Quantcast
Channel: openSUSE Forums
Viewing all articles
Browse latest Browse all 40713

From 11.1 and 11.4 to 12.3 with Luks encryption.

$
0
0
Hi,

Did it Once Again! :)

This is the once promised post about migration to OS 12.3 from some old laptops of mine _With_ Luks encrypted filesystems.

I made two updates: From 11.1 to 12.3 and from 11.4 to 12.3.

Both laptops have the exact same hdd partitions:

Both boot from external usb flash drive: /dev/sdb1

The filesystems on hard drive are has follows:

Code:

/dev/sda1 swap
/dev/sda2 / ext3 encrypted with Luks
/dev/sda3 /home ext3 encrypted with Luks
/dev/sda4 /var ext3 un-encrypted filesystem

I have done as before :

http://forums.opensuse.org/english/g...ncryption.html


So my process is the exact same as the one from the old thread, maintain the /home exactly the same on disk and only make a Fresh install of the new OS, not and upgrade.

I also tried this before with OS 12.2 with no luck with grub2.

http://forums.opensuse.org/english/g...r-systems.html

I finally got time to go for it with 12.3 and the results were good with one problem: I can not remember exactly what I have done ... :(
Now both laptops boot with grub2 but both grub2 configs are different !?
I still can not determine What happened except with one thing :

On the first laptop (11.4->12.3) during the install process I choose to have grub installed in /boot , on the second one that gave me trouble I decided to install grub on the usual MBR ... and that install was the one that forced to write a kernel boot cmd line.

The overall install process is simple:

It is exactly like in:

http://forums.opensuse.org/english/g...ncryption.html

that is, install from DVD onto sda4 (non-encrypted could also be onto a usb drive/flash drive its only temporary install), do not give passwords for the encrypted partitions during the install, then boot from sda4 and there is no need to load any kernel decryption module.
During install choose a custom partitions setup with no swap and only /boot in sdb1 and / on sda4 on my case.
Also important at least for me is that I did not made an upgrade on the first laptop during install and everything went ok !?
On the second laptop I did make an upgrade during install and I had problems after when trying to boot from sda2 ...

After the install ends ok just boot and unlock the luks partitions, mount the sda2 old root onto /mnt/root for example and copy the /sda4 root onto that mount.

unlock and make sda1 swapon sda1
unlock /sda3 old home.
unlock and mount old sda2 /.
(check older thread)

Code:

cryptsetup -v luksOpen /dev/sda2 root
Code:

mkdir /mnt/root
mount -t ext3 /dev/mapper/root /mnt/root

copy current sda4 / onto old sda2 encrypted partition.

Note: before I rsynced both partitions I did delete the entire /mnt/root ...

Code:

cd /
rsync -AHSXax / /mnt/root/

You have then the encrypted partitions with the current / filesystem onto the sda2

Then change /etc/fstab and /etc/crypttab on BOTH sda4 AND the mounted /mnt/root old sda2 /.

Code:

/dev/mapper/root    /      ext3    acl,user_xattr        1 1
/dev/mapper/swap  swap    swap    defaults              0 0
/dev/mapper/home  /home    ext3    acl,user_xattr        1 2

crypttab

Code:

root /dev/sda2 none luks
home /dev/sda3 none luks
sawp /dev/sda1 none luks


Now the problems really really begin .. :) we must change initrd.
I made on both laptops the usual:

Code:

mkinitrd -d /dev/mapper/root -f "dm luks"
even once I made only

Code:

mkinitrd -d /dev/mapper/root
Has systemd is really in control I can not really say anything about the effects of this important command other then to say that if this initrd is not issued the systems boots and does not even ask for the sda2 luks passwd.

Once initrd is issued the boot does ask for the sda2 filesystem passwd.

This is were I lost the exact procedure ...

On the first laptop that was migrated from 11.4 to 12.3 I simply issued a update-bootloader --refresh editing the /etc/defaults/grub file to include the kernel cmd line of:

Code:

root=/dev/mapper/root luks_root=/dev/sda2 luks="root"
This did not work for several reasons I can no recall and I decided to erase from /boot/grub2/grub.cfg the linux kernel cmd line above ... and restored the root=UUID= xxxx that was on the second option of the grub2 menu.

Surprise! I was expecting a boot from the old sda4 / ... and ! Bang!
the laptop booted Perfectly from the encrypted sda2 !!
The UUID was the correct one for /dev/sda2 luke partition!
I really do not know what happened ...

On the second laptop (os11.1) I lost a long time because I made a wrong crypttab file but once I made that right and after many troubles I wrote the

Code:

root=/dev/mapper/root luks_root=/dev/sda2 luks="root"
directly onto /boot/grub2/grub.cfg and!
It worked fine!
On this laptop Writing the UUID of the sda2 directly on /etc/grub2/grub.cfg does not work ...

On this laptop two things were different .. grub2 is on MBR ... and I made an upgrade during first install ...

This is really a bad description of the install process because not only I don't understand deeply systemd but also because I do not yet am able to manage grub2 ..actually the first install with 12.2 was actually to Remove grub2 on boot and use only the old grub.

But it seems like the systems boot and run great and ... although I am not yet aware of why they do so, I feel confortable enough to know up-grade is possible.


Regards.

Viewing all articles
Browse latest Browse all 40713

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>