From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eddie Baxter Subject: LUKS encrypted root with GuixSD 0.12.0 Date: Thu, 29 Dec 2016 23:37:10 +0000 Message-ID: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary=001a1142bbc07137500544d4904c Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:58438) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cMkG2-0004MX-UU for help-guix@gnu.org; Thu, 29 Dec 2016 18:37:16 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cMkG1-0008DN-UV for help-guix@gnu.org; Thu, 29 Dec 2016 18:37:14 -0500 Received: from mail-lf0-x236.google.com ([2a00:1450:4010:c07::236]:33041) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1cMkG1-0008CK-LE for help-guix@gnu.org; Thu, 29 Dec 2016 18:37:13 -0500 Received: by mail-lf0-x236.google.com with SMTP id c13so229142032lfg.0 for ; Thu, 29 Dec 2016 15:37:11 -0800 (PST) List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: help-guix-bounces+gcggh-help-guix=m.gmane.org@gnu.org Sender: "Help-Guix" To: help-guix@gnu.org --001a1142bbc07137500544d4904c Content-Type: text/plain; charset=UTF-8 Hi, I have attempted to install GuixSD on an encrypted root using LUKS, after reading the release notes for 0.12.0 that implies this should now work - My config.scm is linked: https://gist.github.com/AcouBass/3a1a6ab28c17830a175dc7da95eb18cd I don't get any errors on installation, nor upon doing a system reconfigure. At the moment I am still having to drop to a command prompt in Grub and use the commands: insmod luks cryptomount hd0,msdos2 Which while it does work does mean I'm entering my passphrase twice (As well as having to drop to the Grub command line!) Is this still an unsupported setup for now? If not, am I doing something blatently wrong? Thanks! --001a1142bbc07137500544d4904c Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable --001a1142bbc07137500544d4904c-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: LUKS-encrypted root and unencrypted /boot with GuixSD 0.12.0 Date: Sat, 31 Dec 2016 00:52:04 +0100 Message-ID: <87inq16km3.fsf@gnu.org> References: Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:44421) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cN6y5-0005TV-Hk for help-guix@gnu.org; Fri, 30 Dec 2016 18:52:14 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cN6y4-0001mB-KM for help-guix@gnu.org; Fri, 30 Dec 2016 18:52:13 -0500 In-Reply-To: (Eddie Baxter's message of "Thu, 29 Dec 2016 23:37:10 +0000") List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: help-guix-bounces+gcggh-help-guix=m.gmane.org@gnu.org Sender: "Help-Guix" To: Eddie Baxter Cc: bug-guix@gnu.org, help-guix@gnu.org Hello! Eddie Baxter skribis: > I have attempted to install GuixSD on an encrypted root using LUKS, after > reading the release notes for 0.12.0 that implies this should now work - = My > config.scm is linked: > > https://gist.github.com/AcouBass/3a1a6ab28c17830a175dc7da95eb18cd > > I don't get any errors on installation, nor upon doing a system > reconfigure. > > At the moment I am still having to drop to a command prompt in Grub and u= se > the commands: > > insmod luks > cryptomount hd0,msdos2 The config has an unencrypted /boot and an encrypted root. What=E2=80=99s tested and known-good is a configuration with an encrypted root that contains /boot, like the one here: https://www.gnu.org/software/guix/manual/html_node/Using-the-Configuratio= n-System.html#index-encrypted-disk-1 It may be that this configuration is not correctly supported yet. I=E2=80=99m Cc=E2=80=99ing bug-guix@gnu.org so we keep track of this issue. > Which while it does work does mean I'm entering my passphrase twice > (As well as having to drop to the Grub command line!) The passphrase-twice issue seems hard to avoid: first GRUB needs to access the partition, and then the kernel needs to access it. If anyone is aware of ways to solve this, I=E2=80=99m all ears! Thanks for your report! Ludo=E2=80=99.