Skip to content

Instantly share code, notes, and snippets.

@plar
Last active November 6, 2021 19:07
Show Gist options
  • Save plar/5158dfa441d2c53ee8ba456028714583 to your computer and use it in GitHub Desktop.
Save plar/5158dfa441d2c53ee8ba456028714583 to your computer and use it in GitHub Desktop.
Ubuntu_Full_Disk_Encryption_Howto_2019 (shell commands)
sudo -i
export DEV="/dev/sda"
export DEV="/dev/nvme0n1"
export DM="${DEV##*/}"
export DEVP="${DEV}$( if [[ "$DEV" =~ "nvme" ]]; then echo "p"; fi )"
export DM="${DM}$( if [[ "$DM" =~ "nvme" ]]; then echo "p"; fi )"
# export SDD_PASS=secret123
sgdisk --print $DEV
sgdisk --zap-all $DEV
sgdisk --new=1:0:+1024M $DEV
sgdisk --new=2:0:+256M $DEV
sgdisk --new=3:0:+256M $DEV
sgdisk --new=5:0:0 $DEV
sgdisk --typecode=1:8301 --typecode=2:ef02 --typecode=3:ef00 --typecode=5:8301 $DEV
sgdisk --change-name=1:/boot --change-name=2:GRUB --change-name=3:EFI-SP --change-name=5:rootfs $DEV
sgdisk --hybrid 1:2:3 $DEV
sgdisk --print $DEV
# crypto
echo -n "${SDD_PASS}" | cryptsetup luksFormat --type=luks1 ${DEVP}1 --key-file -
echo -n "${SDD_PASS}" | cryptsetup luksFormat ${DEVP}5 --key-file -
echo -n "${SDD_PASS}" | cryptsetup open ${DEVP}1 LUKS_BOOT --key-file -
echo -n "${SDD_PASS}" | cryptsetup open ${DEVP}5 ${DM}5_crypt --key-file -
mkfs.ext4 -L boot /dev/mapper/LUKS_BOOT
mkfs.vfat -F 16 -n EFI-SP ${DEVP}3
pvcreate /dev/mapper/${DM}5_crypt
vgcreate ubuntu-vg /dev/mapper/${DM}5_crypt
lvcreate -L 4G -n swap_1 ubuntu-vg
lvcreate -l 100%FREE -n root ubuntu-vg
# install ubuntu, minimum
# map boot /boot
# map root /
# map swap swap area
# run the following command immediately after Ubuntu Installation
while [ ! -d /target/etc/default/grub.d ]; do sleep 1; done; echo "GRUB_ENABLE_CRYPTODISK=y" > /target/etc/default/grub.d/local.cfg
# Post-Installation Steps
mount /dev/mapper/ubuntu--vg-root /target
for n in proc sys dev etc/resolv.conf; do mount --rbind /$n /target/$n; done
chroot /target
mount -a
apt install -y cryptsetup-initramfs
echo "KEYFILE_PATTERN=/etc/luks/*.keyfile" >> /etc/cryptsetup-initramfs/conf-hook
echo "UMASK=0077" >> /etc/initramfs-tools/initramfs.conf
mkdir /etc/luks
dd if=/dev/urandom of=/etc/luks/boot_os.keyfile bs=512 count=1
chmod u=rx,go-rwx /etc/luks
chmod u=r,go-rwx /etc/luks/boot_os.keyfile
echo -n "${SDD_PASS}" | cryptsetup luksAddKey ${DEVP}1 /etc/luks/boot_os.keyfile --key-file -
echo -n "${SDD_PASS}" | cryptsetup luksAddKey ${DEVP}5 /etc/luks/boot_os.keyfile --key-file -
echo "LUKS_BOOT UUID=$(blkid -s UUID -o value ${DEVP}1) /etc/luks/boot_os.keyfile luks,discard" >> /etc/crypttab
echo "${DM}5_crypt UUID=$(blkid -s UUID -o value ${DEVP}5) /etc/luks/boot_os.keyfile luks,discard" >> /etc/crypttab
update-initramfs -u -k all
# reboot
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment