Luks-Anaconda_checklist

Luks-ANaconda_checklist

--
Note, This is my drive's configuration. I've substituted /dev/sda3 for <device> in many instances.
# sudo lsblk -fa	// List block devices. -a, list all devices; -f, include file system info.
loop7
sda
|-- sda1     vfat         xxxx-xxxx
|-- sda2
|-- sda3

1) Install LUKS from LIVE Media
1.2) Optional[1]: Fill the device with random data:
Filling <device> (eg: /dev/sda3) with random data before encrypting it greatly increases the strength of the encryption. The downside is that it can take a very long time.
Warning. The commands below will destroy any existing data on the device.
    * The best way, which provides high quality random data but takes a long time (several minutes per gigabyte on most systems):
      # dd if=/dev/urandom of=<device>

    * Fastest way, which provides lower quality random data:
      # badblocks -c 10240 -s -w -t random -v <device>

1.3) Make Luks
# cryptsetup luksFormat -y --cipher aes-xts-plain --key-size 512 /dev/sda3

WARNING!
========
This will overwrite data on /dev/sda3 irrevocably.

Are you sure? (Type uppercase yes): YES
Enter LUKS passphrase:
Verify passphrase:

1.4) Verify Luks is successfully installed,
1.4.1)
#lsblk -fa
loop7
sda
|-- sda1 vfat                                    6087-9C99
|-- sda2
|-- sda3 crypto_LUK                              93b3841a-917c-4266-ae14-df6f145b2c72

1.4.2)
# cryptsetup isLuks /dev/sda3 && echo Success
Success

1.4.3)
# cryptsetup luksDump /dev/sda3
LUKS header information for /dev/sda3
Version:       	1
Cipher name:   	aes
Cipher mode:   	xts-plain
Hash spec:     	sha1
Payload offset:	4096
MK bits:       	512
MK digest:     	bc 8e e0 da 62 3c f8 f5 2a 5a 5f e2 f6 da da 29 5c 5f d6 2c
MK salt:       	a0 e0 10 09 f0 61 1d ca a6 04 09 3d ef 76 5b 09
               	5c 13 11 ef 58 90 3e d6 33 31 4c 85 04 49 a8 8e
MK iterations: 	9500
UUID:          	93b3841a-917c-4266-ae14-df6f145b2c72

Key Slot 0: ENABLED
	Iterations:         	38201
	Salt:               	08 90 39 c0 bd 95 ab e2 bf 93 25 59 4f fe a5 8b
	                      	f2 11 2a 90 8b de 33 7a ce 2b b8 ca ca 0c e6 c0
	Key material offset:	8
	AF stripes:            	4000
Key Slot 1: DISABLED
Key Slot 2: DISABLED
Key Slot 3: DISABLED
Key Slot 4: DISABLED
Key Slot 5: DISABLED
Key Slot 6: DISABLED
Key Slot 7: DISABLED

2) Create LVM from LIVE media
2.1) Open Luks partition,
# cryptsetup luksOpen /dev/sda3 crypt*
Enter passphrase for /dev/sda3:

*This setup uses <mapper name> "crypt". The LUKS_install instructions[1] suggest "name" should be luks-[UUID]. To use Luks-[UUID], get the value with these commands,
# cryptsetup luksUUID /dev/sda3

2.2)
# pvcreate /dev/mapper/crypt
Writing physical volume data to disk "/dev/mapper/crypt"
Physical volume "/dev/mapper/crypt" successfully created

2.3)
# vgcreate cryptVG /dev/mapper/crypt
Volume group "cryptVG" successfully created

2.4) Create LVM partitions,
2.4.1) Logical volume "root" created
# lvcreate -n root -L 25G cryptVG

2.4.2) Logical volume "swap" created
# lvcreate -n swap -L 5G cryptVG

2.4.3) Logical volume "home" created
# lvcreate -n home -l 100%FREE cryptVG

2.4.4) Verify LVM is successful,
# lsblk -fa
[...]
loop7
sda
|-- sda1           vfat                              xxxx-xxxx
|-- sda2
|-+ sda3           crypto_LUK                        xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
  |-+ crypt (dm-2) LVM2_membe                        xxxxxx-xxxx-xxxx-xxxx-xxxx-xxxx-xxxxxx
    |-- cryptVG-root (dm-3)
    |-- cryptVG-swap (dm-4)
    |-- cryptVG-home (dm-5)

3) Optional: Make file systems
3.1) partition formatting,
# mke2fs -c -t ext4 -L home /dev/mapper/cryptVG-home
# mke2fs -c -t ext4 -L root /dev/mapper/cryptVG-root

3.2) boot partition formatting,
# mke2fs -c -t ext4 -L boot /dev/sda2

3.3) swap partition formatting,
#mkswap -c /dev/mapper/cryptVG-swap

3.4) Close the LUKS
[NOTE, I can't recall if I performed this step last time or not. It is however listed in the help post [2]
# cryptsetup luksClose crypt
Device crypt is busy.
I just restarted...I think...
]

4) open Luks and mount partitions for Anaconda installer,
4.1) Access Luks to mount the drives,
# cryptsetup luksOpen /dev/sda[n] [cryptname]
You will be asked for the passphrase for the device.

4.2) Allow the kernel to access the Volume Group, "vgchange allowa you to change the attributes of one or more volume groups. ... Only active volume grups are subject to changes and allow access to their logical volumes. [see (Q) below]
# vgchange -ay [volgroup]

4.3) Make directories
# mkdir /mnt/[mountpoint]

4.4) Mount the partitions,
# mount /dev/mapper/[volume_group-logical-volume] /mnt/[mount point]
// Repeat this command for each logical volume

5.) Anaconda installer (this is an outline of the steps for discussion and my notes, I've used the notation: <selected> //with a note at key steps.
5.1) Language
5.2) Device Type
5.3) Select Drive
5.3.1) Examining Storage Devices Progress Bar
5.4) Hostname
5.5) Time zone
5.6) Root password
5.7) What type of install?
5.7.1) Use all space
5.7.2) Replace Existing Linux System
5.7.3) Shrink current system
5.7.4) Use free space
5.7.5) Create Custom layout, <selected>
[New screen displays physical volume, and logical volume partitions made above 4.5.7-4.5.8.
Each partition is individually selectable. To edit the mount point, select partition from the list and "edit"]
5.7.6) Edit partition,
5.7.6.1) Set the mount points to the LVM partitions,    //I set the home, root and boot partitions. swap was already recognized
/, /home, /tmp, /var, /usr/local, /opt
5.7.6.2) Format the partition,                          //All partitions were made as ext4, save for swap.
ext2, ext3, ext4, pv, raid, swap, xfs
[NOTE, All paritions have the option to maintian the original formatting, but not the root mount point. This requires formatting for a new system installation.]
5.7.6.3) Encryption,                                    //I set this in the above steps
5.7.7) Create Custom layout Options,                    //These options are greyed out when you select 7.5
5.7.7.1) Use LVM
5.7.7.2) Encrypt
5.7.7.3) Review settings
5.7.8) Examining Storage Devices Progress Bar
5.8) Boot loader device Options,
5.8.1) Boot loader,
5.8.1.1) Master Boot Record /dev/sda
5.8.1.2) First sector of boot partition /dev/sda2  <selected>
5.8.2) BIOS Drive Order
5.8.3) Boot loader password                             //I've tried this both ways as a trouble shooting effort to no effect


-----
 [1]: http://docs.fedoraproject.org/en-US/Fedora/17/html/Installation_Guide/randomize_device.html
 [2]: http://forums.fedoraforum.org/showpost.php?p=1496052&postcount=14