* bug#72889: Support for root filesystem on btrfs raid1 on two LUKS devices
@ 2024-08-30 7:07 amano.kenji via Bug reports for GNU Guix
2024-09-05 1:56 ` bug#72889: A new insight amano.kenji via Bug reports for GNU Guix
2024-09-10 13:14 ` bug#72889: I thought of a possible way to do this amano.kenji via Bug reports for GNU Guix
0 siblings, 2 replies; 3+ messages in thread
From: amano.kenji via Bug reports for GNU Guix @ 2024-08-30 7:07 UTC (permalink / raw)
To: 72889
Imagine that root filesystem is btrfs raid1 on two LUKS devices.
To mount it on initial ram disk, guix has to first unlock two LUKS devices with one password.
^ permalink raw reply [flat|nested] 3+ messages in thread
* bug#72889: A new insight
2024-08-30 7:07 bug#72889: Support for root filesystem on btrfs raid1 on two LUKS devices amano.kenji via Bug reports for GNU Guix
@ 2024-09-05 1:56 ` amano.kenji via Bug reports for GNU Guix
2024-09-10 13:14 ` bug#72889: I thought of a possible way to do this amano.kenji via Bug reports for GNU Guix
1 sibling, 0 replies; 3+ messages in thread
From: amano.kenji via Bug reports for GNU Guix @ 2024-09-05 1:56 UTC (permalink / raw)
To: 72889@debbugs.gnu.org
I guess this is going to require passphrase reuse for mapped devices.
^ permalink raw reply [flat|nested] 3+ messages in thread
* bug#72889: I thought of a possible way to do this.
2024-08-30 7:07 bug#72889: Support for root filesystem on btrfs raid1 on two LUKS devices amano.kenji via Bug reports for GNU Guix
2024-09-05 1:56 ` bug#72889: A new insight amano.kenji via Bug reports for GNU Guix
@ 2024-09-10 13:14 ` amano.kenji via Bug reports for GNU Guix
1 sibling, 0 replies; 3+ messages in thread
From: amano.kenji via Bug reports for GNU Guix @ 2024-09-10 13:14 UTC (permalink / raw)
To: 72889@debbugs.gnu.org
- /dev/sda
/dev/sda1: A tiny LUKS partition that's filled with the content of a keyfile without any filesystem format.
/dev/sda2: /boot for grub. It also serves as FAT32 EFI partition.
- /dev/sdb
/dev/sdb1: /gnu/store on btrfs raid1
/dev/sdb2: / on btrfs raid1 on LUKS
- /dev/sdc
/dev/sdc1: /gnu/store on btrfs raid1
/dev/sdc2: / on btrfs raid1 on LUKS
Open /dev/sda1 as a luke device, /dev/mapper/key, with one password. It contains a keyfile without any filesystem format. Use /dev/mapper/key as a keyfile for all other LUKS devices in mapped devices.
This exposes /gnu/store, but /gnu/store is not supposed to have any sensitive data. This obviously makes it practically impossible to detect physical tempering of data, but if you store it at a secure location, you don't have to worry too much about evil maid attack.
RAID1 for physically secure servers is enough to ensure some availability when a disk fails.
For laptops that you carry, you are not going to use btrfs raid1, and you can just have unencrypted /boot on fat32 and / on btrfs on luks. extra-initrd contains a keyfile for / so that I don't have to type the password twice.
A desktop computer doesn't require server-level availability, but people who have money can still put root on encrypted btrfs raid1.
Perhaps, can this be documented in the cook book?
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-09-10 13:15 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-08-30 7:07 bug#72889: Support for root filesystem on btrfs raid1 on two LUKS devices amano.kenji via Bug reports for GNU Guix
2024-09-05 1:56 ` bug#72889: A new insight amano.kenji via Bug reports for GNU Guix
2024-09-10 13:14 ` bug#72889: I thought of a possible way to do this amano.kenji via Bug reports for GNU Guix
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).