, which can then be used as a normal partition. Guides for other Linux distributions should serve as a general references for installing Alpine onto a LUKS encrypted disk.		[https://en.wikipedia.org/wiki/Linux%20Unified%20Key%20Setup LUKS] allows encrypting a partition and mapping it as a virtual block device, which can then be used as a normal partition. Guides for other Linux distributions should serve as a general references for installing Alpine onto a LUKS encrypted disk.

	The ~~installer has built-in support for encryption. The default installer will not encrypt the swap partition and the boot partition. To setup Alpine Linux with an encrypted swap partition, refer~~ to ~~[[LVM on LUKS]]. The GRUB bootloader supports BIOS and EFI boot with an encrypted boot partition.~~		The following approaches are known to work:

	~~== Decrypting non-root volumes during boot ==~~		* Plain LUKS
			* [[LVM on LUKS]]

	~~Differently to other Linux distributions, Alpine does~~ not ~~use~~ the ~~file <code>/etc/crypttab</code>~~. ~~Instead, to have~~ an encrypted ~~volume be decrypted prior~~ to ~~automatically mounting it somewhere via <code>/etc/fstab</code>, you must configure <code>dmcrypt</code> in <code>/etc/conf.d/dmcrypt</code>~~. The ~~comments inside that file should guide you, but as a simple example, here's what you should include in that file to decrypt~~ and ~~map a~~ partition ~~to some volume named, say, “<code>myvolume</code>”, given its UUID (here represented using a series of <code>X</code>s), using a passphrase:~~		The installer has built-in support for encryption. The default installer will not encrypt the swap partition and the boot partition. To setup Alpine Linux with an encrypted swap partition, refer to [[LVM on LUKS]]. The [[Bootloaders#Grub\|GRUB]] bootloader supports BIOS and EFI boot with an encrypted boot partition.

	~~<pre>~~
	~~target=myvolume~~
	~~source=UUID=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXX~~
	~~</pre>~~

	~~In <code>/etc/fstab</code>, then, you would include the following line:~~

	~~<pre>~~
	~~/dev/mapper/myvolume <path> <fstype> <options>~~
	~~</pre>~~

	~~substituting in the proper parameters~~.

	== mkinitfs and LUKS ==		== mkinitfs and LUKS ==

	For those familiar with setting up FDE on other Linux distributions, this section contains only Alpine-specific knowledge required is understanding [[mkinitfs]].		For those familiar with setting up FDE on other Linux distributions, this section contains only Alpine-specific knowledge required and understanding [[mkinitfs]].

	First of all, the <code>cryptsetup</code> feature needs to be added to {{path\|/etc/mkinitfs/mkinitfs.conf}}. Additionally, the following kernel parameters are required:		First of all, the <code>cryptsetup</code> feature needs to be added to {{path\|/etc/mkinitfs/mkinitfs.conf}}. Additionally, the following kernel parameters are required:
Line 31:		Line 19:
	* <code>rootfstype</code>: the filesystem type of the root partition (e.g.: <code>btrfs</code>).		* <code>rootfstype</code>: the filesystem type of the root partition (e.g.: <code>btrfs</code>).

			For example, if you use grub with GPT partition table using ext4 without LVM the {{path\|/etc/default/grub}} file will be as follows:{{Cat\|/etc/default/grub\|<nowiki>GRUB_TIMEOUT=2
	For example if you use grub with GPT partition table~~, no~~ LVM ~~and ext4 you will have in~~ {{path\|/etc/default/grub}}:
	<~~pre~~>
	GRUB_TIMEOUT=2
	GRUB_DISABLE_SUBMENU=y		GRUB_DISABLE_SUBMENU=y
	GRUB_DISABLE_RECOVERY=true		GRUB_DISABLE_RECOVERY=true
Line 40:		Line 25:
	GRUB_PRELOAD_MODULES="luks cryptodisk part_gpt"		GRUB_PRELOAD_MODULES="luks cryptodisk part_gpt"
	GRUB_ENABLE_CRYPTODISK=y		GRUB_ENABLE_CRYPTODISK=y
	</~~pre~~>		</nowiki>}}

			== Decrypting non-root volumes during boot ==
			{{Main\|LVM on LUKS#Mounting additional encrypted filesystems at boot}}
			To have an encrypted non-root volume be decrypted prior to automatically mounting it somewhere via <code>/etc/fstab</code>, configure <code>dmcrypt</code> in the {{path\|/etc/conf.d/dmcrypt}} file. The comments inside that file should guide you, but as a simple example, here's what you should include in that file to decrypt and map a partition to some volume named, say, “<code>myvolume</code>”, given its UUID (here represented using a series of <code>X</code>s), using a passphrase {{Cat\|/etc/conf.d/dmcrypt\|<nowiki>...
			target=myvolume
			source=UUID=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXX
			key=/etc/keys/myvolume.key #not needed as passphrase is used in this example
			...</nowiki>}}

			In {{path\|/etc/fstab}} file, then, you would include the following line as follows:{{Cat\|/etc/fstab\|<nowiki>...
			/dev/mapper/myvolume <path> <fstype> <options>
			...</nowiki>}}

			substituting in the proper parameters.

	== See also ==		== See also ==

Juan: Add note about how to decrypt a volume before mounting via fstab

2025-03-11T22:08:56Z

Add note about how to decrypt a volume before mounting via fstab

← Older revision		Revision as of 22:08, 11 March 2025
Line 2:		Line 2:

	The installer has built-in support for encryption. The default installer will not encrypt the swap partition and the boot partition. To setup Alpine Linux with an encrypted swap partition, refer to [[LVM on LUKS]]. The GRUB bootloader supports BIOS and EFI boot with an encrypted boot partition.		The installer has built-in support for encryption. The default installer will not encrypt the swap partition and the boot partition. To setup Alpine Linux with an encrypted swap partition, refer to [[LVM on LUKS]]. The GRUB bootloader supports BIOS and EFI boot with an encrypted boot partition.

			== Decrypting non-root volumes during boot ==

			Differently to other Linux distributions, Alpine does not use the file <code>/etc/crypttab</code>. Instead, to have an encrypted volume be decrypted prior to automatically mounting it somewhere via <code>/etc/fstab</code>, you must configure <code>dmcrypt</code> in <code>/etc/conf.d/dmcrypt</code>. The comments inside that file should guide you, but as a simple example, here's what you should include in that file to decrypt and map a partition to some volume named, say, “<code>myvolume</code>”, given its UUID (here represented using a series of <code>X</code>s), using a passphrase:

			<pre>
			target=myvolume
			source=UUID=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXX
			</pre>

			In <code>/etc/fstab</code>, then, you would include the following line:

			<pre>
			/dev/mapper/myvolume <path> <fstype> <options>
			</pre>

			substituting in the proper parameters.

	== mkinitfs and LUKS ==		== mkinitfs and LUKS ==

Zcrayfish: /* mkinitfs and LUKS */ use path template

2025-03-09T20:56:16Z

mkinitfs and LUKS: use path template

← Older revision		Revision as of 20:56, 9 March 2025
Line 7:		Line 7:
	For those familiar with setting up FDE on other Linux distributions, this section contains only Alpine-specific knowledge required is understanding [[mkinitfs]].		For those familiar with setting up FDE on other Linux distributions, this section contains only Alpine-specific knowledge required is understanding [[mkinitfs]].

	First of all, the <code>cryptsetup</code> feature needs to be added to ~~<code>~~/etc/mkinitfs/mkinitfs.conf~~</code>~~. Additionally, the following kernel parameters are required:		First of all, the <code>cryptsetup</code> feature needs to be added to {{path\|/etc/mkinitfs/mkinitfs.conf}}. Additionally, the following kernel parameters are required:

	* <code>cryptroot</code> kernel parameter should point to the encrypted block device.		* <code>cryptroot</code> kernel parameter should point to the encrypted block device.
Line 15:		Line 15:


	For example if you use grub with GPT partition table, no LVM and ext4 you will have in ~~<code>~~/etc/default/grub~~</code>~~:		For example if you use grub with GPT partition table, no LVM and ext4 you will have in {{path\|/etc/default/grub}}:
	<pre>		<pre>
	GRUB_TIMEOUT=2		GRUB_TIMEOUT=2

Realroot: Add grub file example

2025-03-09T15:07:45Z

Add grub file example

← Older revision		Revision as of 15:07, 9 March 2025
Line 14:		Line 14:
	* <code>rootfstype</code>: the filesystem type of the root partition (e.g.: <code>btrfs</code>).		* <code>rootfstype</code>: the filesystem type of the root partition (e.g.: <code>btrfs</code>).

	~~Those parameters go~~ in <code>~~GRUB_CMDLINE_LINUX_DEFAULT~~</code> in <~~code~~>/~~etc~~/~~default~~/~~grub~~</~~code~~> ~~for grub.~~
			For example if you use grub with GPT partition table, no LVM and ext4 you will have in <code>/etc/default/grub</code>:
			<pre>
			GRUB_TIMEOUT=2
			GRUB_DISABLE_SUBMENU=y
			GRUB_DISABLE_RECOVERY=true
			GRUB_CMDLINE_LINUX_DEFAULT="modules=sd-mod,usb-storage,ext4 quiet rootfstype=ext4 cryptroot=UUID=a7dc90c4-6746-417e-b25b-cb8769ee6334 cryptdm=alpine-rootfs root=/dev/mapper/alpine-rootfs"
			GRUB_PRELOAD_MODULES="luks cryptodisk part_gpt"
			GRUB_ENABLE_CRYPTODISK=y
			</pre>

	== See also ==		== See also ==

Prabuanand: added additional reference page

2025-03-09T13:38:30Z

added additional reference page

← Older revision		Revision as of 13:38, 9 March 2025
Line 20:		Line 20:
	* [[LVM on LUKS]]		* [[LVM on LUKS]]
	* [[mkinitfs\|Initramfs init]]		* [[mkinitfs\|Initramfs init]]
			* [[Full disk encryption secure boot]]
	* [https://wiki.archlinux.org/index.php/Dm-crypt dm-crypt on ArchWiki]		* [https://wiki.archlinux.org/index.php/Dm-crypt dm-crypt on ArchWiki]

	[[Category:Storage]]		[[Category:Storage]]
	[[Category:Security]]		[[Category:Security]]

Prabuanand: added links to see also section

2025-03-09T13:32:18Z

added links to see also section

← Older revision		Revision as of 13:32, 9 March 2025
Line 15:		Line 15:

	Those parameters go in <code>GRUB_CMDLINE_LINUX_DEFAULT</code> in <code>/etc/default/grub</code> for grub.		Those parameters go in <code>GRUB_CMDLINE_LINUX_DEFAULT</code> in <code>/etc/default/grub</code> for grub.

	== See also ==		== See also ==

			* [[LVM on LUKS]]
			* [[mkinitfs\|Initramfs init]]
	* [https://wiki.archlinux.org/index.php/Dm-crypt dm-crypt on ArchWiki]		* [https://wiki.archlinux.org/index.php/Dm-crypt dm-crypt on ArchWiki]

	[[Category:Storage]]		[[Category:Storage]]
	[[Category:Security]]		[[Category:Security]]