How can I manually replicate Manjaro Setup's automatic full-system encryption setup?
Clash Royale CLAN TAG#URR8PPP
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;
When I install Manjaro (16.10.3) from the LiveCD using the erase drive + encrypted option, it seems to create a setup like the following:
- Encrypted
/dev/sda1holding/and encrypted/dev/sda2used as swap - Unknown process prompts for decryption passphrase at boot
- Entering passphrase brings up GRUB menu, from which Manjaro can be booted
How is this accomplished? On the Arch wiki's "encrypted boot" section, I can only find a description for UEFI systems (my computer is BIOS only). That one also involves creating a separate (encrypted) /boot partition, which Manjaro does not create.
grub manjaro whole-drive-encryption
asked Jan 28 '17 at 9:17
user212900user212900
61
add a comment |
When I install Manjaro (16.10.3) from the LiveCD using the erase drive + encrypted option, it seems to create a setup like the following:
- Encrypted
/dev/sda1holding/and encrypted/dev/sda2used as swap - Unknown process prompts for decryption passphrase at boot
- Entering passphrase brings up GRUB menu, from which Manjaro can be booted
How is this accomplished? On the Arch wiki's "encrypted boot" section, I can only find a description for UEFI systems (my computer is BIOS only). That one also involves creating a separate (encrypted) /boot partition, which Manjaro does not create.
grub manjaro whole-drive-encryption
asked Jan 28 '17 at 9:17
user212900user212900
61
add a comment |
When I install Manjaro (16.10.3) from the LiveCD using the erase drive + encrypted option, it seems to create a setup like the following:
- Encrypted
/dev/sda1holding/and encrypted/dev/sda2used as swap - Unknown process prompts for decryption passphrase at boot
- Entering passphrase brings up GRUB menu, from which Manjaro can be booted
How is this accomplished? On the Arch wiki's "encrypted boot" section, I can only find a description for UEFI systems (my computer is BIOS only). That one also involves creating a separate (encrypted) /boot partition, which Manjaro does not create.
grub manjaro whole-drive-encryption
asked Jan 28 '17 at 9:17
user212900user212900
61
When I install Manjaro (16.10.3) from the LiveCD using the erase drive + encrypted option, it seems to create a setup like the following:
- Encrypted
/dev/sda1holding/and encrypted/dev/sda2used as swap - Unknown process prompts for decryption passphrase at boot
- Entering passphrase brings up GRUB menu, from which Manjaro can be booted
How is this accomplished? On the Arch wiki's "encrypted boot" section, I can only find a description for UEFI systems (my computer is BIOS only). That one also involves creating a separate (encrypted) /boot partition, which Manjaro does not create.
grub manjaro whole-drive-encryption
grub manjaro whole-drive-encryption
asked Jan 28 '17 at 9:17
user212900user212900
61
asked Jan 28 '17 at 9:17
user212900user212900
61
asked Jan 28 '17 at 9:17
user212900user212900
61
asked Jan 28 '17 at 9:17
user212900user212900
61
asked Jan 28 '17 at 9:17
user212900user212900
61
61
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
It appears that Grub is basically taking care of it. Notice that although you are prompted for the passphrase before the Grub menu, it is right after the "Welcome to Grub" message.
Take a look inside the grub.cfg file at the following entries:
insmod cryptodisk
insmod luks
insmod gcry_rijndael
insmod gcry_sha256
...
cryptomount -u [encrypted container UUID]
set root='cryptouuid/[encrypted container UUID]
...
search ... --hint='cryptouuid/[encrypted container UUID]
After Grub, there are some obviously important settings in /etc/mkinitcpio.conf:
FILES="/crypto_keyfile.bin"
HOOKS="[nothing out of the ordinary except `encrypt`]"
It's a recent feature of their Calamares installer that has provided this functionality on install.
Also, take a look at this if you haven't already.
answered Jan 28 '17 at 11:18
airhuffairhuff
572421
I'm confused by this. How is GRUB loaded before decryption when it's on/bootthat is part of the encrypted fs?
– user212900
Jan 28 '17 at 20:04
At some point, the installer program ran the commandgrub-install, which installed it to the master boot record of the hard drive. My guess is that grub can detect an encrypted drive/partition from there then opens the grub.cfg that it needs to finish the job, provide a menu etc., afterwords. The MBR is where the partition table lives, too. I'm pretty sure of the gist of this though I don't claim to understand every detail of the boot process.
– airhuff
Jan 28 '17 at 22:46
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f340738%2fhow-can-i-manually-replicate-manjaro-setups-automatic-full-system-encryption-se%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
It appears that Grub is basically taking care of it. Notice that although you are prompted for the passphrase before the Grub menu, it is right after the "Welcome to Grub" message.
Take a look inside the grub.cfg file at the following entries:
insmod cryptodisk
insmod luks
insmod gcry_rijndael
insmod gcry_sha256
...
cryptomount -u [encrypted container UUID]
set root='cryptouuid/[encrypted container UUID]
...
search ... --hint='cryptouuid/[encrypted container UUID]
After Grub, there are some obviously important settings in /etc/mkinitcpio.conf:
FILES="/crypto_keyfile.bin"
HOOKS="[nothing out of the ordinary except `encrypt`]"
It's a recent feature of their Calamares installer that has provided this functionality on install.
Also, take a look at this if you haven't already.
answered Jan 28 '17 at 11:18
airhuffairhuff
572421
I'm confused by this. How is GRUB loaded before decryption when it's on/bootthat is part of the encrypted fs?
– user212900
Jan 28 '17 at 20:04
At some point, the installer program ran the commandgrub-install, which installed it to the master boot record of the hard drive. My guess is that grub can detect an encrypted drive/partition from there then opens the grub.cfg that it needs to finish the job, provide a menu etc., afterwords. The MBR is where the partition table lives, too. I'm pretty sure of the gist of this though I don't claim to understand every detail of the boot process.
– airhuff
Jan 28 '17 at 22:46
add a comment |
It appears that Grub is basically taking care of it. Notice that although you are prompted for the passphrase before the Grub menu, it is right after the "Welcome to Grub" message.
Take a look inside the grub.cfg file at the following entries:
insmod cryptodisk
insmod luks
insmod gcry_rijndael
insmod gcry_sha256
...
cryptomount -u [encrypted container UUID]
set root='cryptouuid/[encrypted container UUID]
...
search ... --hint='cryptouuid/[encrypted container UUID]
After Grub, there are some obviously important settings in /etc/mkinitcpio.conf:
FILES="/crypto_keyfile.bin"
HOOKS="[nothing out of the ordinary except `encrypt`]"
It's a recent feature of their Calamares installer that has provided this functionality on install.
Also, take a look at this if you haven't already.
answered Jan 28 '17 at 11:18
airhuffairhuff
572421
I'm confused by this. How is GRUB loaded before decryption when it's on/bootthat is part of the encrypted fs?
– user212900
Jan 28 '17 at 20:04
At some point, the installer program ran the commandgrub-install, which installed it to the master boot record of the hard drive. My guess is that grub can detect an encrypted drive/partition from there then opens the grub.cfg that it needs to finish the job, provide a menu etc., afterwords. The MBR is where the partition table lives, too. I'm pretty sure of the gist of this though I don't claim to understand every detail of the boot process.
– airhuff
Jan 28 '17 at 22:46
add a comment |
It appears that Grub is basically taking care of it. Notice that although you are prompted for the passphrase before the Grub menu, it is right after the "Welcome to Grub" message.
Take a look inside the grub.cfg file at the following entries:
insmod cryptodisk
insmod luks
insmod gcry_rijndael
insmod gcry_sha256
...
cryptomount -u [encrypted container UUID]
set root='cryptouuid/[encrypted container UUID]
...
search ... --hint='cryptouuid/[encrypted container UUID]
After Grub, there are some obviously important settings in /etc/mkinitcpio.conf:
FILES="/crypto_keyfile.bin"
HOOKS="[nothing out of the ordinary except `encrypt`]"
It's a recent feature of their Calamares installer that has provided this functionality on install.
Also, take a look at this if you haven't already.
answered Jan 28 '17 at 11:18
airhuffairhuff
572421
It appears that Grub is basically taking care of it. Notice that although you are prompted for the passphrase before the Grub menu, it is right after the "Welcome to Grub" message.
Take a look inside the grub.cfg file at the following entries:
insmod cryptodisk
insmod luks
insmod gcry_rijndael
insmod gcry_sha256
...
cryptomount -u [encrypted container UUID]
set root='cryptouuid/[encrypted container UUID]
...
search ... --hint='cryptouuid/[encrypted container UUID]
After Grub, there are some obviously important settings in /etc/mkinitcpio.conf:
FILES="/crypto_keyfile.bin"
HOOKS="[nothing out of the ordinary except `encrypt`]"
It's a recent feature of their Calamares installer that has provided this functionality on install.
Also, take a look at this if you haven't already.
answered Jan 28 '17 at 11:18
airhuffairhuff
572421
answered Jan 28 '17 at 11:18
airhuffairhuff
572421
answered Jan 28 '17 at 11:18
airhuffairhuff
572421
answered Jan 28 '17 at 11:18
airhuffairhuff
572421
572421
I'm confused by this. How is GRUB loaded before decryption when it's on/bootthat is part of the encrypted fs?
– user212900
Jan 28 '17 at 20:04
At some point, the installer program ran the commandgrub-install, which installed it to the master boot record of the hard drive. My guess is that grub can detect an encrypted drive/partition from there then opens the grub.cfg that it needs to finish the job, provide a menu etc., afterwords. The MBR is where the partition table lives, too. I'm pretty sure of the gist of this though I don't claim to understand every detail of the boot process.
– airhuff
Jan 28 '17 at 22:46
add a comment |
I'm confused by this. How is GRUB loaded before decryption when it's on/bootthat is part of the encrypted fs?
– user212900
Jan 28 '17 at 20:04
At some point, the installer program ran the commandgrub-install, which installed it to the master boot record of the hard drive. My guess is that grub can detect an encrypted drive/partition from there then opens the grub.cfg that it needs to finish the job, provide a menu etc., afterwords. The MBR is where the partition table lives, too. I'm pretty sure of the gist of this though I don't claim to understand every detail of the boot process.
– airhuff
Jan 28 '17 at 22:46
I'm confused by this. How is GRUB loaded before decryption when it's on
/boot that is part of the encrypted fs?– user212900
Jan 28 '17 at 20:04
I'm confused by this. How is GRUB loaded before decryption when it's on
/boot that is part of the encrypted fs?– user212900
Jan 28 '17 at 20:04
At some point, the installer program ran the command
grub-install, which installed it to the master boot record of the hard drive. My guess is that grub can detect an encrypted drive/partition from there then opens the grub.cfg that it needs to finish the job, provide a menu etc., afterwords. The MBR is where the partition table lives, too. I'm pretty sure of the gist of this though I don't claim to understand every detail of the boot process.– airhuff
Jan 28 '17 at 22:46
At some point, the installer program ran the command
grub-install, which installed it to the master boot record of the hard drive. My guess is that grub can detect an encrypted drive/partition from there then opens the grub.cfg that it needs to finish the job, provide a menu etc., afterwords. The MBR is where the partition table lives, too. I'm pretty sure of the gist of this though I don't claim to understand every detail of the boot process.– airhuff
Jan 28 '17 at 22:46
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f340738%2fhow-can-i-manually-replicate-manjaro-setups-automatic-full-system-encryption-se%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
