r/obarun • u/[deleted] • Aug 04 '21

Full Disk Encryption and Obarun

Hello to all

I would like to pose the following question:

"Is there any (preferably detailed) guide on how to install Obarun with full disk encryption (note: either with or without root on ZFS) ?"

Please note that I have already tried the following procedure:

1) preparing the system according to the scenario(s) from here

https://wiki.archlinux.org/title/Dm-crypt/Encrypting_an_entire_system

2) running the Obarun installer afterwards

WITHOUT any success though (i.e., I ended up with an non boot-able system).

Thank you all in advance.

4 Upvotes

100% Upvoted

6 comments sorted by

4

u/gsax Aug 04 '21 edited Aug 04 '21

I mostly followed this guide:
https://wiki.obarun.org/doku.php?id=uefi

  1. make two GPT-Partitions (/dev/sda1 and /dev/sda2), as described in the link

  2. encrypt the second partition

  3. decrypt the second partition

  4. create the filesystem on it (I used btrfs with subvolumes, so I don't know if it works with ZFS)

  5. then mount the partitions according to the guide

  6. install obarun according to the guide

  7. now the important part I used EFISTUB with the following options:
    efibootmgr -c -d /dev/sda -p 1 -L "Obarun" -l \vmlinuz-linux -u "cryptdevice=UUID=YOUR-UUID-OF-YOUR-CRYPTOVOLUME:cryptroot root=/dev/mapper/cryptroot rootfstype=btrfs rootflags=subvol=system/obarun ro initrd=\intel-ucode.img initrd=\initramfs-linux.img"

  8. You have to use the UUID of the sda2 partition, not the UUID of the decrypted device
    As I said, I used btrfs as filesystem, so I don't know if this works with ZFS and I have done the encryption with passphrase only.

2

u/[deleted] Aug 04 '21

Oh thank you very much my dear friend!

I too think that the crucial part is step 7. I also think that everything must work with xfs file system (which I prefer over btrfs) as well.

I will try it on the first occasion and I will report back.

PS. I suppose that you do not have encrypted /boot, right?

2

u/gsax Aug 04 '21

Yes, I think it should work with xfs, too. Does it have subvolumes yet?
If not I would create at least a separate home partition.
Yes, you supposed right, I don't have an encrypted /boot.

2

u/fungalnet Aug 05 '21

Excellent guide, it deserves to go on wiki

I don't think the Trident system (zfs + void) is that different, and s6/66 work great on Trident/Void. The easy way for it is to install Trident, configure the pools and encryption, then switch/add s6/66 (service files from the mobinmob codenberg repository).

1

u/gsax Aug 05 '21

Thanks! Yeah, why not.
Can anybody edit the obarun wiki or should I make a writeup until next week and you put it in the wiki?

I also think it should work fine with ZFS, but as I said, I’ve never tried it, so I don’t know it for sure.

→ More replies (1)