morgner/arch-pi3-encrypt.md

## arch-pi3-encrypt.md

      
    Raw
  

              arch-pi3-encrypt.md
            
          
    Original by Simon Perry: https://gist.github.com/pezz/5310082
Step 1

Install Arch Linux to your PI3:
https://archlinuxarm.org/platforms/armv8/broadcom/raspberry-pi-3
Backup /boot/boot.*
 cp -p /boot/boot.scr  /boot/boot.scr.woEnc
 cp -p /boot/boot.txt  /boot/boot.txt.woEnc
Step 2

Boot, update everything
 pacman -Syu
Install necessary tools:
 pacman -S rsync vim uboot-tools
Reboot and make sure everything is cool.
Step 3

Create a new partition of at least 2 GB, I normally just fill the rest of the SD card, it's up to you though. Use:
 fdisk /dev/mmcblk0
and create a new primary partition. You may use gparted on a PC. You should have:

p1 100MB being the vfat boot partition - do not mess with it.
p2 1.8GB being our current 1.8 GB root.
p3 being the new partition, sized as you wish, at least as p2.

Step 4

dd /dev/zero over the new partition (p3), just to add a minimal amount of safety:
 dd if=/dev/zero of=/dev/mmcblk0p3 bs=1M
or
 dd if=/dev/urandom of=/dev/mmcblk0p3 bs=1M
This will take a long time. If you use /dev/urandom it will take even longer. You'll get several kernel IO hung timeout messages while this runs, but it will finish. Be patient!
Create a LUKS volume on /dev/mmcblk0p3
 cryptsetup luksFormat -c aes-xts-plain -y -s 512  /dev/mmcblk0p3
or
 cryptsetup luksFormat -c aes-xts-plain64  -s 512 -h sha512 --use-random -i 30000 /dev/mmcblk0p3
Do what the command says, choose a passphrase etc.
Step 5

Open the LUKS volume and put a filesystem on it:
 cryptsetup luksOpen /dev/mmcblk0p3 root
 mkfs.ext4 /dev/mapper/root
Step 6

Mount the new filesystem:
 mount /dev/mapper/root /mnt
Step 7

rsync the current system over:
 rsync --progress -axv / /mnt/
Don't forget the trailing / on /mnt/ ! This will take a long time. Run the rsync again, just to make sure you have everything, this will be much quicker.
Step 8

Edit /etc/mkinitcpio.conf and make sure this line has:
 HOOKS=(base udev autodetect modconf block keyboard encrypt filesystems fsck)
Now generate an initrd:
 mkinitcpio -P
Step 9

Edit /boot/config.txt and add to the end:
 initramfs initrd 0x00f00000
or
 initramfs initrd followkernel
Step 10

Edit /boot/boot.txt, the kernel command line, leave whatever is there alone, add or modify:
 cryptdevice=/dev/mmcblk0p3:root:allow-discards root=/dev/mapper/root initrd=0x00f00000
For example by replacing "root=PARTUUID=${uuid}" with the former line (don't add linebreaks). Afterwards call
 /boot/mkscr
Now add the following line to /mnt/etc/fstab:
 /dev/mapper/root / ext4 defaults,discard,commit=120 0 1
Change options to what you want.
Reboot and hope it works!
Step 11

From the console, you should now be able to enter your passphrase and boot off the encrypted root. Your root filesystem is now the LUKS encrypted mmcblk0p3 and not p2.
Make sure the HOOKS line in /etc/mkinitcpio.conf on p3 matches what you edited before on p2.
Make sure /etc/fstab on this partition is correct (you did it right if it booted and you can do touch foo and write a file).
If you make any changes, reboot and ensure you can boot without any problems (if you are going to reboot, rebuild the initrd before you do - mkinitcpio -P - just to be on the safe side).
----------- new 1 ----------- to integrate
github/nicohood
sudo pacman -S --needed mkinitcpio rsync
shrink partition with gparted (on another pc), create a new partition on the end
sudo cryptsetup luksFormat -c aes-xts-plain64 -s 512 -h sha512 --use-random -i 30000 /dev/mmcblk0p3
sudo cryptsetup luksOpen /dev/mmcblk0p3 root
sudo mkfs.ext4 /dev/mapper/root
sudo mount /dev/mapper/root /mnt
sudo rsync --progress -axv / /mnt/
sudo nano /etc/mkinitcpio.conf
HOOKS="base udev autodetect modconf block keymap encrypt filesystems keyboard fsck"
sudo mkinitcpio -P
sudo nano /boot/config.txt
initramfs initrd followkernel
sudo nano /boot/cmdline.txt
cryptdevice=/dev/mmcblk0p3:root root=/dev/mapper/root
sudo nano /mnt/etc/fstab
/dev/mapper/root  /  ext4  defaults,noatime  0  1
sudo nano /mnt/etc/crypttab
root   /dev/mmcblk0p3   none   luks
----------- new 2 ----------- to check
https://github.com/NicoHood/NicoHood.github.io/wiki/Raspberry-Pi-Encrypted-Btrfs-Root