Hi,
first of all: I tried your HOWTO and what can I say? It works .... 
Now some notes ...
Code:
dd if=/dev/urandom of=/home/sidux/sda3Keyfile bs=1024 count=4
and
Code:
cryptsetup luksAddKey /dev/sda3 /home/sidux/Desktop/sda3Keyfile
You see the difference? (/home/sidux/... and /home/sidux/Desktop/....).
You create bootSda1 with
Code:
mkdir LVhome LVvar LVusr cryptRoot bootSda1
and copy the initrd to it with
Code:
mv /media/cryptRoot/boot/initrd.img /media/bootsda1/initrd.img-2.6.25-9,slh.1-sidux-686
but you do not mount /dev/sda1 to /media/bootsda1 in your HOWTO. You should add a mount line.
I think I have to add cryptdisks-early via rcconf. May that be possible?
The keyfile
Code:
mv /home/sidux/Desktop/sda3Keyfile /media/cryptRoot/root/
has wrong permissions.
It needs to be root:root with 0400 like this one:
Code:
-r-------- 1 root root 4096 4. Aug 20:43 /root/cryptkeyfile
For more information on this point have a look at the README.Debian.gz:
/usr/share/doc/cryptsetup/README.Debian.gz wrote:
3. Insecure mode/owner for keys
-------------------------------
Any key that is stored somewhere to be used with cryptsetup should have the
mode 400 (-r--------) and owner/group root. This way only root has permissions
to read the file. 'chown root.root keyfile' and 'chmod 400 keyfile' will do
the trick for you.
|
