My work requires us to have full-disk encryption, so these are the steps I use.
The basic idea is to create a LUKS-encrypted partition which is used as an LVM Physical Volume.
The GRUB boot partition isn't encrypted, but everything else is.
These steps tested and working on 22.04 (jammy) and 20.04 (focal). For a target OS of Debian 11, I have used and tested this guide: https://linuxconfig.org/how-to-install-debian-on-an-existing-luks-container
pkg update
To install and update packages on Debian, Ubuntu, or most derived distributions, you use APT, the Advanced packaging tool, to download the packages and their dependencies, which uses dpkg to install them.
These notes go into the downloading part, as I think it's easy to get overwhelmed by how the repositories work. I will eventually turn this into a page on my website.
A repository is where the packages come from. It provides binary packages for an arbitrary selection of architectures as well as source packages. Repositories are APT's data source. [https://wiki.debian.org/DebianRepository]
| function readingTime(txt) { | |
| const wpm = 225; // average adult reading speed (words per minute). | |
| const words = txt.trim().split(/\s+/).length; | |
| const time = Math.ceil(words / wpm); | |
| return time; | |
| } | |
| const time = readingTime( | |
| document.querySelector("article").innerText | |
| ); |
Sometimes it seems like the first (and sometimes only) advice you get offered for almost any problem with a Raspberry Pi is "check your power supply". You think something like:
"hey, I'm using an official power supply sold as being matched with my Pi so how can there be any problem?"
You look up the specs then stick a controlled load across your supply and confirm that it can deliver the required number of Watts.
Yet your problems persist…
| #!/bin/bash | |
| san="DNS:localhost, DNS:localhost.localdomain, IP:127.0.0.1, DNS:app, DNS:app.localdomain" | |
| date=$(date -uI) | |
| openssl genpkey -out tempca.key -outform PEM -algorithm RSA | |
| openssl req -out tempca.csr -key tempca.key -subj "/CN=TempCA$date" -new | |
| openssl x509 -req -days 366 -signkey tempca.key -in tempca.csr -outform der -out tempca.crt | |
| openssl genpkey -out localhost.key -algorithm EC -pkeyopt "ec_paramgen_curve:prime256v1" | |
| openssl req -new -sha256 -key localhost.key -subj "/CN=localhost" -outform pem -out localhost.csr |
| from pathlib import Path | |
| from watchfiles import watch | |
| from devtools import debug | |
| THIS_DIR = Path(__file__).parent | |
| for changes in watch(THIS_DIR, debug=True): | |
| debug(changes) |
| #!/bin/dash | |
| # Creates a standalone core image with grub to be started by EFI. | |
| # It complements the excellent cryptroot tutorial at | |
| # https://community.linuxmint.com/tutorial/view/2061 | |
| # for grub on BTRFS inside LVM inside LUKS. | |
| # | |
| # It initiates decryption of the root device which contains | |
| # LVM with BTRFS on the root volume where grub is installed. | |
| # Therefore, it allows to load grub from an LUKS encrypted BTRFS | |
| # root file system. |
My work requires us to have full-disk encryption, so these are the steps I use.
The basic idea is to create a LUKS-encrypted partition which is used as an LVM Physical Volume.
The GRUB boot partition isn't encrypted, but everything else is.
These steps tested and working on 22.04 (jammy) and 20.04 (focal).
| // ***************************************************************************************** | |
| // ***************************************************************************************** | |
| // ***************************************************************************************** | |
| // ****************************************PC SA Main Script******************************** | |
| // ***************************************************************************************** | |
| // ***************************************************************************************** | |
| // ***************************************************************************************** | |
| SCRIPT_NAME MAIN //NEW MAIN |
