4

I want to install Ubuntu with full disk encryption using LVM but split over multiple drives.

For example, if I wanted everyting on /dev/sda except /var which went to /dev/sdb ? I can see how to do this without LVM by editing the partitions using the 'something else' option

From the installer it seems I can only install to a single drive when selecting LVM. Have I missed something ?

1 Answer 1

4

The installer does not support this scenario, so you'll have to do it manually.

There are many approaches that you can go with, and because you want /var explicitly to be on a separate physical volume, here's what I would do:

  • First of all, install Ubuntu using the installer on the first physical volume (sda) with LUKS encryption and LVM, and later add the second volume. This will install /var on your drive, which you don't want to, but this is only temporary.

  • Then set up LUKS on your second physical volume (sdb). You can either use a passphrase:

    cryptsetup luksFormat /dev/sdb1 # Assuming that sdb1 is the partition where
                                    # you want to create the LUKS container.
                                    # You can also use your entire drive (/dev/sdb)
                                    # and have no partition table.
    
  • Open the LUKS container that you just created:

    cryptsetup luksOpen /dev/sdb1 lvm-var
    

    Now if you check dmsetup you should see two LUKS containers: one that was created during the Ubuntu installation (let's call it lvm-ubuntu for simplicity, though the name will be different), and one that we just created:

    $ dmsetup ls --target=crypt
    lvm-ubuntu ...
    lvm-var    ...
    
  • Initialize the LUKS container for use with LVM:

    pvcreate /dev/mapper/lvm-var
    

    Now if you type pvs you should see two LVM physical volumes: the one where you installed Ubuntu and the new physical volume lvm-var:

    $ pvs
      PV                     VG         Fmt  Attr PSize    PFree   
      /dev/mapper/lvm-ubuntu ubuntu-vg  lvm2 ...  ...      ...
      /dev/mapper/lvm-var               lvm2 ...  ...      ...
    
  • Create a new LVM volume group inside our new LVM physical volume:

    vgcreate var-vg /dev/mapper/lvm-var
    

    Now vgs should list it alongside the volume group create during installation:

    $ vgs
      VG         #PV #LV #SN Attr   VSize    VFree   
      ubuntu-vg    1   1 ...
      var-vg       1   0 ...
    
  • Create a new LVM logical volume inside the group:

    lvcreate -L<size> -n var var-vg # Choose a size for your volume group. You can
                                    # specify 100%, but I always recommend using a
                                    # fraction of the available space, because you
                                    # can always grow logical volumes and
                                    # filesystems online, but shrinking it is a
                                    # pain.
    

    And lvs should reflect our changes:

      LV   VG        Attr       LSize   Pool Origin Data%  Meta%  Move Log Cpy%Sync Convert
      root ubuntu-vg -wi-ao---- ...
      var  var-vg    -wi-a----- ...
    
  • Initialize an ext4 filesystem on that logical volume (or whatever filesystem type you prefer):

    mkfs.ext4 /dev/var-vg/var
    

    Confirm that the filesystem was created with lsblk.

  • Almost there! Now we need to tell Ubuntu to open mount the LUKS container and filesystem automatically on boot. In order to do that:

    • Add this line to /etc/crypttab:

      var-vg UUID=<uuid of /dev/sdb1> none luks,discard,keyscript=decrypt_keyctl
      

      You can get the UUID with lsblk -f. The keyscript=decrypt_keyctl is there so that you don't have to enter the same phassphrase twice on boot (in case your two LUKS containers are using the same phassprase).

    • Add this line to /etc/fstab:

      /dev/var-vg/var /var ext4 defaults 0 1
      

You're done! Now you can copy all the files from the /var on the first drive to the new logical volume on the second drive.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .