LUKS Full disk encryption with Ubuntu 12.04 using the Ubiquity installer.

As noted before, there are plenty of articles on installing Ubuntu with full disk encryption. But they all recommend using the alternative install cd, which is not using Ubuntu’s ubiquity installer. If you want an Ubuntu desktop install exactly as Ubuntu developer’s intended, as I did, then read on.  Note: This is written based on the 12.04LTS installer, but much of the process may work with other versions.

  1. Boot into desktop live cd.
  2. apt-get install lvm2
    • If you don’t want to stuff your filesystem inside an LVM container, you may ignore this
  3. cryptsetup luksFormat -c twofish-xts-plain64 -s 512 <partition>
  4. cryptsetup luksOpen <partition> <luks dm device name>
    • Keep in mind that the luks device name must be the same name as the one in your crypttab that we create later.  Otherwise update-initramfs will not pick it up (that one bit me hard).
  5. vgcreate <vol group name> <luks dm device path>
  6. lvcreate -n <logical vol name> -l 100%VG <vol group name>
  7. mkfs.<desired fs> <logical volume device path>
    • This is actually an important step.  Currently the Ubiquity installer will not install a filesystem on a raw logical volume.  Without this step, you will later be compelled by the installer to install a partition table on the logical volume, which at best is a waste of space an additional unnecessary complexity.
  8. ubiquity [-b]
    • Note that you can not use the luks device as the boot device, when at the manual partitioning step below.  In most cases you don’t want this anyway because you run into the chicken-egg problem when booting (how to decrypt the boot loader at boot time when you need to boot loader to decrypt the device?)  I get around that by having an unencrypted chicken on a USB device.   However, without the ‘-b’ option, ubiquity forces me to choose a boot device and errors when I set the boot device to the luks device (there’s no other device that I want the boot partition to be).
    1. Choose manual partitioning.  You should see a line with the logical volume with the filesystem on it.
    2. Edit the logical volume, setting the label to ‘/’  and be sure that “Use as” is set to the correct filesystem.
    3. Continue with the installer until it finishes, but do not restart.
  9. Chroot into the newly installed target filesystem and prepare for updating grub.
    1. mount --bind /dev /target/dev
    2. sudo chroot /target
    3. apt-get install lvm2 — again if needed
    4. mount /proc
  10. create /etc/crypttab
    • Remember the source device name must match the current /dev/mapper name.
  11. update_initramfs -u
  12. update_grub
  13. boot into your new system.

LVM is entirely optional here, but I’ve included it because I find it to be a more flexible setup.  Also there does exist similar instructions on ubuntu’s help site that predate’s this post.  However, there’s no mention of the work around above to not having to install a partition table on the luks/lvm device.  As such, it would not precisely work for me.  This issue may be recent as of 12.04.

Advertisements

2 Responses to “LUKS Full disk encryption with Ubuntu 12.04 using the Ubiquity installer.”

  1. You made me realize about an important thing in this kind of setups.

    I was failing all the times because I was convinced that since /boot was on the usb stick, this should be boot device too. But no! The boot device should still be the hard drive where you set up the encrypted partition!
    This was a very important heads-up for me, so thanks a lot!

    Also the point about re-installing lvm2 inside chroot. I also had to install cryptsetup in it (but now I’m not sure if it was really necesary, see next point).

    Finally I had to add some modules to the initramfs config:
    echo -e “crypto\nxts\n\ndm-crypt\naes” >> /etc/initramfs-tools/modules
    (stolen from http://trisquel.info/en/forum/grub-cryptsetup-not-booting-after-kernel-update)
    Then I followed with the updates and it all worked like a charm.

  2. Hi man! how we need to create /etc/crypttab ?? wich data or structures is used in it ?

    Regards

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: