From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.saout.de ([127.0.0.1]) by localhost (mail.saout.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kTItCch1JsMb for ; Mon, 19 Mar 2012 08:02:20 +0100 (CET) Received: from v4.tansi.org (ns.km33513-03.keymachine.de [87.118.94.3]) by mail.saout.de (Postfix) with ESMTP for ; Mon, 19 Mar 2012 08:02:20 +0100 (CET) Received: from gatewagner.dyndns.org (84-74-163-71.dclient.hispeed.ch [84.74.163.71]) by v4.tansi.org (Postfix) with ESMTPA id 395E7205400 for ; Mon, 19 Mar 2012 08:02:20 +0100 (CET) Date: Mon, 19 Mar 2012 08:02:19 +0100 From: Arno Wagner Message-ID: <20120319070219.GA22551@tansi.org> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Subject: Re: [dm-crypt] Newbie questions: how to configure and mount an encrypted partition on bootup? List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: dm-crypt@saout.de I suggest you read up on encryption in general. If the passphrase is stored on the system, the encryption becomes totally worthless. Arno On Sun, Mar 18, 2012 at 08:33:43PM -0700, David Li wrote: > Hi, > I am totally new to dm-crypt. My OS is RHEL5/6. > > Here is what I want to do: > I have a system that is pxebooted and the root fs is nfs mounted > from > another server. But I have a local disk that can be used as an encrypted > storage perhaps for user data. In the beginning it's blank with no > partitions. > > So the first time I would let the user to decide how to partition > and > set up LUKS. From that point on each subsequent boot would automatically > mount the encrypted partitions as configured. > > I am looking for general programmable way to achieve this. Maybe > someone has done the exact thing before. > > Specifically, > 1. On first boot, how should I modify the initramfs to prompt > the > user to set up LUKS? Or initramfs is not the way, what else? > > 2. On each subsequent boot, how would I let dm-crypt to > automatically retrieve the passphrase once the user logins into the system. > Assume that the passphrase has been stored on the same server to store the > root fs. I don't want to force him to type in the LUKS passphrase again to > unlock the partitions. > Thanks. > David > _______________________________________________ > dm-crypt mailing list > dm-crypt@saout.de > http://www.saout.de/mailman/listinfo/dm-crypt -- Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name GnuPG: ID: 1E25338F FP: 0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F ---- One of the painful things about our time is that those who feel certainty are stupid, and those with any imagination and understanding are filled with doubt and indecision. -- Bertrand Russell