[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Encrypted /boot & GPT partition table using d-i - full instructions

On Mon, Dec 17, 2018 at 04:47:32PM +0100, Cyril Brulebois wrote:
> Hello,
> autosend@riseup.net <autosend@riseup.net> (2018-12-17):
> > I have managed to find a way to trick the Debian installer into
> > encrypting the /boot partition, so that only the MBR GRUB portion of
> > the hard drive is unencrypted.
> > 
> > This means the password must be input twice at boot, but on the plus
> > side, the Linux kernel lives in /boot, so the system is better
> > protected.
> > 
> > Are you interested in how I did this? I have a full step-by-step guide
> > which I have tried to minimize as much as possible.  I was hoping it
> > could be engineered into a guided installation option.
> > 
> > Note: it only involved one reboot back into the installer environment.
> > 
> > Also, I did it with GPT, which is also something that D-I should
> > support, especially when it comes to encrypted disks (GPT stores a
> > couple backups of the partition table).
> This seems like something that we should support at some point, AFAICT
> grub's cryptodisk support has been around for quite a while, but I've
> never managed to dive into it.
> A step by step guide would certainly be helpful to others, and might be
> a basis for d-i contributors to get involved in implementing this.
> Thanks for your proposal.
> Cheers,
> -- 
> Cyril Brulebois (kibi@debian.org)            <https://debamax.com/>
> D-I release manager -- Release team member -- Freelance Consultant

It was quite an effort in reverse engineering, because I couldn't find alot of
documentation on d-i at short notice via search engines, and so I essentially
took a brute-force approach. Haven't tried using preseed files to do this,
because it seems preseed files aren't as simple to load into d-i as dropping one
into the first partition of a USB drive, for example (this is where BIOS
updaters often look for a file, as an example).

OK, here are the full instructions.
Note: this is 'expert install' mode.

1.  Configure partman with 1MB /boot as ext4.
    Configure 2nd partition using 100% of space, and dedicate it as a crypto
    Note: the above can be done with fdisk on TTY2, and fdisk is better at using
      up almost 100% of disk space, by default.

    Finish configuring encrypted volume.

2.  Set the configured encrypted volume as the root '/' mount point.
    It can be either an ext4 or XFS filesystem (have not tested others).
    Note: this part must be done via partman so that d-i lets you continue.

3.  Choose to install base system and switch to TTY4
    At the point that d-i attempts to install the kernel and pauses, switch over
    to TTY2 and unmount /target/boot
    # umount /target/boot

4.  Switch back to TTY1, choose kernel to install, and install initramfs.

    If all the above steps have been followed, and no error messages _yet_ then
    now is a good time to setup users, clock, network, etc., if you want to.

5.  Choose to install the GRUB boot loader - it will fail but will at least
    successfully install the GRUB dpkgs.

6.  Switch to TTY2 and chroot into /target
    # chroot /target

7.  Install gdisk and run it on your target hard drive:
    # apt-get install -y gdisk && gdisk /dev/sda
    Note: the above assumes your target install disk is /dev/sda.

    Change the partition type of the 1MB partition to ef02.
    Write the changes to disk.

8.  Exit the chroot, switch to TTY1 and select 'finish installation' - you will
    have to select 'continue without bootloader'.

9.  Reboot, but this time instead of 'expert mode' choose 'rescue mode'.
    Unlock your disk with the LUKS password.
    Enter a shell within the install environment, either by selecting from the
    menu, or by switching to TTY2 and chrooting in.

10. Edit your /etc/default/grub within the target install volume to include the

11. Also run the following from within new install, perhaps twice for good
    # grub-mkconfig -o /boot/grub/grub.cfg
    # grub-install /dev/sda
    Note: the above assumes your target install disk is /dev/sda.

12. Delete the /boot line from /etc/fstab within the target install volume.

13. Reboot into a working install, with GPT partition table and encrypted /boot!

Because the above instructions took many many hours to create and minimise, with
so many reboots until I found a working sequence, I'd really really appreciate
it if the above could be adapted into a 'guided installation' option, then
perhaps in the future LVM could be added, once it is stable enough.
Every user of d-i would benefit from the extra security of encrypted /boot, as
well as the extra reliability of a GPT partition table. GRUB has dutifully
supported both for a while now, including Debian stable's version of GRUB.

Note that last time I checked, Red Hat's Fedora was also installing using MBR
partitions without encrypted /boot, so Debian could be ahead of the curve here.

Reply to: