Wednesday 22 May 2013

GEOM ELI FULL DISK ENCRYPTION



Boot up with FreeBSD Live CD. Start bsdinstall.

When installation reaches partitioning, select ‘shell’.


Partitioning

# gpart create  –s gpt ada0

1 .Create Boot Block

# gpart add –t freebsd-boot –s 64k ada0
# gpart bootcode  –b /boot/pmbr  –p /boot/gptboot  –i 1 ada0

2 .Create and format Boot partition

# gpart add –t freebsd-ufs –s 256m ada0
# newfs /dev/ada0p2

3. Create and initialize encrypted partition

# gpart add –t freebsd-ufs ada0
# geli init –bl 256 /dev/ada0p3                       (Pass phrase will be prompted.)
# geli attach /dev/ada0p3                   (Pass phrase will be prompted. Device /dev/ada0p3.eli will be created.)
# newfs /dev/ada0p3.eli

4. Mount file systems to /mnt

# mount /dev/ada0p3.eli /mnt
# mkdir /mnt/boot2
# mount /dev/ada0p2 /mnt/boot2

5. Continue Installation

# exit

Once the installation ends, enter into a ‘shell’ to make final changes.


Final Changes

1. Move /boot to /boot2/

# mv /mnt/boot  /mnt/boot2/.


2. Edit loader.conf

# vi /boot2/boot/loader.conf

Add the following lines.

geom_eli_load=”YES”
vfs.root.mountfrom=”ufs:/dev/ada0p3.eli”

3. Edit fstab

Add the following lines

/dev/ada0p2                /boot2              ufs       rw,noatime      1          1
/dev/ada0p3.eli                        /                       ufs       rw,noatime      1          1

No comments:

Post a Comment