Re: [dm-crypt] dm-crypt alignment + ssd + raid

["Thomas Bächler" <thomas@archlinux.org>]

[-- Attachment #1: Type: text/plain, Size: 2099 bytes --]

Am 04.06.2010 14:31, schrieb Philippe Cerfon:
>> The scenario dm-crypt->LVM is easier, as there is no extra layer between
>> the LV and filesystem.
> 
> Well,... I rethought the whole thing.
> I still think that RAID should be at the bottom, but then we can have either:
> a) disk-->RAID-->dm-crypt-->LVM-->fs
> or
> b) disk-->RAID-->LVM-->dm-crypt-->fs

Yes, both are supported.

> (a) seems to be more naturally, as LVM is (as you've said) directly
> below the fs,.. but... if I now add new disk because I want to enlarge
> the fs,... I'll end up in using at least different master keys, as
> dm-crypt is below LVM, right?
> This would be avoided with (b) as far as I understand.

That is correct. I use the dm-crypt->LVM setup on laptops, where a
second disk will never be added. If you expect the LVM to be split over
several VGs, then a per-logical-volume encryption seems more logical.

>>> 2) I guess at any of the levels from above, one can partition the
>>> exported block device, right?
>>> So e.g. partition the physical disks that each has one big sdX1, and
>>> create the RAID on it _OR_ create the RAID directly on the disk
>>> withoug partitioning.
>> I wouldn't rely on partitions, LVM is way more flexible.
> So what is suggested now?
> 
> I start e.g. with /dev/sd[a-d],... putting the RAID/MD directly on
> sd[a-d] or on sd[a-d]1?

If you boot from an external medium (as you say below), then I see no
need to even partition the drives. Linux handles sd[a-d] (without
partition table) just fine.

> (I ask because this might have an effect on the alignment thingy)
> 
> Then the raid gives me the "raid-device" /dev/md0. As I want several
> LUKS volumes on my RAID (all with different keys) I could now either
> partition md0, or set up LVM, right? Then on top of the
> partitions/volumes dm-crypt,... on top of this my filesystems.

Yes. I don't know how well partitioned md0 is supported. I would prefer
LVM in any case, because it is very flexible - in particular, it does
not rely on a specific physical layout of the volumes.


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 262 bytes --]