4.2 KiB
Arch Linux with LUKS and btrfs on a hetzner server (DRAFT)
This guide should show you how to set up an System with the following specifications on an hetzner server:
- Arch Linux
- btrfs
- LUKS
Guide
1. Configure and Install Image
1.1
Login to Hetzner Rescue System
ssh root@your_server_ip
1.2
Create the autosetup by executing
nano /autosetup
and saving the following content into this file:
## Hetzner Online GmbH - installimage - config
DRIVE1 /dev/sda
DRIVE2 /dev/sdb
## SOFTWARE RAID:
## activate software RAID? < 0 | 1 >
SWRAID 1
## Choose the level for the software RAID < 0 | 1 | 10 >
SWRAIDLEVEL 1
## BOOTLOADER:
BOOTLOADER grub
## HOSTNAME:
HOSTNAME hetzner-arch-luks
#Adapt the hostname to your needs
## PARTITIONS / FILESYSTEMS:
PART /boot btrfs 512M
PART lvm vg0 all
LV vg0 swap swap swap 8G
LV vg0 root / btrfs 10G
## OPERATING SYSTEM IMAGE:
IMAGE /root/.oldroot/nfs/install/../images/archlinux-latest-64-minimal.tar.gz
1.3
Afterwards install the image by executing the following command:
installimage
1.4
When the setup finished restart the server via
reboot
2. Setup System
2.1
Login to your server:
ssh-keygen -f "$HOME/.ssh/known_hosts" -R your_server_ip #revokes old ssh_host
ssh root@your_server_ip
2.2
Update the system:
pacman -Syyu
2.3
Install basic administration software:
pacman -Syyu nano
3. Prepare System for Unlocking via SSH
3.1 Execute the following script
# Install software
pacman -Syyu busybox mkinitcpio-dropbear mkinitcpio-utils
#Copy ssh-key
cp ~/.ssh/authorized_keys /etc/dropbear/root_key
3.2
Replace the following line in /etc/mkinitcpio.conf
HOOKS=(base udev autodetect modconf block mdadm_udev lvm2 filesystems keyboard fsck)
with
HOOKS=(netconf ppp dropbear encryptssh base udev autodetect modconf block mdadm_udev lvm2 filesystems keyboard fsck)
4. Activate Encryption
4.1
Activate the rescue system https://robot.your-server.de/server
4.2
Afterwards reboot the system by entering:
reboot
4.3
Login to the rescue system:
ssh-keygen -f "$HOME/.ssh/known_hosts" -R your_server_ip #revokes old ssh_host
ssh root@your_server_ip
4.4
Mount the "system" by:
vgscan -v
vgchange -a y
mount /dev/mapper/vg0-root /mnt
4.5
Copy "system":
# Resync unterbrechen
echo 0 >/proc/sys/dev/raid/speed_limit_max
mkdir /oldroot
cp -a /mnt/. /oldroot/.
# Resync fortsetzen
echo 200000 >/proc/sys/dev/raid/speed_limit_max
4.6
Unmount the "system" by:
umount /mnt
4.7
Delete unencrypted LVM-Volume-Group by executing:
umount /mnt
4.8
cat /proc/mdstat
4.9
Encrypt MD1 by executing:
cryptsetup --cipher aes-xts-plain64 --key-size 256 --hash sha256 --iter-time=10000 luksFormat /dev/md1
ryptsetup luksOpen /dev/md1 cryptroot
pvcreate /dev/mapper/cryptroot
vgcreate vg0 /dev/mapper/cryptroot
lvcreate -n swap -L8G vg0
lvcreate -n root -L10G vg0
mkfs.btrfs /dev/vg0/root
mkswap /dev/vg0/swap
4.10
Mount encrypted :
mount /dev/vg0/root /mnt
4.11
Mount encrypted :
mount /dev/vg0/root /mnt
4.12
Copy "system":
# Resync unterbrechen
echo 0 >/proc/sys/dev/raid/speed_limit_max
cp -a /oldroot/. /mnt/.
# Resync fortsetzen
echo 200000 >/proc/sys/dev/raid/speed_limit_max
4.13
Integrate finale installation:
mount /dev/md0 /mnt/boot
mount --bind /dev /mnt/dev
mount --bind /sys /mnt/sys
mount --bind /proc /mnt/proc
chroot /mnt
4.14
echo "cryptroot /dev/md1 none luks" >> /etc/crypttab
Missing initramfs neu schreiben GRUB neu schreiben
4.15
exit
umount /mnt/boot /mnt/proc /mnt/sys /mnt/dev
umount /mnt
sync
#Neustart
reboot
Sources
The code is adapted from the following guides: