SliTaz Forum

wolfpup

Member

Registered: 2012-06-16

Posts: 3

help needed: install w/ encrypted root partition (mountbox?? grub4dos-linux??)

Hello slitaz forum! I'm new to SliTaz, and my nerd skills are quite modest,

but of course i try to do everything the most complicated way

So, i'm trying to do this:

Install SliTaz to HDD with my root partition encrypted (i'm installing from a Slitaz liveUSB). I've been searching the internet for information, but specifically for SliTaz i've only found this: http://doc.slitaz.org/en:guides:uncommoninst#crypto-install

and it is, well, a quite 'concise' guide

But i've tried to do my homework and then try out this guide, but i haven't got it working yet. I manage to create the encrypted partition, format & mount it, and copy the rootfs.gz archive to it (from a loop-mounted iso file), and then i'm able to see the contents of the installed rootfs on the partition. But,

- i haven't been able to get the boot setup working despite lots of research and experimenting, and,

- if i shutdown/reboot the liveUSB, i can't find or open the encrypted partition again.

So, before i start asking for help with my setup specifically, i'd be happy for some general info about the above-mentioned guide so that i can try to sort it out myself:

- the mountbox 'crypto button': what does it do? How does it work more specifically? I.e., what would be the process for doing the same thing manually?

- is there some essential step that is left out of this guide because it 'should be obvious'?

- On the top of the 'Unusual install methods' page it says that, "The following configurations are using the SliTaz 4.0 boot loader grub4dos-linux": what is this? How is it different from 'normal' Grub4dos - or is it some kind of modified version of Grub legacy?

So far i've been trying to get the boot setup working with both 'normal' Grub4dos and with Grub legacy with no success*, so i suppose the next thing to do is to install this grub4dos-linux package to my boot partition and try to find out how it's supposed to work, but i'd be happy to get some kind of introduction to it first. Also, it seems to me that the problem would be somewhere else, because i'm not able to decrypt/mount/open the partition through my liveUSB.

- which brings me to my obvious next question: how do you decrypt/mount/open an encrypted device previously created with mountbox?

Mountbox doesn't seem to have a function for this, and using cryptsetup in a terminal doesn't work (Error message says that the partition "is not a valid LUKS device").

- also, if someone has tried out alternative methods for installing SliTaz with encrypted root partition, i'd be very happy to hear of them. I suppose that one option for me is to do: more homework on cryptsetup/LUKS and do it all 'from scratch', but in that case i wonder if there's something specific that should be taken into account with SliTaz - it's a bit different than most other distros anyway.

I really like SliTaz so i'd really like to get this to work! Thanks for creating the coolest distro around!

-wolfpup

* I just get various errors when choosing to boot the menu entry for the encrypted partition, and then either the bootloader hangs, or i'm returned to the menu interface. With the menu.lst entry described in the guide, i get "Error 62: Number of heads must be specified etc etc", and when i modify it to

[c]title Slitaz 4.0 blah blah
find --set-root /boot/slitaz-preinit.iso
map --mem --heads=0 --sectors-per-track=0 /boot/slitaz-preinit.iso (hd1)
map --hook
root (hd1)
kernel <etc etc>[/c]
i get "Error 17: Cannot mount selected partition". I've also tried changing (hd1) to (hd32) or (0xff), but same problem.

wolfpup

Member

Registered: 2012-06-16

Posts: 3

Re: help needed: install w/ encrypted root partition (mountbox?? grub4dos-linux??)

Okay folks, here's an update on my adventures with the cryptic "Slitaz Unusual Install Methods guide":

"the mountbox 'crypto button': what does it do?"

Well, with a great deal more brain sweat & frustration, which in the end produced a little critical thinking + experimenting, i found out this:

There is a major error in the guide! Mountbox's Crypto Manager's 'Create' button does not encrypt anything, it just creates a device mapping. The button that should be used is 'Format'. This button seems to do the same thing as the command [c]cryptsetup luksFormat[/c], probably using the aes-cipher chosen from the dropdown menu in Mountbox's Crypto Manager window. At least if i choose a device and then click 'Format', the device is then recognized as a LUKS device by the terminal commands [c]cryptsetup isLuks[/c] or [c]cryptsetup luksUUID[/c], and [c]cryptsetup luksOpen[/c] prompts me for a password and then decrypts the device when i give the right password, and it works also after rebooting. So i've got the root partition sorted out, and it's also nice to know that Mountbox does the same things as the cryptsetup terminal commands. Great.

But,

the boot process is still not working - still same errors when booting with Grub4dos and the menu.lst entries described above. I suppose i could just try this, to find out what on earth this "grub4dos-linux" is & how it works:

[c]tazpkg get-install grub4dos-linux --root=/mnt/bootpartition[/c]

and then what? chroot to /mnt/bootpartition and from there try

[c]grub-install[/c]

or

[c]grub> root (hd0,0)[/c]

[c]grub> setup (hd0)[/c]

?

...

I'm actually curious about the purpose of this messy iso-mapping in the boot setup. Why? Would it not work to instead just

[c]mount -o loop /path/to/slitaz-preinit.iso /media/cdrom[/c]

[c]mount /dev/hda1 /mnt/bootpartition[/c]

[c]mkdir /mnt/bootpartition/boot[/c]

[c]cp -a /media/cdrom/boot /mnt/bootpartition[/c]

and then just install grub to the same boot directory:

[c]grub-install --root-directory=/mnt/bootpartition /dev/hda[/c]

and then the menu.lst entry would just be

[c]title SliTaz 4.0 blah blah[/c]

[c]kernel (hd0,0)/boot/bzImage cryptoroot=hda2[/c]

[c]initrd (hd0,0)/boot/rootfs.gz[/c]

Tell me if u know please.

I solemnly swear, that as soon as i've got all of this sorted out & a working setup, i'll provide some improved documentation about how to do it.

Joke of the day:

"Software terms

Encryption:  A powerful algorithmic encoding technique employed in the creation of

computer manuals."

http://www.gnu.org/fun/jokes/software.terms.html

-wolfpup