25 replies to this topic

[bvx]

Just do apt-get update then apt-get upgrade, it will redo everything.

One thing to watch out for, I've noticed on both my BT and Ubuntu is that apt-get will start saying I don't need cryptsetup and put it on the autoremove list.

Thanks. Will try.

[bolee]

I have 2 questions on the segment

a) how do I set up the swap file?

can I make a copy of the boot USB disc to another USB disc using say dd?

[Valsacar]

I have 2 questions on the segment

a) how do I set up the swap file?

can I make a copy of the boot USB disc to another USB disc using say dd?

a) make a blank file of the right size
dd if=/dev/zero bs=1024 count=4094304 of=/swapfile
That should make you a blank file of about 4GB, bs*count=endsize (I did the math in my head, might be off)
mkswap /swapfile
That tells the system it's a swapfile
swapon /swapfile
That says to start using it
edit /etc/fstab to add: /swapfile swap swap defaults 0 0
That just mounts it as swap when you reboot.
You probably also want to make it read/write by root only, instead of whatever your defaults are.

Yes, a straight dd should work fine... just don't mix them up like I did when doing an update. I also put a copy of the original key on my HD (inside the encrypted part) in case I forget to check after an update, some updates can edit /boot which might change the bits on the usb drive (and therefore wipe out the key). So anytime I do an update I check to see if the key has changed, if it did I update the key before doing a backup of the usb drive.

[int0x80]

+1 on the dd, just make sure the target drive is at least the same size as the source drive.

[bvx]

Ok, I managed to add cryptsetup to the installed system (Ubuntu in my case) and it is now possible to create the key on boot to unlock the target partition. I also had to copy the resolv.conf from the live to the installed environment for my internet (and apt-get/update/...) to work.

Only thing left is to automate the unlocking process on boot. I added a keyscript option to the crypttab file:

haktop	/dev/disk/by-uuid/UUID	none	luks,keyscript=/some-location-on-initramfs/keyscript.sh

But how do I add the keyscript file to the initramfs image?

[Valsacar]

Automating it defeats the purpose of doing it this way. If you want it automated, just use a normal key file with an ascii key instead of this method.