(howto) Install debian with loop-aes encryption in the root partition and the kernel and key in an external pendrive

• Booting from a pendrive
• Setup the tools in the pendrive's debian
• Erase any previous data
• Create the keyfile
• Losetup, format and mount the root partition
• Debootstrap and configure
• Create initramfs
• Booting
• References

Booting from a pendrive

Boot from a pendrive with an autonomous debian on it. This can be done following some instructions i left earlier over here

This is the main difference (apart of not using LVM, and using the partition table) with the tutorial found here

• Debianhelp Howto: Booting Loop-AES Encrypted Root from USB Stick

Setup the tools in the pendrive's debian

	apt-get install loop-aes-utils loop-aes-testsuite module-assistant
	module-assistant prepare
	m-a a-i loop-aes

	apt-get install devscripts gpm
	apt-get build-dep gnupg
	apt-get clean
	gpg --gen-key
	mkdir -p builds/gnupg
	cd builds/gnupg
	apt-get source gnupg

Erase any previous data

The official loop-aes README in this point explains how to copy the non encrypted partition into the encrypted partition on the fly using aespipe. As we are going to reinstall everything, we do not need that. But first we wipe the entire hard drive with random looking data:

dd if=/dev/urandom of=/dev/sda bs=8225280 count=30401

The number after the blocksize (bs=) parameter and the count of sectors can be retrieved with an fdisk call:

# fdisk -l /dev/sda | head -4

Disk /dev/sda: 250.1 GB, 250059350016 bytes
255 heads, 63 sectors/track, 30401 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Launch fdisk and create the root partition now, unless you want to use the entire drive as root partition, without partition tables whatsoever

Create the keyfile

    head -c 3705 /dev/random | uuencode -m - | head -n 66 | tail -n 65 \
        | gpg --symmetric -a > /boot/keyfile.gpg

It is convenient to store a copy of this file in another pendrive or anywhere else, just in case the original pendrive breaks.

Losetup, format and mount the root partition

losetup -e AES256 -K /boot/keyfile.gpg /dev/loop1 /dev/
(you are asked for the key)
mkfs.ext2 /dev/loop1 # or whatever fs you like
mount /dev/loop1 /mnt

Debootstrap and configure

Now we debootstrap debian into the /mnt/ directory

debootstrap --arch i386 squeeze /mnt http://ftp.fi.debian.org/debian

 mount -o bind /dev/ /mnt/dev
 mount -o bind /proc/ /mnt/proc
 mount -o bind /sys/ /mnt/sys
 chroot /mnt
 apt-get install loop-aes-utils
 passwd root
 # without loop-aes-utils the rootfilesystem will not be remounted
 # without a root password you're not going to be able to reboot :)
 # install here any driver/etc you need to have networking later
 # on if needed
 exit
 umount /mnt/dev /mnt/proc /mnt/sys
 umount /mnt

Create initramfs

Add a line to /etc/fstab _of the pendrive_ (not on the actual / root partition), stating the loop-aes stance for the root device:

/dev/sda2     /       ext2    loop=/dev/loop1,encryption=AES256,gpgkey=/boot/keyfile.gpg    0       1

 cp /boot/initramfs.img* /boot/initramfs.img.pendrive

Update-initramfs as follows:

update-grub
update-initramfs -t -u -k `uname -r`

Booting

As the pendrive had a working grub on it, you only need to specify the new parameters in the grub commandline

 root (hd0,1)
 linux /boot/vmlinuz-*wicheverversionyouhave* root=/dev/*encryptedrootdevice*
 initrd /boot/initrd.img-*wicheverversionyouhave*
 boot

References

• Debianhelp Howto: Booting Loop-AES Encrypted Root from USB Stick
• loop-aes