kevinveenbirkenbach/hetzner-arch-luks
1
0
Fork 0
mirror of https://github.com/kevinveenbirkenbach/hetzner-arch-luks.git synced 2024-11-24 02:31:04 +01:00
Code Issues Packages Projects Releases Wiki Activity
Guide to install Arch Linux with LUKS encryption on an hetzner server
9 Commits 2 Branches 0 Tags 42 KiB
eff6a29313
Go to file
Kevin Veen-Birkenbach [aka. Frantz] eff6a29313 Optimized
2020-04-17 19:21:08 +02:00
README.md Optimized 2020-04-17 19:21:08 +02:00

README.md

Arch Linux with LUKS and btrfs on a hetzner server (DRAFT)

This guide should show you how to set up an System with the following specifications on an hetzner server:

  • Arch Linux
  • btrfs
  • LUKS

Guide

1. Configure and Install Image

1.1

Login to Hetzner Rescue System

ssh root@your_server_ip

1.2

Create the autosetup by executing

nano /autosetup

and saving the following content into this file:

##  Hetzner Online GmbH - installimage - config

DRIVE1 /dev/sda
DRIVE2 /dev/sdb

##  SOFTWARE RAID:
## activate software RAID?  < 0 | 1 >
SWRAID 1

## Choose the level for the software RAID < 0 | 1 | 10 >
SWRAIDLEVEL 1

##  BOOTLOADER:
BOOTLOADER grub

##  HOSTNAME:
HOSTNAME hetzner-arch-luks
#Adapt the hostname to your needs

##  PARTITIONS / FILESYSTEMS:
PART /boot  btrfs     512M
PART lvm    vg0       all
LV vg0   swap   swap     swap         8G
LV vg0   root   /        btrfs        10G

##  OPERATING SYSTEM IMAGE:
IMAGE /root/.oldroot/nfs/install/../images/archlinux-latest-64-minimal.tar.gz

1.3

Afterwards install the image by executing the following command:

installimage

1.4

When the setup finished restart the server via

reboot

2. Setup System

2.1

Login to your server:

ssh-keygen -f "$HOME/.ssh/known_hosts" -R your_server_ip #revokes old ssh_host
ssh root@your_server_ip

2.2

Update the system:

pacman -Syyu

2.3

Install basic administration software:

pacman -S nano

3. Prepare System for Unlocking via SSH

3.1 Execute the following script

# Install software
pacman -S busybox mkinitcpio-dropbear mkinitcpio-utils mkinitcpio-netconf
#Copy ssh-key
cp -v ~/.ssh/authorized_keys /etc/dropbear/root_key

3.2

Replace the following line in /etc/mkinitcpio.conf

HOOKS=(base udev autodetect modconf block mdadm_udev lvm2 filesystems keyboard fsck)

with

HOOKS=(base udev autodetect modconf block mdadm_udev lvm2 netconf dropbear encryptssh filesystems keyboard fsck)

⚠️ In the original example the initramfs get modified. Don't know if this is still necessary: /etc/initramfs-tools/initramfs.conf
Alt: BUSYBOX=auto
Neu: BUSYBOX=y
http://daemons-point.com/blog/2019/10/20/hetzner-verschluesselt/#etcinitramfs-toolsinitramfsconf-anpassen

4. Activate Encryption

4.1

Activate the rescue system https://robot.your-server.de/server

4.2

Afterwards reboot the system by entering:

reboot

4.3

Login to the rescue system:

ssh-keygen -f "$HOME/.ssh/known_hosts" -R your_server_ip #revokes old ssh_host
ssh root@your_server_ip

4.4

Mount the "system" by:

vgscan -v
vgchange -a y
mount /dev/mapper/vg0-root /mnt

4.5

Copy "system":

# Resync unterbrechen
echo 0 >/proc/sys/dev/raid/speed_limit_max
mkdir /oldroot
cp -va /mnt/. /oldroot/.
# Resync fortsetzen
echo 200000 >/proc/sys/dev/raid/speed_limit_max

4.6

Unmount the "system" by:

umount /mnt

4.7

Delete unencrypted LVM-Volume-Group by executing:

vgremove vg0

4.8

Check drive state:

cat /proc/mdstat

4.9

Encrypt MD1 by executing:

cryptsetup --cipher aes-xts-plain64 --key-size 256 --hash sha256 --iter-time=10000 luksFormat /dev/md1
cryptsetup luksOpen /dev/md1 cryptroot
pvcreate /dev/mapper/cryptroot
vgcreate vg0 /dev/mapper/cryptroot
lvcreate -n swap -L8G vg0
lvcreate -n root -L10G vg0
mkfs.btrfs /dev/vg0/root
mkswap /dev/vg0/swap

4.10

Mount encrypted :

mount /dev/vg0/root /mnt

4.12

Copy "system":

# Resync unterbrechen
echo 0 >/proc/sys/dev/raid/speed_limit_max
cp -av /oldroot/. /mnt/.
# Resync fortsetzen
echo 200000 >/proc/sys/dev/raid/speed_limit_max

4.13

Integrate finale installation:

mount /dev/md0 /mnt/boot
mount --bind /dev /mnt/dev
mount --bind /sys /mnt/sys
mount --bind /proc /mnt/proc
chroot /mnt

4.14

echo "cryptroot /dev/md1 none luks" >> /etc/crypttab

4.15

mkinitcpio -p linux

5

5.1

Install grub:

pacman -S grub

⚠️ I'm not shure if the following is correct. Please check out this link . I appreciate feedback 💕

5.2

Edit /etc/default/grub and tell the Kernel about the cryptdevice and the mdraid, and netconf that we want dhcp

GRUB_CMDLINE_LINUX="cryptdevice=/dev/md0:root ip=dhcp"

5.3

grub-mkconfig -o /boot/grub/grub.cfg

grub-install /dev/sda
grub-install /dev/sdb

5.4

exit
umount /mnt/boot /mnt/proc /mnt/sys /mnt/dev
umount /mnt
sync

#Neustart
reboot

6.

6.1

Decrypt server:

ssh  -o UserKnownHostsFile=/dev/null root@your_server_ip
cryptroot-unlock
exit

6.2

Login to server:

ssh-keygen -f "$HOME/.ssh/known_hosts" -R your_server_ip
ssh root@your_server_ip

Sources

The code is adapted from the following guides: