Not quite full disk encryption with LVM and LUKS

Andreas Haerter has a step-by-step guide on how to install an Ubuntu Linux system with full disk encryption. However it does not encrypt the GRUB2 or /boot partition.

The purpose of using LVM is that multiple encrypted volumes can be opened with one pass-phrase at boot because they all reside on one encrypted disk partition with a LUKS header.

Here is a summary.

In the following examples:

• boot partition is sda2
• encrypted partition is sda5
• opened encrypted partition is sda5-secure
• encrypted VG is SecureVG
• Root LV is secure-root

From the live install disk install LVM2 and cryptsetup.

# apt-get install LVM2
# apt-get install cryptsetup 
# modprobe dm-crypt

Create the LUKS header for the encrypted partition, e.g.

# cryptsetup --cipher aes-xts-plain --key-size 512 --verify-passphrase luksFormat /dev/sda5

Open the encrypted partition, e.g.

# cryptsetup luksOpen /dev/sda5 sda5-secure

This maps to /dev/mapper/sda5-secure

Create the LVM volumns:

# pvcreate /dev/mapper/sda5-secure
# vgcreate SecureVG /dev/mapper/sda5-secure
# lvcreate ...

Install the system.

Chroot to the new system root mounted at /mnt/secure-root.

# mkdir /mnt/secure-root
# mount /dev/mapper/SecureVG-secure--root--01 /mnt/secure-root
# mount /dev/sda2 /mnt/secure-root/boot
# mount -o bind /dev /mnt/secure-root/dev
# mount -t proc proc /mnt/secure-root/proc
# mount -t sysfs sys /mnt/secure-root/sys
# cp /etc/resolv.conf /mnt/secure-root/etc/resolv.conf
# chroot /mnt/secure-root /bin/bash

Install LVM2 and cryptsetup on the new system. 

# apt-get update
# apt-get install cryptsetup lvm2

Add an entry in /etc/crypttab. Generate the line with:

# echo "secure-sda5 UUID=$(ls -la /dev/disk/by-uuid | grep $(basename /dev/sda5) | cut -d ' ' -f 10) none luks"

E.g. "secure-sda5 UUID=6e61c215-b930-41bf-b33a-cfb52cc5b969 none luks"

Add GRUB2 modules for preload to /etc/default/grub:

GRUB_PRELOAD_MODULES="lvm cryptodisk luks"

Update the GUB2 menu:

# update-grub

Regenerate the initrd:

# update-initramfs -u -k all

Do you feel lucky?

# exit
# reboot