unofficial mirror of bug-guix@gnu.org 
 help / color / mirror / code / Atom feed
* bug#72889: Support for root filesystem on btrfs raid1 on two LUKS devices
@ 2024-08-30  7:07 amano.kenji via Bug reports for GNU Guix
  2024-09-05  1:56 ` bug#72889: A new insight amano.kenji via Bug reports for GNU Guix
  2024-09-10 13:14 ` bug#72889: I thought of a possible way to do this amano.kenji via Bug reports for GNU Guix
  0 siblings, 2 replies; 3+ messages in thread
From: amano.kenji via Bug reports for GNU Guix @ 2024-08-30  7:07 UTC (permalink / raw)
  To: 72889

Imagine that root filesystem is btrfs raid1 on two LUKS devices.

To mount it on initial ram disk, guix has to first unlock two LUKS devices with one password.




^ permalink raw reply	[flat|nested] 3+ messages in thread

* bug#72889: A new insight
  2024-08-30  7:07 bug#72889: Support for root filesystem on btrfs raid1 on two LUKS devices amano.kenji via Bug reports for GNU Guix
@ 2024-09-05  1:56 ` amano.kenji via Bug reports for GNU Guix
  2024-09-10 13:14 ` bug#72889: I thought of a possible way to do this amano.kenji via Bug reports for GNU Guix
  1 sibling, 0 replies; 3+ messages in thread
From: amano.kenji via Bug reports for GNU Guix @ 2024-09-05  1:56 UTC (permalink / raw)
  To: 72889@debbugs.gnu.org

I guess this is going to require passphrase reuse for mapped devices.




^ permalink raw reply	[flat|nested] 3+ messages in thread

* bug#72889: I thought of a possible way to do this.
  2024-08-30  7:07 bug#72889: Support for root filesystem on btrfs raid1 on two LUKS devices amano.kenji via Bug reports for GNU Guix
  2024-09-05  1:56 ` bug#72889: A new insight amano.kenji via Bug reports for GNU Guix
@ 2024-09-10 13:14 ` amano.kenji via Bug reports for GNU Guix
  1 sibling, 0 replies; 3+ messages in thread
From: amano.kenji via Bug reports for GNU Guix @ 2024-09-10 13:14 UTC (permalink / raw)
  To: 72889@debbugs.gnu.org

- /dev/sda

/dev/sda1: A tiny LUKS partition that's filled with the content of a keyfile without any filesystem format.
/dev/sda2: /boot for grub. It also serves as FAT32 EFI partition.

- /dev/sdb

/dev/sdb1: /gnu/store on btrfs raid1
/dev/sdb2: / on btrfs raid1 on LUKS

- /dev/sdc

/dev/sdc1: /gnu/store on btrfs raid1
/dev/sdc2: / on btrfs raid1 on LUKS

Open /dev/sda1 as a luke device, /dev/mapper/key, with one password. It contains a keyfile without any filesystem format. Use /dev/mapper/key as a keyfile for all other LUKS devices in mapped devices.

This exposes /gnu/store, but /gnu/store is not supposed to have any sensitive data. This obviously makes it practically impossible to detect physical tempering of data, but if you store it at a secure location, you don't have to worry too much about evil maid attack.

RAID1 for physically secure servers is enough to ensure some availability when a disk fails.

For laptops that you carry, you are not going to use btrfs raid1, and you can just have unencrypted /boot on fat32 and / on btrfs on luks. extra-initrd contains a keyfile for / so that I don't have to type the password twice.

A desktop computer doesn't require server-level availability, but people who have money can still put root on encrypted btrfs raid1.

Perhaps, can this be documented in the cook book?




^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2024-09-10 13:15 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-08-30  7:07 bug#72889: Support for root filesystem on btrfs raid1 on two LUKS devices amano.kenji via Bug reports for GNU Guix
2024-09-05  1:56 ` bug#72889: A new insight amano.kenji via Bug reports for GNU Guix
2024-09-10 13:14 ` bug#72889: I thought of a possible way to do this amano.kenji via Bug reports for GNU Guix

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).