266 lines
9.6 KiB
Markdown
266 lines
9.6 KiB
Markdown
---
|
|
title: "LMDE4 Custom Partitions Disk Encryption"
|
|
date: 2020-12-15
|
|
draft: false
|
|
tags: ["linux-mint","disk-encryption"]
|
|
summaryimage: Screenshot31.png
|
|
summaryimagew: 754
|
|
summaryimageh: 700
|
|
authors: ["trent"]
|
|
post: 13
|
|
---
|
|
date: 2020-12-15
|
|
## **Introduction**
|
|
Linux Mint Debian Edition is the alternate version of Linux Mint, but built on a Debian base. The result is quite pleasant: the
|
|
stability of desktop Debian, but with the rough edges polished smooth, nicely configured fonts and ui, and all the multi-media codecs included.
|
|
|
|
Previously, I wrote a [guide for installing LMDE3 with disk encryption](lmde3-xfs-full-disk-encryption.md){target=_blank}.
|
|
The installer for LMDE 4 is different
|
|
in that it includes support for disk encryption, but not if you need custom partitions such as for a **dual-boot
|
|
configuration**.
|
|
|
|
With this in mind, the examples presented below assume that you have Windows 10 installed in 4 partitions, and
|
|
thus you would want to make 3 partitions (5,6,7) after that, for LMDE4.
|
|
As with before, with separate partitions for `/boot` formatted ext4, `/boot/efi` formatted fat32,
|
|
and a regular luks-encrypted partition for `/` formatted xfs.
|
|
|
|
With a separate efi partition for LMDE4, you can then use the computer's device boot menu to
|
|
select which efi boot entry you want to boot. There is also an advantage in having Windows use the
|
|
first efi partition, in that if something happens to the Windows efi boot entry, you can fall back to the
|
|
default efi executable. Whereas, if the efi boot entry for Linux somehow gets wiped, you could [repair that
|
|
easily enough via chroot](https://help.ubuntu.com/community/Grub2/Installing#via_ChRoot){target=_blank}.
|
|
|
|
## **Prepare The Installation Media**
|
|
Visit the [Linux Mint Website](https://www.linuxmint.com/){target=_blank}
|
|
and [download](https://www.linuxmint.com/edition.php?id=279){target=_blank} the iso file for LMDE 4 64bit. Download from torrents if possible, to save bandwidth.
|
|
|
|
* verify the sha256 sum of the iso file
|
|
```console
|
|
sha256sum lmde-4-cinnamon-64bit.iso
|
|
```
|
|
|
|
Identify the thumb drive you are going to install from.
|
|
|
|
* type `lsblk`, note the output, and then insert the thumb drive
|
|
* then type `lsblk` again and note the *additional output*
|
|
|
|
```console
|
|
# lsblk /dev/sdb
|
|
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
|
|
sdb 8:32 1 14.5G 0 disk
|
|
├─sdb1 8:33 1 3.4G 0 part /media/trent/Debian 9.6.0 amd64
|
|
└─sdb2 8:34 1 416K 0 part
|
|
```
|
|
In the above example output we see that our thumb drive is identified as `/dev/sdb`, and partition `/dev/sdb1` is automatically mounted.
|
|
|
|
Take special care that you have accurately identified the thumb drive before proceeding. For the sake of example,
|
|
we will proceed on the assumption that our thumb drive is identified as `/dev/sdb`, but you need to compensate accordingly.
|
|
|
|
* unmount any partition of the thumb drive that are automatically mounted
|
|
```console
|
|
umount /dev/sdb1
|
|
```
|
|
|
|
* write the disk image to the thumb drive
|
|
```console
|
|
ddrescue -D --force lmde-4-cinnamon-64bit.iso /dev/sdb
|
|
```
|
|
|
|
## **Boot The Install Disc**
|
|
* boot into bios to disable fastboot and secureboot
|
|
* invoke your machine's device boot menu and boot the install disc in uefi mode
|
|
* confirm that you have booted in uefi mode by listing efivars
|
|
```console
|
|
ls /sys/firmware/efi/vars
|
|
```
|
|
|
|
## **Partition The Hard Drive**
|
|
If you recall we are assuming the target hard drive is `/dev/sda`, as an example. So, make adjustments as necessary.
|
|
|
|
If you would rather use a different partition tool, make sure the efi partition is an efi partition type, and you definitely need a separate `/boot` partition.
|
|
|
|
If indeed, you are installing a dual-boot and are installing alongside another operating system,
|
|
then **skip steps 1 and 2**, obviously.
|
|
|
|
1. if needed you can clear the drive with wipefs
|
|
```console
|
|
wipefs --all /dev/sda
|
|
```
|
|
1. create a new partition table for `/dev/sda`
|
|
```console
|
|
sgdisk /dev/sda -o
|
|
```
|
|
1. create a new efi partition for `/dev/sda`
|
|
```console
|
|
sgdisk /dev/sda --new=5::+512MiB --typecode=1:ef00
|
|
```
|
|
1. create a new `/boot` partition for `/dev/sda`
|
|
```console
|
|
sgdisk /dev/sda --new=6::+1G
|
|
```
|
|
1. create a new `/` partition for `/dev/sda`
|
|
```console
|
|
sgdisk /dev/sda --new=7
|
|
```
|
|
1. verify your partition work
|
|
```console
|
|
sgdisk /dev/sda -p
|
|
```
|
|
1. format the efi partition
|
|
```console
|
|
mkfs.vfat -F32 /dev/sda5
|
|
```
|
|
1. format the /boot partition
|
|
```console
|
|
mkfs.ext4 /dev/sda6
|
|
```
|
|
1. encrypt the `/` partition, you will be prompted for a password
|
|
```console
|
|
cryptsetup -y -v luksFormat --type luks2 /dev/sda7
|
|
```
|
|
1. decrypt the `/` partition, you will be prompted for a password
|
|
```console
|
|
cryptsetup open /dev/sda7 cryptroot
|
|
```
|
|
1. format the `/` device
|
|
```console
|
|
mkfs.xfs /dev/mapper/cryptroot
|
|
```
|
|
## **Mount The Hard Drive**
|
|
This takes advantage of *expert mode* in the LMDE installer.
|
|
|
|
1. create an `/target` directory
|
|
```console
|
|
mkdir /target
|
|
```
|
|
1. mount the `/` device at `/target`
|
|
```console
|
|
mount /dev/mapper/cryptroot /target
|
|
```
|
|
1. create an `/target/boot` directory
|
|
```console
|
|
mkdir /target/boot
|
|
```
|
|
1. mount the `/boot` partition at `/target/boot`
|
|
```console
|
|
mount /dev/sda6 /target/boot
|
|
```
|
|
1. create an `/target/boot/efi` directory
|
|
```console
|
|
mkdir /target/boot/efi
|
|
```
|
|
1. mount the efi partition at `/target/boot/efi`
|
|
```console
|
|
mount /dev/sda5 /target/boot/efi
|
|
```
|
|
|
|
## **Run The Installer App From Command Line**
|
|
At this point you're ready to run the live installer. But you need to run the
|
|
installer from the command line in order to **use expert-mode**:
|
|
```console
|
|
live-installer --expert-mode
|
|
```
|
|
|
|
The first three pages of the live-installer cover Language,Timezone, and Keymap.
|
|
The fourth page of the live-installer covers name, password, and hostname. After this
|
|
**select manual partitioning**.
|
|
|
|
On the seventh page of the live-installer, you come to a partition configuration page.
|
|
But there is nothing to do here. The partition-configuration doesn't even recognize
|
|
your encrypted partitions. But no matter, because you have already mounted the target
|
|
file system relative to `/target/`, so select *expert mode* at the bottom of the page.
|
|
|
|
<figure>
|
|
<img src=../../photos/Screenshot31.png width="100%" />
|
|
<figcaption>the installer doesn't even recognize the encrypted partitions ... ignore everything on this screen and click the `Expert mode` button</figcaption>
|
|
</figure>
|
|
|
|
Again select *forward*, and when you come to the page where you configure the location
|
|
to install grub, that should be the efi partition, i.e. `/dev/sda5`.
|
|
|
|
<figure>
|
|
<img src=../../photos/Screenshot39.png width="100%" />
|
|
<figcaption>select the efi partition as the location to install grub</figcaption>
|
|
</figure>
|
|
|
|
Then continue with the installation. The installation will run for a
|
|
few minutes and will then pause. There will be a popup informing you that the installation has paused.
|
|
During the pause you need to manually configure `fstab` and `crypttab`.
|
|
|
|
## **Configure Fstab**
|
|
|
|
1. find the UUID of the efi partition
|
|
```console
|
|
blkid /dev/sda5 -s UUID
|
|
```
|
|
1. find the UUID of the `/boot` partition
|
|
```console
|
|
blkid /dev/sda6 -s UUID
|
|
```
|
|
1. find the UUID of the `/` device
|
|
```console
|
|
blkid /dev/mapper/cryptroot -s UUID
|
|
```
|
|
|
|
And when you find the correct UUID numbers, use them to configure `/etc/fstab` which is actually currently at `/target/etc/fstab`.
|
|
```conf
|
|
# /etc/fstab
|
|
###############
|
|
# efi partition
|
|
# run the command `blkid /dev/sda1 -s UUID` which outputs
|
|
# /dev/sda5: UUID="17C4-215D", from which derive
|
|
UUID=17C4-215D /boot/efi vfat defaults 0 2
|
|
|
|
# /boot partition
|
|
# run the command `blkid /dev/sda2 -s UUID` which outputs
|
|
# /dev/sda6: UUID="f2509fff-4854-4721-b546-0274c89e6aec", from which derive
|
|
UUID=f2509fff-4854-4721-b546-0274c89e6aec /boot ext4 defaults 0 2
|
|
|
|
# "/" device
|
|
# run the command `blkid /dev/mapper/cryptroot -s UUID` which outputs
|
|
# /dev/mapper/cryptroot: UUID="72241377-cd65-43a6-8363-1afce5bd93f6", from which derive
|
|
UUID=72241377-cd65-43a6-8363-1afce5bd93f6 / xfs defaults 0 1
|
|
```
|
|
|
|
## **Configure Crypttab**
|
|
But before the file systems can be mounted, `crypttab` needs to mount `/dev/sda3` at `/dev/mapper/cryptroot`.
|
|
Configure `/etc/crypttab` which is actually currently at `/target/etc/crypttab`
|
|
|
|
Sorry, that's actually an over-simplification. But you need to configure `crypttab` now,
|
|
because when the installer continues running again, it installs the bootloader and builds the initramfs,
|
|
and `mkinitramfs` parses `crypttab`, and builds and configures the initramfs in such a way that it knows
|
|
to decrypt your `/` partition so it can then hand it off to the kernel at boot time (I think).
|
|
|
|
* find the UUID of the partition that will be mounted at `/dev/mapper/crypttab`
|
|
```console
|
|
blkid /dev/sda3 -s UUID
|
|
```
|
|
|
|
And when you find the correct UUID number for `/dev/sda3`,
|
|
use that to configure `/etc/crypttab` which is actually currently at `/target/etc/crypttab`.
|
|
```conf
|
|
# /etc/crypttab
|
|
# run the command `blkid /dev/sda7 -s UUID` which outputs
|
|
# /dev/sda7: UUID="da3e0967-711f-4159-85ac-7d5743a75201", from which derive
|
|
# <target name> <source device> <key file> <options>
|
|
cryptroot UUID=da3e0967-711f-4159-85ac-7d5743a75201 none luks
|
|
```
|
|
|
|
## **Resume Installer App**
|
|
At this point finish running the live installer, and you'll be done.
|
|
|
|
## **UEFI Fix**
|
|
Well, actually there isn't one. In this scenario having two efi partitions,
|
|
we rely on the motherboard correctly persisting efi boot entries.
|
|
|
|
So if you are unlucky enough to have one of the HP laptops that
|
|
*forgets* efi boot entries, I guess you are out of luck.
|
|
|
|
You might try using a single efi partition instead of two, and
|
|
maybe that will work. Presumably this would require using VeraCrypt
|
|
for Windows, instead of Bitlocker (because Bitlocker won't allow Grub
|
|
to load the Windows bootloader?)
|
|
|
|
## **Optional Swap File**
|
|
Visit the [Arch Wiki](https://wiki.archlinux.org/index.php/Swap#Swap_file){target=_blank} and they will hook you up.
|