Can I use my boot disk in rescue mode with an encrypted drive?

  • Permalink
  • submit to reddit
  • Email
  • Follow


Hi All,

I am thinking that the coming release of CentOS 6.0 would be a mighty 
fine time to upgrade my office computer. Got my eye on an i7-930 and a 
Supermicro X8SAX.

Anyway, when I install CentOS 6 fresh on my new hard drives (RAID), I am 
thinking it would be a good time to take advantage of the whole hard 
drive encryption feature. That said, some questions:

1) this is a deal killer: does it allow me to boot off the install disk 
in rescue mode and unlock/see/read/write my encrypted hard drives? I
must have this feature as I am constantly screwing things up. (Not an 
admission I screw thing up. Maybe once or twice. Maybe.)

2) what is the performance hit?

3) do you guys think my idea of a whole disk encryption is "practical"?

4) okay, not an encryption question, but do we finally get to use ext4?

Many thanks,
-T
0
Reply Todd 11/14/2010 5:28:55 AM

See related articles to this posting

On Sun, 14 Nov 2010 00:28:55 -0500, Todd <Todd@invalid.com> wrote:

> 1) this is a deal killer: does it allow me to boot off the install disk
> in rescue mode and unlock/see/read/write my encrypted hard drives? I
> must have this feature as I am constantly screwing things up. (Not an
> admission I screw thing up. Maybe once or twice. Maybe.)

They would not be accessible, until the needed kernel modules have been
loaded, and the appropriate programs executed.  It can be done, but no
live cd/dvd I've seen, will do it by default.

> 2) what is the performance hit?

I use a luks encrypted file system for my data, and only notice a
performance hit, when copying a large file (such as a 4+GB file, to/from
the encrypted filesystem.  During normal usage, I see no difference.

The filesystem containing /boot must not be encrypted, or the boot
manager will not be able to read it.

> 3) do you guys think my idea of a whole disk encryption is "practical"?

No, as /boot must be readable by the boot manager.

> 4) okay, not an encryption question, but do we finally get to use ext4?

I've been using ext4 for all of my file systems, for about 6 months,
including those on luks encrypted containers.  The fsck speed of ext4
is much faster than ext3.  I've lost data stored on reiserfs and xfs
file systems (open files getting file length zero after a crash), but
have not lost any on ext4.

See http://www.ody.ca/~dwhodgins/Luks-Howto.html for an explanation of
how to set up a luks encrypted filesystem.

I'm currently using the Mandriva 2010.1 version of linux.  The bulk of
the system is not encrypted.  Even /home/dave, is not encrypted.  I have
an encrypted filesystem, that is mounted at login, that contains my email,
usenet, photos, documents, videos, etc, and have replaced the appropriate
directories in /home/dave with symlinks to those directories, in the
encrypted filesystem.

Regards, Dave Hodgins

-- 
Change nomail.afraid.org to ody.ca to reply by email.
(nomail.afraid.org has been set up specifically for
use in usenet. Feel free to use it yourself.)
0
Reply David 11/14/2010 8:09:13 AM

On 11/14/2010 12:09 AM, David W. Hodgins wrote:
> On Sun, 14 Nov 2010 00:28:55 -0500, Todd <Todd@invalid.com> wrote:
>
>> 1) this is a deal killer: does it allow me to boot off the install disk
>> in rescue mode and unlock/see/read/write my encrypted hard drives? I
>> must have this feature as I am constantly screwing things up. (Not an
>> admission I screw thing up. Maybe once or twice. Maybe.)
>
> They would not be accessible, until the needed kernel modules have been
> loaded, and the appropriate programs executed. It can be done, but no
> live cd/dvd I've seen, will do it by default.
>
>> 2) what is the performance hit?
>
> I use a luks encrypted file system for my data, and only notice a
> performance hit, when copying a large file (such as a 4+GB file, to/from
> the encrypted filesystem. During normal usage, I see no difference.
>
> The filesystem containing /boot must not be encrypted, or the boot
> manager will not be able to read it.
>
>> 3) do you guys think my idea of a whole disk encryption is "practical"?
>
> No, as /boot must be readable by the boot manager.
>
>> 4) okay, not an encryption question, but do we finally get to use ext4?
>
> I've been using ext4 for all of my file systems, for about 6 months,
> including those on luks encrypted containers. The fsck speed of ext4
> is much faster than ext3. I've lost data stored on reiserfs and xfs
> file systems (open files getting file length zero after a crash), but
> have not lost any on ext4.
>
> See http://www.ody.ca/~dwhodgins/Luks-Howto.html for an explanation of
> how to set up a luks encrypted filesystem.
>
> I'm currently using the Mandriva 2010.1 version of linux. The bulk of
> the system is not encrypted. Even /home/dave, is not encrypted. I have
> an encrypted filesystem, that is mounted at login, that contains my email,
> usenet, photos, documents, videos, etc, and have replaced the appropriate
> directories in /home/dave with symlinks to those directories, in the
> encrypted filesystem.
>
> Regards, Dave Hodgins
>

Thank you!
0
Reply Todd 11/14/2010 10:01:33 PM

On Sun, 14 Nov 2010 03:09:13 -0500, David W. Hodgins wrote:
<snip>
> 
>> 3) do you guys think my idea of a whole disk encryption is "practical"?
> 
> No, as /boot must be readable by the boot manager.
> 
Another alternative is to have "boot" (at least the kernel and initrd) on 
a bootable media (cd, usb-stick, etc.).
>
<snip>
>
I can't speak for CentOS, but there are a lot of possibilities in the DIY 
(do it yourself) school. I have hacked together a means of booting 
Slackware from usb, cd, etc. My simple startup environment gives the 
ability to perform various functions including the following:

	* setup,
	* generic startup including networking for any hardware,
	* "live" system using a device mapper target
	* encrypted startup using a device mapper target

Please note that startup environment is distribution dependent and mine 
has been setup for Slackware. From what I've learned almost anything is 
possible- that is, if the user is willing to invest some time in learning 
what to do. The final point seems to be the weak link in the chain. YMMV.

-- 
Douglas Mayne
0
Reply Douglas 11/14/2010 11:19:35 PM

On 11/14/2010 03:19 PM, Douglas Mayne wrote:
> On Sun, 14 Nov 2010 03:09:13 -0500, David W. Hodgins wrote:
> <snip>
>>
>>> 3) do you guys think my idea of a whole disk encryption is "practical"?
>>
>> No, as /boot must be readable by the boot manager.
>>
> Another alternative is to have "boot" (at least the kernel and initrd) on
> a bootable media (cd, usb-stick, etc.).
>>
> <snip>
>>
> I can't speak for CentOS, but there are a lot of possibilities in the DIY
> (do it yourself) school. I have hacked together a means of booting
> Slackware from usb, cd, etc. My simple startup environment gives the
> ability to perform various functions including the following:
>
> 	* setup,
> 	* generic startup including networking for any hardware,
> 	* "live" system using a device mapper target
> 	* encrypted startup using a device mapper target
>
> Please note that startup environment is distribution dependent and mine
> has been setup for Slackware. From what I've learned almost anything is
> possible- that is, if the user is willing to invest some time in learning
> what to do. The final point seems to be the weak link in the chain. YMMV.
>

Over at Red Hat, I found this: http://www.redhat.com/rhel/server/details/

        Storage devices can be designated for encryption at
        installation time, protecting user and system data.

So, I was wondering if the installation disk, in rescue mode (note
this is not a live CD or a rescue CD, this is the "installation disk"),
had a way of looking at the hard drive.

-T
0
Reply Todd 11/15/2010 3:39:14 AM

On Sun, 14 Nov 2010 19:39:14 -0800, Todd wrote:

> On 11/14/2010 03:19 PM, Douglas Mayne wrote:
>> On Sun, 14 Nov 2010 03:09:13 -0500, David W. Hodgins wrote: <snip>
>>>
>>>> 3) do you guys think my idea of a whole disk encryption is
>>>> "practical"?
>>>
>>> No, as /boot must be readable by the boot manager.
>>>
>> Another alternative is to have "boot" (at least the kernel and initrd)
>> on a bootable media (cd, usb-stick, etc.).
>>>
>> <snip>
>>>
>> I can't speak for CentOS, but there are a lot of possibilities in the
>> DIY (do it yourself) school. I have hacked together a means of booting
>> Slackware from usb, cd, etc. My simple startup environment gives the
>> ability to perform various functions including the following:
>>
>> 	* setup,
>> 	* generic startup including networking for any hardware, * "live"
>> 	system using a device mapper target * encrypted startup using a 
device
>> 	mapper target
>>
>> Please note that startup environment is distribution dependent and mine
>> has been setup for Slackware. From what I've learned almost anything is
>> possible- that is, if the user is willing to invest some time in
>> learning what to do. The final point seems to be the weak link in the
>> chain. YMMV.
>>
>>
> Over at Red Hat, I found this:
> http://www.redhat.com/rhel/server/details/
> 
>         Storage devices can be designated for encryption at installation
>         time, protecting user and system data.
>
Most probably the method of encryption thet have chosen is LUKS. LUKS is 
implemented as a layer on top of device mapper encryption targets. AIUI, 
you can unlock LUKS if you have the proper toolset (cryptsetup, device 
mapper, etc.) As a WAG, I wager that the proper toolset is provided as 
part of the setup and rescue environments. Verify for yourself. BTW, I 
have decided not to use LUKS and stick with simple device mapper objects 
and manage my own encryption keys. For me, LUKS was just "one too many" 
abstraction layers. YMMV.

> So, I was wondering if the installation disk, in rescue mode (note this
> is not a live CD or a rescue CD, this is the "installation disk"), had a
> way of looking at the hard drive.
>
I don't know because I don't use CentOS, RedHat, etc. 
> 
> -T

Note: comments inline.

-- 
Douglas Mayne
0
Reply Douglas 11/15/2010 1:45:21 PM

On Sun, 14 Nov 2010 22:39:14 -0500, Todd <Todd@invalid.com> wrote:

> Over at Red Hat, I found this: http://www.redhat.com/rhel/server/details/
>         Storage devices can be designated for encryption at
>         installation time, protecting user and system data.
> So, I was wondering if the installation disk, in rescue mode (note
> this is not a live CD or a rescue CD, this is the "installation disk"),
> had a way of looking at the hard drive.

I doubt it.  While the installer's partitioning software may be able
to create encrypted filesystems, and create the appropriate entries
in /etc/crypttab an /etc/fstab (like Mandriva's diskdrake can do),
I doubt the rescue cd wlll find those files, and use them.  What
would happen if you boot from the rescue cd, on a system with more
than one linux installation on it?

I expect you would have to manually load the kernel modules, and then
run "cryptsetup luksOpen <rest>".

All rescue cds I've looked at use the output of blkid to generate
/etc/fstab entries, to use for mounting partitions, not the contents
of files on those filesystems.

Regards, Dave Hodgins

-- 
Change nomail.afraid.org to ody.ca to reply by email.
(nomail.afraid.org has been set up specifically for
use in usenet. Feel free to use it yourself.)
0
Reply David 11/16/2010 8:19:53 AM
comp.os.linux.misc 33317 articles. 19 followers. Post

6 Replies
302 Views

Similar Articles

[PageSpeed] 52

  • Permalink
  • submit to reddit
  • Email
  • Follow


Reply:

Similar Artilces:

Drive Image 2002 Rescue Boot disks under XP?
I'm preparing for the installation of a new hard drive on my WIN XP SP1A (NTFS) system. I am planning on using Drive Image 2002 to do a disk-to-disk clone of my existing boot drive (and associated partitions) to the brand new drive, so I though I'd better create a set of Drive Image rescue bootable floppy disks so that I could just boot off them and go straight into DI after connecting the power and IDE cables to the new drive. That went fine, but when I went to boot from them, my system complained about A:\IBMDOS.COM...I forget what the exact error message was. Now that...

Copying system drive to another one so that it could be used as a boot disk
When I bought my Mac, 10 GB was all you needed. Now, it's barely sufficient to write an e-mail. I bought a 120 GB drive and want to copy the system and all my 10 GB content to it so that I am not that limited in disk space (provided that Applications reside on the system drive and hotos from iPhotos as well as Tunes from iTunes are in there). I tried using the cp comment (cp -i -p / /Volumes/BigDrive), but that didn't work out. Is there another way for me to do this? Thanks. incognito wrote: >When I bought my Mac, 10 GB was all you needed. Now, it's barely &...

Can i Using primary IDE connector if i have already a SCSI Boot Disk ?
Greetings, Can i use primary IDE connector if i currently use SCSI like C:\ with AHA 2920C ? I want connect a new IDE 40G disk on my system, but Secondary IDE connector is full but primary IDE is empty. Currently,i use an SCSI disk defined as C booting disk. So can i have a primary Slave disk on first IDE connector and booting with my SCSI disk ? Philippe SCSI is adaptec AHA2920C <pcouas@infodev.fr> schreef in bericht news:af5681c8.0402290758.311d8468@posting.google.com... > Greetings, > > Can i use primary IDE connector if i currently use SCSI like C:\ with > AHA 2920C ?...

Why is my desktop ETS target booted using safe mode program after a format disk?
Following the web page, http://zone.ni.com/devzone/cda/tut/p/id/4480#toc8, I got some progress in developing a desktop PC as a LabVIEW real-time ETS Target. When I evaluate my PC on a floppy drive with the Desktop PC utility obtained from the pceval.zip attached to the following web document, http://digital.ni.com/public.nsf/websearch/62538D52E61FC167862571C7006EDAC0?OpenDocument, I see a message on a monitor screen, which is seen in figure 1 attached to this e-mail. At this stage, I would like to ask whether the message is normal or not. With this message, I continue to the steps configuring ...

Can't access C drive from Windows Xp boot disk
How do I make a Win Xp boot disk that will recoginize a 16 gig hard disk and allow access from the command prompt? I made a boot disk using the A: format options, but I can't get to the C drive when it boots from the floppy. Is there a driver I can add to the boot disk that will allow access to the hard drive? -Bill Probably the best option is to boot from your XP CD as it has all the necessary drivers & files. WT <wrongaddress@att.net> wrote in message news:1105426149.407196.62100@c13g2000cwb.googlegroups.com... > How do I make a Win Xp boot disk that will recogini...

Can I use slower DVD-RW disk on a 8X DVD-RW drive?
Can I use a 2.4X DVD-RW disk on an 8X DVD-RW drive? And, if so, do I have to tell the DVD drive software that I'm using the slower disk, or can it figure it out itself? Thanks, Don ----== Posted via Newsfeeds.Com - Unlimited-Uncensored-Secure Usenet News==---- http://www.newsfeeds.com The #1 Newsgroup Service in the World! 120,000+ Newsgroups ----= East and West-Coast Server Farms - Total Privacy via Encryption =---- On Sat, 02 Apr 2005 10:23:28 -0700, Don <no@adr.com> wrote: >Can I use a 2.4X DVD-RW disk on an 8X DVD-RW drive? And, if so, do I have >to tell ...

Question:Can I boot from a floppy disk and install Linux from an external USB2.0 Drive
Hi, If I had made a linux file system on external USB2.0 drive then download the latest version of the Linux installation image files on it for friend's brand new machine Linux installtion, is there a specific boot floppy disk with USB driver built in for external USB drive installation. I knew the network boot disk can allow to do that installation on the local area network using the mounting way. But if this brand new machine is just a stand alone machine. If there is a way to do the installation using USB drive, then I can avoid the tedious buring CD image process and...

Can I Format My SATA Drive Using XP's Disk Manager If DM Sees It?
Long and short of it: Im running an Asus P5K Deluxe motherboard with the latest BIOS flash, 0812. The P5K has SATA as well as ATA on board, and I am using the ATA with an old ATA drive which has XP installed, as the boot drive. Recently purchased a SATA drive, Seagate ST3250410AS. I want this to be my only drive, but I dont want to have to have a floppy, when installing XP w/SP3 onto the new SATA drive. But maybe I wont. Heres the question. With the SATA attached, and the ATA still being the boot, I can go into XP's Disk Management, and my SATA is listed there, and it will let me s...

can't use hdpram to get the correct SATA drive power mode status!
Dear All, I meet a problem when I use hdparm on SATA drive with Sil3114 SATA controller.The kernel I use is 2.6.11, I have already patched the 2.6.11-libata-dev1.patch file into kernel 2.6.11, smart mointer tools work well with the patched kernel 2.6.11 and I also can run "hdpram -S" or "hdparm -y" to set the SATA drive go to standby mode, but when I run "hdparm -C" to get the power mode status of SATA drive, wrong result returns, the returned result is always standby evenif the SATA drive is active. Is there anyone meet the same problem? The log I...

Can I Format My SATA Drive Using XP's Disk Manager If DM Sees It?
Long and short of it: Im running an Asus P5K Deluxe motherboard with the latest BIOS flash, 0812. The P5K has SATA as well as ATA on board, and I am using the ATA with an old ATA drive which has XP installed, as the boot drive. Recently purchased a SATA drive, Seagate ST3250410AS. I want this to be my only drive, but I dont want to have to have a floppy, when installing XP w/SP3 onto the new SATA drive. But maybe I wont. Heres the question. With the SATA attached, and the ATA still being the boot, I can go into XP's Disk Management, and my SATA is listed there, and it ...

model 70 faulty drive, can't boot from ref disk, error 113, etc...
Clean the contacts on the riser with a rubber eraser. -- Cheers...... ...

Bought a 3 TB Toshiba HD but now I was told I can't use as a SYSTEM boot drive?
I needed an upgrade to my Seagate Baracudda 1 TB drive on my 3 year old ASUS mobo (P6X58D-E). The mobo dces not have UEFI support. I wanted to use it as my main Windows 7 x64 drive. Little did I know that this was going to be an issue. Is there a way of allowing Windows 7 to see the full 3TB drive and have it run as the boot drive as well? ...

Bought a 3 TB Toshiba HD but now I was told I can't use as a SYSTEM boot drive? #2
I needed an upgrade to my Seagate Baracudda 1 TB drive on my 3 year old ASUS mobo (P6X58D-E). The mobo dces not have UEFI support. I wanted to use it as my main Windows 7 x64 drive. Little did I know that this was going to be an issue. Is there a way of allowing Windows 7 to see the full 3TB drive and have it run as the boot drive as well? On Mon, 02 Dec 2013 22:47:08 -0800, Sam <None@none.com> wrote: >I needed an upgrade to my Seagate Baracudda 1 TB drive on my 3 year >old ASUS mobo (P6X58D-E). The mobo dces not have UEFI support. I >wanted to use it as my main...

Cannot mount ext3 partition (booting from new master disk) which is viewable with LINUX Rescue boot (when old disk is master)
Hello All, Whilst trying to back up my drive i corrupted the dba2 partition and Fedora Core 3 will now not boot. So i have a new install on another HD disk and am trying to mount the original disk so that i can retrieve some data from it. I can see these files under /mnt/sysimage when i boot with the old disk as master and "linux rescue". It does warn me that not all files are avalible as some are lost but I can see and read the ones which I need. When i make the new disk master and boot from that (everything ok) but I want to mount the old disk (slave). When i try to moun...

Can you keep a secret? This encrypted drive can...
http://www.sfgate.com/cgi-bin/article.cgi?file=/chronicle/archive/2006/10/30/BUGU2M1ETT1.DTL&type=printable http://www.theglobeandmail.com/servlet/story/RTGAM.20061030.wharddrive1029/BNStory/Front/?page=rss&id=RTGAM.20061030.wharddrive1029 http://www.infoworld.com/article/06/10/30/HNseagateagain_1.html -- Saqib Ali, CISSP, ISSAP http://www.full-disk-encryption.net "Saqib Ali" <docbook.xml@gmail.com> writes: >http://www.sfgate.com/cgi-bin/article.cgi?file=/chronicle/archive/2006/10/30/BUGU2M1ETT1.DTL&type=printable >http://www.theglobeandmail.com/servlet...

How can we make the hard disk as a boot disk?
Hi All, I have gone through the target.html which is avaiable in the doucmentation folder of the VxWorks where it contains the information about the making the boot device. We prepared a FLOPPY as a boot device as mentioned in the file and tried to boot through it. However, after getting V1.6+++++++++++ (around 10 lines of + signs on the console) system hangs. When we tried to make the HARD DISK as a boot device, we end up with the VxSys error and unable to make the Hard Disk as a boot able device. So, could you any one explain, how can we make the hard disk as a boot disk? Could any on add ...

booting from win98 boot disk and seeing all my Hard drives
My Windows 2000 pro installation has gone bad so I am booting from a Win98 boot disk into dos. I can see my C drive, but not my other rather large (100 gig) hard drive (E:). I am thinking that my Win98 boot disk needs a device driver for my Ultra66 (Promise Tech) controller? I have downloaded the drivers for the Ultra66 from their website, but can't figure out which win98 file to put on the floppy. Also, I probably need to put a command in an autoexec.bat file or a config.sys file? If I can boot up into dos and see both drives, then I can copy the contents of C: to E: with...

can I use desktop hard drive as external laptop drive?
Hi. My mom gave me her old compaq presario 1200 because my desktop motherboard burnt out and I couldn't afford to fix it. The hard drive in my laptop is very small, and all of my old files are still on the hard drive from my desktop, which still is in good condition. Is there a way to connect the old hard drive (it's an internal drive)to my laptop? thanks, Kristie yes, get an external drive box for about $40, they make in USB or FWire connection, or both. I did it, works great. -- Dennis Savatski "Kristie" <kjd183@psu.edu> wrote in message news:8c9b4541.0401221503...

Boot Camp
System: 20" Core 2 Duo Boot Camp 1.1.1 All firmware and software is up to date. Boot Camp works just fine, including my bluetooth kybd and mouse. I'm new to the Apple world, so this might be a dumb question - Now that I have XP Home SP2 installed on my iMac, prior to loading any other software, can I use Norton Ghost, DriveImage Pro or Acronis True Image to create a restore cd(s) of my XP system? I don't completely understand the dual boot process so I'd like to get this info before messing up an otherwise clean XP installation. Thanks! ...

[9fans] disk is full; can't boot to fix it because disk is full
Came back after the weekend any my Plan 9 cluster is down. The front end says this many times: cacheAllocBlock wrap 609408 cacheAllocBlock: xxx1 disk is full cacheAllocBlock wrap 609408 cacheAllocBlock wrap 609408 cacheAllocBlock: xxx1 disk is full .. .. .. .. boot: /386/init: '/386/init' disk is full panic blah blah blah ok, the disk is full, can't boot, can't get in to fix it. Any options here or am I totally screwed? Are these fossil or Venti errors? I would look but my Plan 9 machine is ..... well, you guessed it. ron This is a multi-part message in MIME format....

Can't see hard drive/can't boot.
Using an Intel Mac with 2gb ram with updated Leopard. When starting up, the hard drive does its usual whine, then stops, and starts again. I get the Apple logo on the grey background. But it refuses to go further. Just does this over and over. Its like its hitting some block on the startup. So I take that hard drive and try it on another Mac. It sees it perfectly. I try some utilities to test it - tests 100%. It behaves perfectly. Then I take the 2nd hard drive I use all the time on that system (firewire) and plug it into the other Mac. Its invisible. Nothing in the Finder. ...

No Support for USB Pocket Drive Booting: Boot Selector on Fixed Disk with XP Partition
I have seen a lot of information (particularly on various implementations of GRUB) about how to get a boot selector program that helps to boot USB pocket drives where the machine BIOS will not support the boot, as in the case of my laptop. I want put a boot selection program (GRUB or like it) on the hard disk that boots Win XP. Clearly it will move or relocate the XP boot/loader to another location, or in some way hook into that loader to prevent it from running. The runs the boot loader selection program then presents a list of the bootable options (device/partition): in my case i...

Can I use Putty to mimic a local drive, so I can read/write files remote?
Hi group, I hope somebody can help me with this. This is my situation: 1) I run a Redhat8 machine somewhere. (location1) 2) I run a windows2000 Prof somewhere else (location2) 3) I want to use a directory and content (read/write) on the RD8 (location1) from windows2000 (location2). The problem is that i want a program (Eclipse in my case) to use that remote location AS IF it is just a local HD. I know I can map a drive in windows with ftp:// or http:// but I need some kind of ssh:// Any advise?? Thanks! Regards, Erwin Moller ...

How do you make a boot disk when you don't have a "floppy" disk drive?
I have a little problem: I have no real floppy disk drive, but a system with an LS-120 Atapi super floppy drive, and a 100 meg Atapi Zip disk drive (amongst the usual hard drives and CD-ROMs). I can't make a boot floppy disk (and I have a need to), as they don't behave like a floppy drive. Raw write type of applications just don't work. If it helps, here's how those drives are referenced: /dev/hda /mnt/ls120.0 auto noauto,owner,kudzu 0 0 /dev/hdb4 /mnt/zip auto noauto,owner,kudzu 0 0 Does anybody know of any solutions? (Putting in a real...