{"action":"created","issue":{"url":"https://api.github.com/repos/armbian/build/issues/948","repository_url":"https://api.github.com/repos/armbian/build","labels_url":"https://api.github.com/repos/armbian/build/issues/948/labels{/name}","comments_url":"https://api.github.com/repos/armbian/build/issues/948/comments","events_url":"https://api.github.com/repos/armbian/build/issues/948/events","html_url":"https://github.com/armbian/build/pull/948","id":319050271,"number":948,"title":"Feature: Optional LUKS encryption of rootfs","user":{"login":"zciendor","id":37557036,"avatar_url":"https://avatars3.githubusercontent.com/u/37557036?v=4","gravatar_id":"","url":"https://api.github.com/users/zciendor","html_url":"https://github.com/zciendor","followers_url":"https://api.github.com/users/zciendor/followers","following_url":"https://api.github.com/users/zciendor/following{/other_user}","gists_url":"https://api.github.com/users/zciendor/gists{/gist_id}","starred_url":"https://api.github.com/users/zciendor/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zciendor/subscriptions","organizations_url":"https://api.github.com/users/zciendor/orgs","repos_url":"https://api.github.com/users/zciendor/repos","events_url":"https://api.github.com/users/zciendor/events{/privacy}","received_events_url":"https://api.github.com/users/zciendor/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2018-04-30T21:58:17Z","updated_at":"2018-05-14T15:18:04Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/armbian/build/pulls/948","html_url":"https://github.com/armbian/build/pull/948","diff_url":"https://github.com/armbian/build/pull/948.diff","patch_url":"https://github.com/armbian/build/pull/948.patch"},"body":"Initial implementation for feature request https://github.com/armbian/build/issues/947\r\n\r\nThis set of changes allows optional encryption of the root filesystem using LUKS when building the Armbian image.\r\nThe following 4 advanced build options were added:\r\n- `CRYPTROOT_ENABLE=yes                     # encrypt the root file system`\r\n- `CRYPTROOT_PASSPHRASE=\"1234\"       # passphrase to unlock root file system on boot`\r\n- `CRYPTROOT_SSH_UNLOCK=yes            # enable ssh (dropbear) during boot to unlock root file system`\r\n- `CRYPTROOT_SSH_PORT=2222              # change the ssh port of the root system to avoid host key changed conflicts`\r\n\r\n## Implementation details:\r\n\r\n#### lib/configuration.sh\r\nAdd the packages `cryptsetup` and `dropbear-initramfs` if the respective build options are set.\r\n\r\n#### packages/bsp/common/etc/init.d/resize2fs\r\nAdded logic to handle partitions of type `crypt` (LUKS container) and automatic resizing of the\r\nLUKS container before the root filesystem can be expanded.\r\n\r\n#### /lib/debootstrap-ng.sh\r\nThis file needed the most changes (mostly additions).\r\n1. We need a 2-partition layout when using LUKS encryption (`CRYPTROOT_ENABLE=yes`)\r\n2. We need to create the LUKS container before the filesystem can be created (mkfs)\r\n3. We need to add the file `/etc/crypttab` with the respective partition mapping\r\n4. `/etc/fstab` needs to mount the root filesystem from the LUKS container (crypttab)\r\n5. `/boot/armbian.txt` and `/boot/boot.ini` need to be modified accordingly to be able to boot from a `cryptroot`\r\n6. `update-initramfs` needs to be called, so `cryptsetup` and `dropbear` get included in the initrmafs\r\n7. If the build options enable early boot SSH access (`CRYPTROOT_SSH_UNLOCK=yes`) a SSH keypair needs to be generated for the `dropbear` SSH daemon. This is needed for boards without a display connector.\r\n8. If the build options specify a non-default SSH port for the root system (OpenSSH) via `CRYPTROOT_SSH_PORT=<PORT>`, we need to modify `/etc/sshd_config` accordingly.\r\n9. The crypt device (LUKS container) needs to be closed after unmounting root when image creation is complete."},"comment":{"url":"https://api.github.com/repos/armbian/build/issues/comments/388855188","html_url":"https://github.com/armbian/build/pull/948#issuecomment-388855188","issue_url":"https://api.github.com/repos/armbian/build/issues/948","id":388855188,"user":{"login":"zciendor","id":37557036,"avatar_url":"https://avatars3.githubusercontent.com/u/37557036?v=4","gravatar_id":"","url":"https://api.github.com/users/zciendor","html_url":"https://github.com/zciendor","followers_url":"https://api.github.com/users/zciendor/followers","following_url":"https://api.github.com/users/zciendor/following{/other_user}","gists_url":"https://api.github.com/users/zciendor/gists{/gist_id}","starred_url":"https://api.github.com/users/zciendor/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zciendor/subscriptions","organizations_url":"https://api.github.com/users/zciendor/orgs","repos_url":"https://api.github.com/users/zciendor/repos","events_url":"https://api.github.com/users/zciendor/events{/privacy}","received_events_url":"https://api.github.com/users/zciendor/received_events","type":"User","site_admin":false},"created_at":"2018-05-14T15:18:04Z","updated_at":"2018-05-14T15:18:04Z","author_association":"NONE","body":"@rosbeef \r\n\r\nUsing a `post-install` script is possible if you have a board like the Odroid HC1/HC2 where you can attach another disk which you use to temporarily copy the root system to while preparing the root partition on the SD card. However, I thought my approach is more generic as it works for boards which don't have a second disk. I guess both approaches are valid and have their pros & cons.\r\n\r\n**Question:** If I read your script correctly, you are using the SD card only for the `boot` partition, right? The actual root system is on the SATA disk and you use LVM to have 2 partitions there... one for `root` and one for `data`. Any specific reason, why you move the root system to the SATA disk? Better performance?"}}
{"actor":{"display_login":"zciendor"}}