172 lines
3.4 KiB
Markdown
172 lines
3.4 KiB
Markdown
title: Encrypted rootfs with Alpine Linux
|
|
---
|
|
pub_date: 2020-10-08
|
|
---
|
|
author: ungleich
|
|
---
|
|
twitter_handle: ungleich
|
|
---
|
|
_hidden: no
|
|
---
|
|
_discoverable: yes!
|
|
---
|
|
abstract:
|
|
How to encrypt your root filesystem with Alpine Linux
|
|
---
|
|
body:
|
|
|
|
## Introduction
|
|
|
|
This is a short guide on how to encrypt your root filesystem on Alpine
|
|
Linux. This article assumes an EFI based system.
|
|
|
|
## Booting Alpine Linux
|
|
|
|
Use the standard Alpine Linux installer to boot. Prepare networking
|
|
and and apkrepos:
|
|
|
|
```
|
|
setup-interfaces
|
|
```
|
|
|
|
If you are in an IPv6 only network, setup a nameserver. At the moment
|
|
Alpine Linux does not start rdnssd by default. The following works for
|
|
VMs on [Data Center Light](https://datacenterlight.ch)
|
|
|
|
```
|
|
echo nameserver 2a0a:e5c0:2:a::a
|
|
```
|
|
|
|
Then setup the repos:
|
|
|
|
```
|
|
setup-apkrepos
|
|
```
|
|
|
|
Optional, if you want to continue the installation remotely from
|
|
another computer via ssh:
|
|
|
|
```
|
|
setup-sshd
|
|
```
|
|
|
|
And then add your ssh key to /root/.ssh/authorized keys. We are using
|
|
the key.wf service for staff at ungleich:
|
|
|
|
```
|
|
mkdir -p /root/.ssh/
|
|
wget -O ~/.ssh/authorized_keys key.wf/nico
|
|
```
|
|
|
|
## Create partitions
|
|
|
|
In this guide we assume you create 3 partitions, based on gpt:
|
|
|
|
* /boot: a vfat partition usable for EFI boot (usually ~500MB)
|
|
* swap: the swap partition (usually ~half RAM)
|
|
* root: the partition containing the root filesystem
|
|
|
|
In the the following sections we assume your disk is **/dev/sda**. If you
|
|
are using NVMe, your disk might also be **/dev/nvme0n1** or similar.
|
|
|
|
```
|
|
apk add gptfdisk
|
|
gdisk /dev/sda
|
|
# create new partition table if it does not exist or you want to start clean
|
|
# create the partitions
|
|
```
|
|
|
|
## Format partitions
|
|
|
|
```
|
|
mkfs.vfat /dev/sda1
|
|
apk add cryptsetup
|
|
|
|
# Enter YES and your password twice
|
|
cryptsetup luksFormat /dev/sda3
|
|
|
|
# Create DM device
|
|
cryptsetup luksOpen /dev/sda3 rootfs
|
|
|
|
# Create filesystem
|
|
apk add e2fsprogs
|
|
mkfs.ext4 /dev/mapper/rootfs
|
|
|
|
# Mount filesytems
|
|
mount /dev/mapper/rootfs /mnt
|
|
mkdir /mnt/boot
|
|
mount /dev/sda1 /mnt/boot
|
|
|
|
```
|
|
|
|
## Configure initramfs
|
|
|
|
We need to enable rootfs decryption on boot. For this we need to add
|
|
cryptsetup into the feature list of /etc/mkinitfs/mkinitfs.conf:
|
|
|
|
```
|
|
hike:/etc# cat /etc/mkinitfs/mkinitfs.conf
|
|
features="ata base ide scsi usb virtio ext4 cryptsetup"
|
|
```
|
|
|
|
Regenerate the initramfs:
|
|
|
|
```
|
|
mkinitfs
|
|
```
|
|
|
|
## Configure and install the bootloader
|
|
|
|
We will be using grub for booting:
|
|
|
|
```
|
|
apk add grub-efi efibootmgr
|
|
```
|
|
|
|
Update the /etc/default/grub to contain the cryptroot kernel
|
|
parameter in the GRUB_CMDLINE_LINUX_DEFAULT variable:
|
|
|
|
```
|
|
hike:/# cat /etc/default/grub
|
|
GRUB_DISTRIBUTOR="Alpine"
|
|
GRUB_TIMEOUT=2
|
|
GRUB_DISABLE_SUBMENU=y
|
|
GRUB_DISABLE_RECOVERY=true
|
|
GRUB_CMDLINE_LINUX_DEFAULT="cryptroot=/dev/sda3 cryptdm=root"
|
|
```
|
|
|
|
Regenerate the grub configuration:
|
|
|
|
```
|
|
grub-mkconfig -o /mnt/boot/grub/grub.cfg
|
|
```
|
|
|
|
Verify it has been added correctly:
|
|
|
|
```
|
|
hike:/# grep crypt /boot/grub/grub.cfg
|
|
linux /vmlinuz-lts root=UUID=fa67b307-e155-47d8-98a6-4930131b5cd3 ro modules=sd-mod,usb-storage,ext4 nomodeset quiet rootfstype=ext4 cryptroot=/dev/sda3 cryptdm=root
|
|
```
|
|
|
|
Install grub:
|
|
|
|
```
|
|
grub-install --efi-directory /mnt/boot
|
|
```
|
|
|
|
## Install to disk
|
|
|
|
All changes so far have been done in RAM. Let's persist them:
|
|
|
|
```
|
|
setup-disk /mnt
|
|
```
|
|
|
|
## Final step
|
|
|
|
If everything went well so far - it's time to reboot your fully
|
|
encrypted system. The usual steps like setting up the root password or
|
|
the hostname have been skipped for the sake brevity.
|
|
|
|
Enjoy your full encrypted [Alpine Linux](https://alpinelinux.org/)!
|