2 question concerning LVM over LUKS

I succesfully configured LVM over LUKS, but have 2 parts that are not 100% clear to me
My setup is now
/dev/vda1 /boot
/dev/vda2 LVM2 with volumegroup name lvm holding three logical volumes: lvm-root, lvm-home, lvm-swap
The following I am wondering if someone would like to clarify to me
1. For booting I added cryptdevice to my kernel with the following parameter settings
kernel /vmlinuz-linux cryptdevice=/dev/vda2:encrypted root=/dev/mapper/lvm-root ro
It doesn't seems to matter what name I use in the red part of cryptdevice.
So why do I need to put a name in this red part ?? Does it matter at all what name I use here ??
2. I did not fill in anyhting in /etc/crypttab and all seems to be working without issues.
I could have entered something like "encrypted /dev/vda2 none luks" in it....
What good would it do me to enter anything in crypttab ?? When would I really need this to be filled in ??
Hoping someone would mind to explains this to me .... thx

I just started playing with encryption so take what I say with a block of salt.
The name you give is what will show up in /dev/mapper, ie /dev/mapper/encrypted in this case. Since you're using lvm I think you could change the name every boot if you wanted. OTOH, if you formatted the partition directly, you could use the /dev/mapper/encrypted in fstab for example.
On the subject of crypttab I can't help you, except to say that in my experiments with encryption I've never touched it.

Similar Messages

[SOLVED] [LVM over LUKS] TRIM forwarding doesn't work

Recently I encrypted my SSD using LUKS and created three LVM volumes on top of it. Then I added "allow-discards" to the list of kernel parameters, here is the respective entry from grub.cfg:
linux /vmlinuz-linux root=/dev/mapper/vgarch-root ro cryptdevice=/dev/sda2:vgarch:allow-discards cryptkey=/dev/disk/by-uuid/02F2-CDB8:vfat:/lukskey quiet logo.nologo loglevel=3 console=tty1 splash=silent,theme:arch-elegant elevator=noop transparent_hugepage=never radeon.modeset=1
And an excerpt from fstab:
/dev/mapper/vgarch-root / ext4 defaults,auto,noatime,discard 0 1
UUID=e8ba294e-9621-422d-8f40-d9ffbc715484 /boot ext2 defaults 0 2
/dev/mapper/vgarch-var /var ext4 defaults,auto,noatime,discard 0 2
/dev/mapper/vgarch-home /home ext4 defaults,auto,noatime,discard 0 2
When the system is booting up, "encrypt" hook prints the appropriate message ("Enabling TRIM/discard support."), so everything seems to work fine. But when I check for TRIM support using the following method, the last command doesn't print zeroes as expected.
[root@archhost /]# dd if=/dev/urandom of=tempfile count=100 bs=512k oflag=direct
100+0 records in
100+0 records out
52428800 bytes (52 MB) copied, 5.66872 s, 9.2 MB/s
[root@archhost /]# hdparm --fibmap tempfile
tempfile:
filesystem blocksize 4096, begins at LBA 0; assuming 512 byte sectors.
byte_offset begin_LBA end_LBA sectors
0 13969408 13970431 1024
524288 13986816 13987839 1024
1048576 14026752 14127103 100352
[root@archhost /]# hdparm --read-sector 13969408 /dev/sda
/dev/sda:
reading sector 13969408: succeeded
bc43 41aa 82eb 4200 438a 6151 cbbd 0842
4014 cfa4 17e7 b2ca 7c92 ec35 9fe3 0089
206c beba c33d 5876 89e7 0d9c 1fc7 b122
801e bdb9 82af 8885 add9 7b17 7aa4 4c69
d4c1 da55 2029 bd05 d0f0 cd22 a944 b27b
ffa7 9c29 ad4a 9292 7f3a 9e4d 9040 f135
f507 3d8b c142 6ac2 da83 167a c40e 1be4
2c58 f7b6 fb50 2ce7 c7d2 6f70 ce45 be87
bfe4 2755 4795 10ee e1e1 1362 d078 a8ac
0754 8663 6881 12e4 fe8c c1c1 795f 7617
0423 1abf eade 31d1 4bfc e7a0 5fbc 36cd
af25 febe 374a bef1 eb3b 2b73 df5c a5fe
9dc3 d5e9 e31c 97ec 35ca 4002 4beb 0917
2d72 d0e3 f0ab 8d75 0fcf ce97 500f e869
875b 7866 1528 7148 99d0 6369 3369 a639
cb39 f552 a277 62c3 1ba8 bdb3 4127 a6ca
5cdd d934 5f5b a434 a20e 980c 7bfd 6f40
7029 d9aa 294f 321e 4eab 8130 adf3 140a
5352 328b 6713 25ac c37a d33a 2be9 3699
459c fc7a 1b10 7e99 8b74 cc60 e5b9 3a85
edbb 7baf 2205 34a4 c10e 6d79 1e44 239f
dad3 ee10 b76f 76fa 569c 3b73 81e0 0848
db89 4efd c520 163e af72 b83b ff3b a924
d2f1 120d 75df f7ae 3922 1b2a ee39 5efd
3ade 6a0e f24e f14d 7444 d7b6 3c3a 5ab6
2345 420d e9a4 1811 807e 9c29 5da3 f9a0
f7cb ba53 b3f1 69c4 b76d fa9d 6a0a 0184
a69c fe16 42d9 71a9 85b9 1b01 8870 40b1
585a c191 a101 39b4 2203 b662 2a17 50fc
93ac 3a2d 2b27 22f4 ff60 f7d1 fd59 feda
1477 c56f 816a 0199 34b7 ba4c 4950 6af8
b7bf c409 d48a e701 2894 1be1 3ac9 d4b1
[root@archhost /]# rm tempfile
[root@archhost /]# sync
[root@archhost /]# hdparm --read-sector 13969408 /dev/sda
/dev/sda:
reading sector 13969408: succeeded
bc43 41aa 82eb 4200 438a 6151 cbbd 0842
4014 cfa4 17e7 b2ca 7c92 ec35 9fe3 0089
206c beba c33d 5876 89e7 0d9c 1fc7 b122
801e bdb9 82af 8885 add9 7b17 7aa4 4c69
d4c1 da55 2029 bd05 d0f0 cd22 a944 b27b
ffa7 9c29 ad4a 9292 7f3a 9e4d 9040 f135
f507 3d8b c142 6ac2 da83 167a c40e 1be4
2c58 f7b6 fb50 2ce7 c7d2 6f70 ce45 be87
bfe4 2755 4795 10ee e1e1 1362 d078 a8ac
0754 8663 6881 12e4 fe8c c1c1 795f 7617
0423 1abf eade 31d1 4bfc e7a0 5fbc 36cd
af25 febe 374a bef1 eb3b 2b73 df5c a5fe
9dc3 d5e9 e31c 97ec 35ca 4002 4beb 0917
2d72 d0e3 f0ab 8d75 0fcf ce97 500f e869
875b 7866 1528 7148 99d0 6369 3369 a639
cb39 f552 a277 62c3 1ba8 bdb3 4127 a6ca
5cdd d934 5f5b a434 a20e 980c 7bfd 6f40
7029 d9aa 294f 321e 4eab 8130 adf3 140a
5352 328b 6713 25ac c37a d33a 2be9 3699
459c fc7a 1b10 7e99 8b74 cc60 e5b9 3a85
edbb 7baf 2205 34a4 c10e 6d79 1e44 239f
dad3 ee10 b76f 76fa 569c 3b73 81e0 0848
db89 4efd c520 163e af72 b83b ff3b a924
d2f1 120d 75df f7ae 3922 1b2a ee39 5efd
3ade 6a0e f24e f14d 7444 d7b6 3c3a 5ab6
2345 420d e9a4 1811 807e 9c29 5da3 f9a0
f7cb ba53 b3f1 69c4 b76d fa9d 6a0a 0184
a69c fe16 42d9 71a9 85b9 1b01 8870 40b1
585a c191 a101 39b4 2203 b662 2a17 50fc
93ac 3a2d 2b27 22f4 ff60 f7d1 fd59 feda
1477 c56f 816a 0199 34b7 ba4c 4950 6af8
b7bf c409 d48a e701 2894 1be1 3ac9 d4b1
Is it possible at all to enable TRIM support in this case? And if yes, what did I miss?
Last edited by Atragor (2012-07-01 19:19:14)

Good, my guess then would be that your trim is working already and you should be able to invoke it also with fstrim manually to get a positive confirmation in bash.
The reason you don't see the zeros in your check should be that the hdparm reports back the wrong starting sector of the file due to offsets. See here for a thorough explanation by the developer and here another summary.

System encryption :: Luks on lvm or Lvm on Luks?

Hello,
I was reading up about lvm and luks and decided I want to encrypt my system. Until now I have been using truecrypt to encrypt a data partition which get mounted during boot. I recently bought myself a netbook and since then I've been pondering how to make the most use of HD space and keeping it secure should it get stolen.
I have 3 Harddrives in my tower. One of the HDs is my backup drive. The other two are for OSs. What I would like to do is
1) Create an encrypted volume group on HD 1 (has about 650 Gb).
2) Create 2 LVs for /root /home on HD1
3) Rsync /root and /home to the LVs HD2 -> HD1
4) HD2 secure erase
5) create VG on HD2 and add it to VG on HD1
*** My Question ***
While reading up on lvm and luks I came upon this article and I'm not quite sure which one is better suited for my situation. I don't know how easy it is to grow/add to an encrypted vg or lg.
There are two ways of setting up an encrypted disk using LVM:
1. Create the LVM and encrypt every volume separately
2. Set up LVM on top of an encrypted partition
source :: http://www.pindarsign.de/webblog/?p=767
Update : Using badblocks on /dev/sda4 didn't work as intended. It completely wiped /dev/sda. One way of going Windows free.
Luckily enough windows 7 was still able to boot without a partition table (scratches head), so I was able to copy some saved games and the downloads folder.
Last edited by whitethorn (2011-09-19 15:12:12)

Dieter@be wrote:
AFAIK you cannot resize luks/dm_crypt devices, so you lose a lot of the flexibility if you put luks on top. of lvm.
personally i do full disk encryption with luks/dm_crypt, then lvm on top of that.
btw the arch installer supports both scenarios out of the box.
Sounds like what I'm doing right now. I encrypted my first HD then added lvm on top of that. It took a little while to get a seperate boot working and chroot to get all the files setup how I want. At the moment I'm randomizing a 2 Tb harddrive 10 hours 85%. Once it finishes encrypt the drive and add lvm on top. I'm not quite sure if I can grow my /home with the space from the 2nd drive and how to decrypt it during boot

Question concerning Servicing

Hey all.
I have a question concerning the servicing of my Macbook.
My laptop (less than a year old and still under warrenty) has several dead pixels on the display and the case has developed a chip on the palm rest when the display lid (prongs) meets the palm rest (I believe that this is a popular problem). I did initiate a self repair on the chipped palm rest with super glue to fix it temporarily.
The question is if i take my laptop to the Genius bar, will I be able to get both the screen repaired and the palm rest repaired. And if so how long do you think it will take to replace both and any indication about costs.

jfdm wrote:
Hey all.
I have a question concerning the servicing of my Macbook.
My laptop (less than a year old and still under warrenty) has several dead pixels on the display and the case has developed a chip on the palm rest when the display lid (prongs) meets the palm rest (I believe that this is a popular problem). I did initiate a self repair on the chipped palm rest with super glue to fix it temporarily.
The question is if i take my laptop to the Genius bar, will I be able to get both the screen repaired and the palm rest repaired. And if so how long do you think it will take to replace both and any indication about costs.
I would think you would have no problem with just a simple super-gluing of the palm rest, provided you didn't get it all over the rest of the case. Dead pixels may be another issue. Industry standards say that a certain amount of dead pixels are acceptable. Yield would go way down if all LCD panels were required to be perfect and stay perfect. Your best course of action is to make an appointment and ask. Good luck.

Question concerning sap script

Hi all experts! I have a question concerning sap script
First some background information:
Ive created a sap script that is called from a function module and from an executable program, when I run the executable program the sap script work fine, but when I run the function module, all the variables in the sap script dont have value
In the function module the variables are defined in the top include
I dont know why these variables dont take his value from the function module
Any ideas?
Thanks in advance.
Message was edited by: Gerardo hernandez

I think that sapscript expects its variables to be in the program which calls the fm <b>by default</b>. When you test via SE37 the framework itself is the calling program and it's unlikely that it will have a variable named kunnr-name1.
To over-ride this default, inside your fm pass the 'options' parameter(type itcpo) to 'open_form' and set the 'tdprogram' value to sy-repid in the function module.
I have tested this in my own environemnt and initially got the same error as you. When I set the tdprogram variable it started working!

I have a MacBook Pro running 10.6.8 model 7.1; need to upgrade to Mavericks. My question concerns 3 software apps: Reunion 10, Quicken 2007, Appleworks 6.2.9. Any recommendations?

I have a MacBook Pro model 7.1 running 10.6.8; need to upgrade to Mavericks...question concerns 3 software apps: Reunion 10, Quicken 2007, Appleworks 6.2.9 (word processing docs). Any recommendations?

Quicken Essentials is universally loathed on this forum. Quicken 2007 updated for Lion, Mt. Lion and Mavericks for $15 is the way to go:
http://quicken.intuit.com/personal-finance-software/quicken-2007-osx-lion.jsp
Appleworks 6:
Partition your hard drive or add an external drive and install Snow Leopard and use the "dual-boot" method to run Appleworks; and/or
Install Snow Leopard Server (available by telephone order only from the Apple Store 1.800.MYAPPLE [1.800.692.7753]; part number - MC588Z/A) into Parallels and run Appleworks (and most other PowerPC apps) concurrently with Mavericks:
[click on image to enlarge]
Review Roger Wilmut's excellent series of articles, Abandoning Appleworks:
http://www.wilmut.webspace.virginmedia.com/notes/aw/page1.html

Good afternoon ladies and gentlemen! My question concerns the impossibility to open RAW-files directly from the program Adobe Bridge. At the moment when you open a RAW-file from Adobe Bridge by double-clicking, RAW-file is opened only in Photoshop. In t

Good afternoon ladies and gentlemen!
My question concerns the impossibility to open RAW-files directly from the program Adobe Bridge. At the moment when you open a RAW-file from Adobe Bridge by double-clicking, RAW-file is opened only in Photoshop. In the settings Adobe Bridge - in "open RAW-files by double-clicking in Adobe Camera Raw» box is checked. When you try any changes in the settings Adobe Bridge system displays a message:
Bridge's parent application is not active. Bridge requires that a qualifying product has been launched at least once to enable this feature.
The entire line of Adobe products on my computer updated to the latest updates. Previously, a family of products Adobe Photoshop on your computer is not set. Computer - PC, Windows 7 Enterprises.

<moved from Adobe Creative Cloud to Bridge General Discussion>

Master iPad configurator question concerning cart syncing with different versions of iPads.

I have a question concerning configurator syncing.Can the master iPad be a different version of iPad than the other synced iPads? For instance can iPad 2 be the master iPad to a group of iPad Air's? The iPad 2 has some fewer capabilities than the Air, would some settings or restrictions be left off of the iPad Airs if they were set up this way? Thanks.

There is no such thing as 'master iPad'. If you're using Configurator or Profile Manager control of the setup is done from a Macintosh.

LVM on LUKS on LVM

Does anyone know if, on a system with LVM on LUKS on LVM, a logical volume created inside a LUKS container can be added to the same volume group that the LUKS container is in? Even if this is possible, is it this just a bad idea from a security perspective? Should the outer LVM and inner LVM each have their own physical devices, volume groups, and logical volumes?

sda
└─sda1
└─Storage 254:0 0 XG 0 lvm
├─Storage-lrootvol 254:1 0 XG 0 lvm /
└─luks 254:0 0 XG 0 crypt
├─Storage-lvarvol 254:2 0 XG 0 lvm /var
├─Storage-lhomevol 254:3 0 XG 0 lvm /home
├─Storage-ltmpvol 254:4 0 XG 0 lvm /tmp
└─Storage-lswapvol 254:5 0 XG 0 lvm swap
Yes, that's what I was thinking, except that it's all on sda2 because sda1 is my EFI System partion.
Why don't you just encrypt the root partition as well? Any reason why that wouldn't work for you?
This is on a laptop, so I was trying to avoid the performance/battery life penalty of encrypting the root partition.

Might go for T400/500- Many questions concerning Think Vantage

Hi,
I am deciding on my first IBM, a T400 or T500
I have a few questions concerning the Think Vantage Function:
a) Does the recovery DVD set back the hard drive partitions to factory settings?
b) Does the Think Vantage function set back the hard drive partitions to factory settings?
This means the original size of the partitions, when they have been changed manually.
c) Does Think Vantage work with a self buyed Windows Vista?
d) Does Think Vantage work unter Windows XP
e) Does Think Vantage need drivers/ anything else to work or is it entirly working on the hardware side, so no software/ windows is needed
f)Will Think Vantage work under Windows 7 in a T400/500
g) How was the past situation? Did a under Windows XP working Think Vantage also work on Vista / have there been drivers delivered, when needed, for the new OS
h) Is it possible to set up a new OS (like Vista Ultimate) and then backup it up on a external hard drive and later recover from this?
What do I want to achieve?
I want to recover the factory settings at all times, this means partition size, number of partitions etc. and Windows Vista Business. Then I want to install Vista Ultimate do my settings and backing it up to an external drive or whatever and then recover from that all 3 Months. In the end I should be able to set back factory settings with the earliest/ first backup from Windows Business; Furthermore I might want to install Windows 7 sometimes.
Thank you for your help! Kind regards
Message Edited by Schwenker on 11-23-2008 08:23 AM

Hello,
I would recommend Acronis to do this job. Here is a link at thinkpad-forum.de.
You´ll get Acronis for free if you buy a PCWelt.
Your answers:
A. yes
B: yes
C: yes
D: yes
E: No, windows is needed and if it´s XP than MS NET 2.0 also.
F: yes, when windows 7 is out, than Thinkvantage will work then, on Server 2008 it seems to work.
G:Thinkvantage work in Vista and XP environment.
H: yes, you can backup it on a extern hdd and later recover the R&R Image to the internal disc.
What do I want to achieve?
I would recommend Acronis to do this job. Here is a link at thinkpad-forum.de.
You´ll get Acronis for free, if you buy a PCWelt.
here are some interesting benchmark with first versions of Windows 7 and XP.
Windows 7 unmasked
Perceptions becomes reality
Message Edited by Agotthelf on 23-11-2008 10:23 PM
Follow @LenovoForums on Twitter! Try the forum search, before first posting: Forum Search Option
Please insert your type, model (not S/N) number and used OS in your posts.
I´m a volunteer here using New X1 Carbon, ThinkPad Yoga, Yoga 11s, Yoga 13, T430s,T510, X220t, IdeaCentre B540.
TIP: If your computer runs satisfactorily now, it may not be necessary to update the system.
English Community Deutsche Community Comunidad en Español

I use picasa for my photos..currently there is a question mark imposed over the icon on the dock aand it won't open...what does this mean?

I use picasa for my photos..currently there is a question mark imposed over the icon on the dock and it won't open...what does this mean?
Thanks for any help.

The icon in the dock is a shortcut to the app itself.....for some reason the icon has lost contact with the app.......go to your Applications folder and drag Picasa back to the dock....a new alias (shortcut) will be created.....

Best way to securely backup LVM on LUKS encrypted system

I'm upgrading harddisks and would like to backup my system to external storage and restore it on the new disk
This is the high level plan:
1. use ecryptfs to create an encrypted directory on a mounted external stroage device
2. mount ecryptfs directory
3. use rsync to make a backup into the ecryptfs directory
4. swap harddisks
5. use an arch live usb to encrypt and partition new disk (LVM on LUKS)
6. mount external storage and mount encrypted ecryptfs on the storage
7. restore system with rsync
Is this the way to do it?
After reading a little on ecryptfs, it seems like the passphrase and keys I create work only for the current kernel using ecryptfs (adds to the kernel key ring). So my understanding is that if I try to decrypt and mount the ecryptfs using a live arch usb, I won't be able to.
Any clarification of the process would be of great help! Thank you

clfarron4 wrote:Any particular reason you're planning to use eCryptfs for the backup and LUKS for the actual system when you could use LUKS for both?
No particular reason for ecryptfs. I believe my two options are ecryptfs and encfs as described in the disk encryption comparison table: https://wiki.archlinux.org/index.php/Di … ison_table
clfarron4 wrote:
trillian wrote:After reading a little on ecryptfs, it seems like the passphrase and keys I create work only for the current kernel using ecryptfs (adds to the kernel key ring). So my understanding is that if I try to decrypt and mount the ecryptfs using a live arch usb, I won't be able to.
I'm not sure whether this is how it works. Could you show us the documentation which led you to this conclusion please?
I'm also not very familiar with keyrings and how the kernel manages it, or whether it's possible to do what I want with ecryptfs.
http://manpages.ubuntu.com/manpages/uto … ase.1.html

Questions concerning ST Simple Transformations

I got some questions concerning Simple Transformations:
1.) When editing a simple transformation, how to insert comments? In pure ABAP, a comment line must have as asterisk in the first column...
2.) I use <tt:loop>...</tt:loop> and want to use the index of the currently processed entry, like SY-TABIX when implementing a "LOOP AT itab" in ABAP. Is there a way?
Thanks for your answer, points will be rewared...
-MIKE

Hi Jack, please find some sample coding below that will solve your issue:
<tt:cond check="not-initial(ref('E1EDL20.INCO1'))">
<INCO1 tt:value-ref="E1EDL20.INCO1"/>
</tt:cond>
With the simple transformation tt cond statment you can make an XML tag optional. In below example during deserialisation xml tag <INCO1> will be skipped when not availabke in the xml and SAP data E1EDL20.INCO1 will not be filled by the transformation.
Regards. Please give points when usefull !

My question concerns the ipad monthly calendar view.

My question concerns the ipad monthly calendar view. An all day event spans two days in the monthly calendar view. Is this a bug?

The entry is correct in day and week view. In the month view, the event carries to the next day indicating it ends at 12:00am.

Question concerning Tiger installation

Hello,
currently I have OS X 10.2.8 and most recently I bought tiger...I have a question concerning the installation process. I inserted the disk and completed the first couple of installation steps and when I get to the 3rd step to choose a hard dive to install the operating system on, my slave drive is the only option that appears, not my mac hd drive that already has the current operating system on it...should i install tiger on my slave drive or is there a way to get my home drive as an option?? I have more available space on my mac hd drive and would say that it is the main drive that contains all the information to run this computer....
any info on this matter would be greatly appreciated.....peter
Dual 1.25 GHz G4 Mac OS X (10.4.3)

when selecting the startup disk, should there always be a ? mark on the drive icon? Well, i selected the mac osx2.8 system and will try the process again.....thanks....
Dual 1.25 GHz G4 Mac OS X (10.2.x)

2 question concerning LVM over LUKS

Similar Messages

Maybe you are looking for