1

Topic: Cannot encrypt Hyperbola installation

I sometimes practise installing Hyperbola on a virtual machine to make sure I know how to do it right for the real thing. Every time I try to encrypt my installation.

Following the instructions, I believe I'm supposed to do it near the beginning by
creating a LUKS partition, which I need to start by entering the command "modprobe dm-mod" but the system doesn't recognise the command.

What am I missing?

Also, if I decide to install in a computer with two hard drives: with my root partition in one drive
and my home partition in the second, how do I still encrypt my installation?

Plus is it possible to perform a cascaded encryption with LUKS like it is with VeraCrypt?

2 (edited by koszko 2019-09-03 23:08:10)

Re: Cannot encrypt Hyperbola installation

burhen42 wrote:

I sometimes practise installing Hyperbola on a virtual machine to make sure I know how to do it right for the real thing. Every time I try to encrypt my installation.

From your other post I conclude, that You're buying a libreboot device. Libreboot runs GRUB from ROM, so, as You may already know, You can (and should smile) do FDE (full disk encryption). Thus, You can encrypt the entire filesystem. The problem is, an emulator will, by default, bahave like a usual BIOS PC. This means, it won't run it's own embedded GRUB like Libreboot would, but rather try to run code in the Master Boot Record of the virtual disks provided to it, rendering FDE impossible.
The "right" thing to do would be to use libreboot rom for qemu. I put double-quotes around 'right', because you could just install GRUB on one virtual disk and fully encrypt the another one...
Sorry if I'm telling You sth You've already done/learnt by yourself tongue

burhen42 wrote:

Following the instructions, I believe I'm supposed to do it near the beginning by
creating a LUKS partition, which I need to start by entering the command "modprobe dm-mod" but the system doesn't recognise the command.

What am I missing?

What exactly gets outputted? Is cryptsetup installed?

burhen42 wrote:

Also, if I decide to install in a computer with two hard drives: with my root partition in one drive
and my home partition in the second, how do I still encrypt my installation?

You'll have to create 2 LUKS volumes, one on each drive. And You'll have to tell the system to unencrypt and mount both at boot. Kernel takes care of / using command line parameters passed to it (cryptdevice=device:dmname, etc...). For dealing with /home, use /etc/fstab and /etc/crypttab (didn't even know such file exists before researching your question smile)

Another option is to have LVM set up on both volumes and LUKS on top of that... But I recommend the first approach

burhen42 wrote:

Plus is it possible to perform a cascaded encryption with LUKS like it is with VeraCrypt?

I haven't heard of such possibility. Is this really desired? I.e. AES has been around for some time and nobody has broken it yet, so it probably won't happen. Same applies to other ciphers commonly used in LUKS. Hence no need to use one on top of another... unless one wants to advertise with multiple encryption big_smile

EDIT: I wrote, that I recommend LVM-on-LUKS over LUKS-on-LVM. After fully reading your other post and some SSD stuff on the net, I think both approaches have their pros and cons. Read on here and here.