Here's how I've tried to achieve this on a netbook, in I think the
simplest way possible (i.e. not using LVM):
- get debian-6.0.1a-i386-CD-1.iso, write it to a USB flash stick using
unetbootin, boot the graphical installer from it
- choose "manual" in the partitioner,
* delete all existing partitions
* create small partition and set it up to be ext3 for /boot
* create big partition and set it up to be ext4 for /usr
* create big partition and set it up for crypt usage
* create small partition and set it up for crypt usage
* choose "set up crypt volumes" (or so),
- say no to "overwrite with random data" (too slow for me;
actually I went to a console and used "fastrandom"[1] to
overwrite them)
- give password (2*2 times, twice for each of the two encrypted
partitions)
* set up the big encrypted partition to be ext4 for /
* set up the small encrypted partition to be swap
- let it install the base system; when it says "No installable kernel
was found in the defined APT sources", go to the console, run
# chroot /target
# vi /etc/apt/sources.list
(file is empty, insert sources)
# apt-get update
# apt-get install linux-image-686
- let the installer continue; when it says
apt configuration problem
An attempt to configure apt to install additional packages from
the CD failed.
just confirm that it should fetch things from the net
(at that point it will replace sources.list with its own)
- let it install into the MBR; let it reboot, remove the USB flash
stick; after letting grub boot the default entry, and after waiting
~30-45 seconds for the initrd to time out waiting for the root volume
to appear, when thrown to the emergency shell, type this (I've had
this problem on another laptop of mine where I installed Squeeze when
it was testing, already):
# cryptsetup luksOpen /dev/sda4 sda4_crypt
command cryptsetup not found
Oh, it doesn't even have cryptsetup in the initrd now. Write GRML to
the USB flash stick and boot from that.
Run cryptsetup luksOpen ..., mount and then mount --bind proc / dev /
sys, mount /usr and /boot, then:
# apt-get install busybox
# update-initramfs -u
Installing busybox makes a warning "W: Busybox is required for
successful boot!" from update-initramfs go away, and makes the initrd
a little bigger; but it still doesn't include cryptsetup.
I've compared /etc/initramfs-tools/* with my other system (laptop) and
they are the same, so why does update-initramfs include the crypto
stuff on my laptop (even if the password asking part doesn't work
there) but not at all on the netbook?
(I'm also wondering whether nobody ever tested installing Squeeze with
an encrypted roofs, that can't be true, right, but then why aren't the
problems I ran into known?)
Note that the info below is from my laptop, not the netbook, since I
can't boot the latter. As mentioned it is running squeeze, too, and
uses the same setup regarding / and /usr. As mentioned, on this
laptop update-initramfs at least does include cryptsetup (and I don't
know why), though.
Kernel: Linux 2.6.37.3 (SMP w/2 CPU cores)
Locale: LANG=en_CA.UTF-8, LC_CTYPE=en_CA.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages initramfs-tools depends on:
ii cpio 2.11-4 GNU cpio -- a program to manage ar
ii findutils 4.4.2-1+b1 utilities for finding files--find,
ii klibc-utils 1.5.20-1 small utilities built with klibc f
ii module-init-tools 3.12-1 tools for managing Linux kernel mo
ii udev 164-3 /dev/ and hotplug management daemo
Versions of packages initramfs-tools recommends:
ii busybox 1:1.17.1-8 Tiny utilities for small and embed
Versions of packages initramfs-tools suggests:
ii bash-completion 1:1.2-3 programmable completion for the ba
-- no debconf information
--
To UNSUBSCRIBE, email to debian-kernel-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: 20110610014436.12344.71782.reportbug@tie.local">ht tp://lists.debian.org/20110610014436.12344.71782.reportbug@tie.local
06-10-2011, 02:10 AM
Christian Jaeger
Bug#629985: initramfs-tools: encrypted rootfs doesn't work
> * * actually I went to a console and used "fastrandom"[1] to
[1] https://github.com/pflanze/fastrandom
(PS. I previously also sent a mail to the debian-boot mailing list on
that issue / those issues, "How to install with encrypted root?")
--
To UNSUBSCRIBE, email to debian-kernel-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: BANLkTi=CyBfCB3YayNzW6PTQLMbWdoeF-w@mail.gmail.com">http://lists.debian.org/BANLkTi=CyBfCB3YayNzW6PTQLMbWdoeF-w@mail.gmail.com
Bug#629985: initramfs-tools: encrypted rootfs doesn't work
