Re: [Xen-users] Automating boot of Ubuntu on encrypted LVM?

[jacek burghardt <jaceksburghardt@xxxxxxxxx>]

Would this help https://wiki.archlinux.org/index.php/Dm-crypt_with_LUKS#Storing_the_Key_File

On Mon, Apr 8, 2013 at 11:42 AM, Alexandre Kouznetsov <alk@xxxxxxxxxx> wrote:

Hello.

El 07/04/13 23:07, Fajar A. Nugraha escribió:

For example, if you just want to have dom0 boot normally while domU
boot requires some kind of password, then Mike's suggestion should
work. You encrypt everything that domU uses (domU's config file and
disk), but leave everything that only dom0 use unencrypted. One easy
way to do this is by having a separate VG:
- dom0 -> VG_1 -> PV on unencrypted disk/partition
- domU -> VG_2 -> PV on encrypted disk/partition (e.g. luks)

During boot, dom0 boot just fine, but then you log in to unencrypt the
luks partition and manually run the commands to start all domUs.

I wish to confirm, it is a very working setup. I use something very similar myself. An alternative would be to provide DomU with a initrd with embedded key, which is more complex to set up and maintain.

In both cases, it's assumed that DomU trusts Dom0, so it's perfectly legal to leave the encryption to Dom0 and reduce complexity in DomU.

In case Dom0 is administrated by someone else, it's another story.

In my case, Dom0 is also encrypted, but is uses a separate Physical Volume and Volume Group, so it's a completely independent mechanics. Dom0 asks passphrase from console or can read it form USB drive, if somebody authorized, who is near, inserts it before booting (and remove it once booted). Little bit tricky, if I where to setup something like this again, I would give a chance to a initrd with embedded minimalistic ssh server, so the key might be provided remotely.

Greetings.

--
Alexandre Kouznetsov

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxx
http://lists.xen.org/xen-users

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxx
http://lists.xen.org/xen-users