I have 3 partitions: EFI (/boot/efi
), boot (/boot
) and root (/
). I want to encrypt just /
. I can do this manually via the installer, but I want to preseed it.
How do I define it? My (non-encrypted) recipe looks something like the below. It is something of a mishmash of suggestions for EFI System Partitions I have found (found no clear guide).
boot-root ::
100 100 100 fat32
$primary
$iflabel{ gpt }
$reusemethod( }
use_filesystem{ } filesystem{ vfat }
method{ efi } format{ }
mountpoint{ /boot/efi }
.
300 300 300 ext4
use_filesystem{ } filesystem{ ext4 }
method{ format } format{ }
mountpoint{ /boot }
.
100% 3000 100% ext4
use_filesystem{ } filesystem{ ext4 }
method{ format } format{ }
mountpoint{ / }
.
How do I make sda3
be a physical partition for LUKS-encryption and then have a filesystem on top of that?
UPDATE:
I discovered that I can set the partition to be crypto as below, but there are still 3 issues:
- I still need to create and activate the encrypted volumes on the chosen partition
- I still need to set the correct ext4 filesystem on the encrypted volume after created and activated
- The recipe doesn't select the encryption type to
dm-crypt
which is required for creating and activating the encrypted volumes.
Still struggling mightily
boot-root ::
100 100 100 fat32
$primary
$iflabel{ gpt }
$reusemethod( }
use_filesystem{ } filesystem{ vfat }
method{ efi } format{ }
mountpoint{ /boot/efi }
.
300 300 300 ext4
use_filesystem{ } filesystem{ ext4 }
method{ format } format{ }
mountpoint{ /boot }
.
100% 3000 100% ext4
method{ crypto } format{ }
.
sda
,sdb
,sdc
, etc don't always keep the same letters (a,b,c) between boots (mine switch every boot)UUID
orPARTUUID
orLABEL
orPARTLABEL
are much better. In my case, I am booting up an image to format, so there is only one drive in. Either way, how do I set it up to crypt single partition? I can do it interactively, but I need it preseeded.