LVM on LUKS
- 1 Introduction
- 2 Setting up Alpine Linux Using LVM on Top of a LUKS Partition
- 2.1 Preparing the Temporary Installation Environment
- 2.2 Creating the Partition Layout
- 2.3 Optional: Overwrite LUKS Partition with Random Data
- 2.4 Encrypting the LVM Physical Volume Partition
- 2.5 Creating the Logical Volumes and File Systems
- 2.6 Creating and Mounting the File Systems
- 2.7 Installing Alpine Linux
- 2.8 Installing a bootloader
- 2.9 Unmounting the Volumes and Partitions
- 3 Troubleshooting
- 4 Hardening
- 5 See also
This documentation describes how to set up Alpine Linux on a fully encrypted disk (apart from the bootloader's partition). We will have an LVM container installed inside an encrypted partition. To encrypt the partition containing the LVM volume group, dm-crypt (which is managed by the
cryptsetup command) and its LUKS subsystem is used.
Note that your
/boot/ partition must be non-encrypted to work with Syslinux. When using GRUB2 it is possible to boot from an encrypted partition to provide a layer of protection from Evil Maid attacks, but Syslinux doesn't support this.
Storage Device Name
To find your storage device's name, you could either install
apk add util-linux) and find your device using the
lspci command, or you could make an educated guess by using BusyBox's
df commands, and running
ls /dev/sd* if you are installing to a USB, SATA or SCSI device,
ls /dev/fd* for floppy disks and
ls /dev/hd* for IDE (PATA) devices.
The following documentation uses the
/dev/sda device as installation destination. If your environment uses a different device name for your storage device, use the corresponding device names in the examples.
Setting up Alpine Linux Using LVM on Top of a LUKS Partition
To install Alpine Linux in logical volumes running on top of a LUKS encrypted partition, you cannot use the official installation procedure. The installation requires several manual steps you must run in the Alpine Linux Live CD environment.
Preparing the Temporary Installation Environment
Before you begin to install Alpine Linux, prepare the temporary environment:
Boot the latest Alpine Linux Installation CD. At the login prompt, use the
root user without a password to log in. Now we will follow the Setup-alpine script and make our changes along the way.
Run the scripts in this order:
# setup-keymap # setup-hostname # setup-interfaces # rc-service networking start
If you are configuring static networking (you didn't configure any interfaces to use DHCP), run
# passwd # setup-timezone # rc-update add networking boot # rc-update add urandom boot # rc-update add acpid default # rc-service acpid start
Edit your /etc/hosts to look like this, replacing <hostname> with your hostname and <domain> with your TLD (if you don't have a TLD, use 'localdomain':
# setup-apkrepos # apk update # setup-sshd # setup-ntp
Now we will deviate from the install script.
Install the following packages required to set up LVM and LUKS:
# apk add lvm2 cryptsetup e2fsprogs parted
Optionally, if you want to overwrite your storage with random data first, install
haveged, which is a random number generator based on hardware events and has a higher throughput than
# apk add haveged # rc-service haveged start
Creating the Partition Layout
BIOS/MBR with DOS disklabel
We will be partitioning the storage device with a non-encrypted
/boot partition for use with the Syslinux bootloader. Syslinux is meant for use with legacy BIOS and the MSDOS MBR partition table. Syslinux does support GPT partition tables but GRUB2 is the better option for UEFI.
+---------------------------+------------------------+-----------------------+ | Partition name | Partition purpose | Filesystem type | +---------------------------+------------------------+-----------------------+ | /dev/sda1 | Boot partition | ext4 | | /dev/sda2 | LUKS container | LUKS | | |-> /dev/mapper/lvmcrypt | LVM container | LVM | | |-> /dev/vg01/root | Root partition | ext4 | | |-> /dev/vg01/swap | Swap partition | swap | +---------------------------+------------------------+-----------------------+
Create an approx. 100MB partition to boot off, then assign the rest of the space to your LUKS partition.
# parted -a optimal (parted) mklabel msdos (parted) mkpart primary ext4 0% 100M (parted) name 1 boot (parted) set 1 boot on (parted) mkpart primary ext4 100M 100% (parted) name 2 crypto-luks
To view your partition table, type
parted. Your results should look something like this:
(parted) print Model: ATA TOSHIBA ******** (scsi) Disk /dev/sda: 1000GB Sector size (logical/physical): 512B/4096B Partition Table: msdos Disk Flags: Number Start End Size Type File system Flags 1 1049kB 99.6MB 98.6MB primary ext4 boot 2 99.6MB 1000GB 1000GB primary ext4
UEFI with GPT disklabel
We will be encrypting the whole disk but the EFI system partition mounted at
/boot/efi. This means that GRUB2 will decrypt the LUKS volume and load the kernel from there, preventing someone with physical access to your computer from maliciously installing a rootkit (or bootkit) in your boot partition while your computer is not already unlocked. The partitioning scheme will look like this:
+---------------------------+------------------------+-----------------------+ | Partition name | Partition purpose | Filesystem type | +---------------------------+------------------------+-----------------------+ | /dev/sda1 | EFI system partition | fat32 | | /dev/sda2 | LUKS container | LUKS | | |-> /dev/mapper/lvmcrypt | LVM container | LVM | | |-> /dev/vg01/root | Root partition | ext4 | | |-> /dev/vg01/boot | Boot partition | ext4 | | |-> /dev/vg01/swap | Swap partition | swap | +---------------------------+------------------------+-----------------------+
Create an approx. 200MB EFI system partition, then assign the rest of the space to your LUKS partition.
# parted -a optimal (parted) mklabel gpt (parted) mkpart primary fat32 0% 200M (parted) name 1 esp (parted) set 1 esp on (parted) mkpart primary ext4 200M 100% (parted) name 2 crypto-luks
Optional: Overwrite LUKS Partition with Random Data
This should be done if your hard drive wasn't encrypted previously. It helps purge old, non-encrypted data and makes it harder for an attacker to work out how much data you have on your drive if they have access to the encrypted contents.
We will be using
haveged as it is considerably faster than
/dev/urandom when generating pseudo-random numbers (it's almost as high as
/dev/zero in throughput), and is (supposedly) very close to truly random.
# haveged -n 0 | dd of=/dev/sda2
Encrypting the LVM Physical Volume Partition
To encrypt the partition which will later contain the LVM PV, you could either use the default settings (aes-xts-plain64 cipher with 256-bit key and Argon2 hashing with iter-time 2000ms), or you could use these settings which have added security with the trade-off being a non-noticeable decrease in performance in modern computers:
# cryptsetup luksFormat /dev/sda2
Optimized for security:
# cryptsetup -v -c serpent-xts-plain64 -s 512 --hash whirlpool --iter-time 5000 --use-random luksFormat /dev/sda2
Creating the Logical Volumes and File Systems
Open the LUKS partition:
# cryptsetup luksOpen /dev/sda2 lvmcrypt
Create the PV on
# pvcreate /dev/mapper/lvmcrypt
vg0 LVM VG in the
# vgcreate vg0 /dev/mapper/lvmcrypt
LV Creation fro BIOS/MBR
This will create a 2GB swap partition and a root partition which takes up the rest of the space. This setup is for those who do not need to use the hibernate/suspend to disk state. If you do need to suspend to disk, create a swap partition slightly larger than the size of your RAM (change the size after
# lvcreate -L).
# lvcreate -L 2G vg0 -n swap # lvcreate -l 100%FREE vg0 -n root
The LVs created in the previous steps are automatically marked active. To verify, enter:
LV Creation for UEFI/GPT
This will create a 2GB swap partition, a 2GB boot partition and a root partition which takes up the rest of the space. This setup is for those who do not need to use the hibernate/suspend to disk state. If you do need to suspend to disk, create a swap partition slightly larger than the size of your RAM (change the size after
# lvcreate -L).
# lvcreate -L 2G vg0 -n swap # lvcreate -L 2G vg0 -n boot # lvcreate -l 100%FREE vg0 -n root
The LVs created in the previous steps are automatically marked active. To verify, enter:
Creating and Mounting the File Systems
boot LVs using the ext4 file system:
# mkfs.ext4 /dev/vg0/root
Format the swap LV:
# mkswap /dev/vg0/swap
Before you can install Alpine Linux, you must mount the partitions and LVs. Mount the root LV to the
# mount -t ext4 /dev/vg0/root /mnt/
Next format your boot partition, create a mount point and mount it:
- If you're using BIOS and MBR:
# mkfs.ext4 /dev/sda1 # mkdir -v /mnt/boot # mount -t ext4 /dev/sda1 /mnt/boot
- If you're using UEFI and GPT:
# apk add dosfstools # mkfs.fat -F32 /dev/sda1 # mkfs.ext4 /dev/vg0/boot # mkdir -v /mnt/boot # mount -t ext4 /dev/vg0/boot /mnt/boot # mkdir -v /mnt/boot/efi # mount -t vfat /dev/sda1 /mnt/boot/efi
Lastly, activate your swap partition:
# swapon /dev/vg0/swap
Installing Alpine Linux
In this step you will install Alpine Linux in the
/mnt/ directory, which contains the mounted file system structure:
# setup-disk -m sys /mnt/
The installer downloads the latest packages to install the base installation. Additionally, the installer automatically creates the entries for the mount points in /etc/fstab file, which is currently mounted in the
To get the UUID of your storage device into a file for later use, use this command:
# blkid -s UUID -o value /dev/sda2 > ~/uuid
To enable the operating system to decrypt the PV at boot time, create the /mnt/etc/crypttab file. Enter the following line into the file to decrypt the
/dev/sda2 partition using the
luks module and map it to the
lvmcrypt UUID=<UUID> none luks
The swap LV is not automatically added to the
fstab file. To add it manually, add the following line to the /mnt/etc/fstab file:
/dev/vg0/swap swap swap defaults 0 0
Edit the /mnt/etc/mkinitfs/mkinitfs.conf file and append the
cryptsetup module to the
Rebuild the initial RAM disk:
# mkinitfs -c /mnt/etc/mkinitfs/mkinitfs.conf -b /mnt/ $(ls /mnt/lib/modules/)
The command uses the settings from the
mkinitfs.conf file set in the
-c parameter to generate the RAM disk. The command is executed in the
/mnt/ directory and the RAM disk is generated using the modules for the installed kernel. Without setting the kernel version using the
$(ls /mnt/lib/modules/) option,
mkinitfs tries to generate the RAM disk using the kernel version installed in the temporary environment, which can differ from the latest one installed by the
Installing a bootloader
Syslinux with BIOS
Install the Syslinux package:
# apk add syslinux
Edit /mnt/etc/update-extlinux.conf and append the following kernel options to the
default_kernel_opts parameter, replacing <UUID> with the UUID of
default_kernel_opts="... cryptroot=UUID=<UUID> cryptdm=lvmcrypt"
cryptroot parameter sets the name of the device that contains the root file system, and the
cryptdm parameter sets the name of the mapping previously set in
update-extlinux utility operates only on the
/boot/ directory, temporarily change the root to the
/mnt/ directory and update the boot loader configuration:
# chroot /mnt/ # update-extlinux # exit
- If an error occurs in the
update-extlinuxcommand you can most likely ignore it.
Write the MBR to the
# dd bs=440 count=1 conv=notrunc if=/mnt/usr/share/syslinux/mbr.bin of=/dev/vda
Grub with UEFI
Mount the required filesystems for the Grub EFI installer to the installation:
# mount -t proc /proc /mnt/proc # mount --rbind /dev /mnt/dev # mount --make-rslave /mnt/dev # mount --rbind /sys /mnt/sys
Then chroot in and use
grub-install to install Grub.
# chroot /mnt # source /etc/profile # export PS1="(chroot) $PS1"
GRUB2 for EFI and (optionally) remove syslinux:
# apk add grub grub-efi efibootmgr # apk del syslinux
Edit /etc/default/grub and add the following kernel options to the
GRUB_CMDLINE_LINUX_DEFAULT parameter, replacing <UUID> with the UUID of the encrypted partition (in this case,
cryptroot parameter sets the name of the device that contains the root file system. The
cryptdm parameter sets the name of the mapping previously set in the
# (chroot) grub-install --target=x86_64-efi --efi-directory=/boot/efi # (chroot) grub-mkconfig -o /boot/grub/grub.cfg # (chroot) exit
Unmounting the Volumes and Partitions
/mnt/ partitions and reboot:
# cd # umount -ql /mnt/dev # umount -R /mnt # reboot
In case your system fails to boot, you can verify the settings and fix incorrect configurations.
Reboot and do the steps in Prepare the temporary installation environment again.
Setup the LUKS partition and activate the LVs:
# cryptsetup luksOpen /dev/sda2 # vgchange -ay
Verify that you run the steps described in the Installing Alpine Linux section correctly. Update the configuration if necessary, unmount the partitions, then reboot.
System can't find boot device
This can be because you are using a GPT partition table on a motherboard that runs BIOS instead of UEFI, or you are running an MSDOS/MBR/Syslinux install without enabling legacy boot mode in the UEFI settings.
If secure boot complains of an unsigned bootloader, you can either disable it or adapt this guide to sign GRUB. If you're using Syslinux, then secure boot should be automatically disabled when you enable legacy boot mode.
- To harden, you should disable DMA and install a hardened version of AES (TRESOR or Loop-Amnesia) since by default cryptsetup with luks uses AES by default.
- Disable DMA in the BIOS and set the password for the BIOS according to Wikipedia.
- Blacklist kernel modules that use DMA and any unused expansion modules (FireWire, CardBus, ExpressCard, Thunderbolt, USB 3.0, PCI Express and hotplug modules) that use DMA.
- Alpine setup scripts
- Installing on GPT LVM
- Setting up LVM on GPT-labeled disks
- Setting up disks manually