From 2a73d63b75589f652cca669bfac7fe95e8405467 Mon Sep 17 00:00:00 2001 From: Francis Rowe Date: Mon, 15 Sep 2014 00:05:46 -0400 Subject: Documentation: add tutorial for encrypted Parabola GNU/Linux installation. --- (limited to 'docs/howtos') diff --git a/docs/howtos/encrypted_parabola.html b/docs/howtos/encrypted_parabola.html new file mode 100644 index 0000000..cdbcf20 --- /dev/null +++ b/docs/howtos/encrypted_parabola.html @@ -0,0 +1,490 @@ + + + + + + + + + Installing Parabola GNU/Linux with full disk encryption (including /boot) + + + +

Installing Parabola GNU/Linux with full disk encryption (including /boot)

+ +

+ Because GRUB is installed directly as a payload of libreboot (or coreboot), you don't need an unencrypted /boot partition + when setting up an encrypted system. This means that your machine can really secure data while powered off. +

+ +

+ Boot Parabola's install environment. How to boot a GNU/Linux installer. +

+ +

+ Parabola is much more flexible than Trisquel, but also more involved to setup. Use Parabola. It's 10 million times better than Trisquel. +

+ +

+ Firstly if you use an SSD, beware there are issues with TRIM (not enabled through luks) and security issues if you do enable it. + See this page + for more info. +

+ +

+ Wipe the MBR (if you use MBR):
+ # lsblk
+ Your HDD is probably /dev/sda: + # dd if=/dev/zero of=/dev/sda bs=446 count=1
+ Never use SeaBIOS! The MBR section can easily be changed with malicious code, which SeaBIOS will blindly execute. + This guide is for libreboot with GRUB-as-payload only. +

+ +

+ Securely wipe the drive:
+ # dd if=/dev/urandom of=/dev/sda +

+ +

+ This guide will go through the installation steps taken at the time of writing, which may or may not change due to + the volatile nature of Parabola (it changes all the time). In general most of it should remain the same. If you spot mistakes, + please say so! This guide will be ported to the Parabola wiki at a later date. For up to date Parabola install guide, go to + the Parabola wiki. This guide essentially cherry picks the useful information (valid at the time of writing: 2014-09-15). +

+ +

+ Change keyboard layout +

+ Parabola live shell assumes US Qwerty. If you have something different, use:
+ # loadkeys LAYOUT
+ For me, LAYOUT would have been dvorak-uk. +

+ +

Getting started

+ The beginning is based on https://wiki.parabolagnulinux.org/Installation_Guide. + Then I referred to https://wiki.archlinux.org/index.php/Partitioning at first. +

+ +

dm-mod

+ device-mapper will be used - a lot. Make sure that the kernel module is loaded:
+ # modprobe dm-mod +

+ +

Create LUKS partition

+ I am using MBR partitioning, so I use cfdisk:
+ # cfdisk /dev/sda +

+ I create a single large sda1 filling the whole drive, leaving it as the default type 'Linux' (83). +

+ Now I refer to https://wiki.archlinux.org/index.php/Dm-crypt/Drive_preparation#Partitioning:
+ I am then directed to https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption. +

+ Parabola forces you to RTFM. +

+ It tells me to run:
+ # cryptosetup benchmark (for making sure the list below is populated)
+ Then:
+ # cat /proc/crypto
+ This gives me crypto options that I can use. It also provides a representation of the best way to setup LUKS (in this case, security is a priority; speed, a distant second). + To gain a better understanding, I am also reading:
+ # man cryptsetup +

+ Following that page, based on my requirements, I do the following based on + based on https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption#Encryption_options_for_LUKS_mode. + Reading through, it seems like Serpent (encryption) and Whirlpool (hash) is the best option. +

+ I am initializing LUKS with the following:
+ # cryptsetup -v --cipher serpent-xts-plain64 --key-size 512 --hash whirlpool --use-random --verify-passphrase luksFormat /dev/sda1 + -- choose a secure passphrase here. Ideally lots of lowercase/uppercase numbers, letters, symbols etc all in a random pattern. The password + length should be as long as you are able to handle without writing it down or storing it anywhere. Ideally, 100 characters or more. + It might take you a while to memorize a long passphrase before beginning this step. +

+ +

Create LVM

+ Now I refer to https://wiki.archlinux.org/index.php/LVM. +

+ Open the LUKS partition:
+ # cryptsetup open --type luks /dev/sda1 lvm (it will be available at /dev/mapper/lvm) +

+ Create LVM partition:
+ # pvcreate /dev/mapper/lvm
+ Show that you just created it:
+ # pvdisplay +

+ Now I create the volume group, inside of which the logical volumes will be created:
+ # vgcreate matrix /dev/mapper/lvm (volume group name is 'matrix')
+ Show that you created it:
+ # vgdisplay +

+ Now create the logical volumes:
+ # lvcreate -L 2G matrix -n swapvol (2G swap partition, named swapvol)
+ # lvcreate -l +100%FREE matrix -n rootvol (single large partition in the rest of the space, named rootvol)
+ You can also be flexible here, for example you can specify a /boot, a /, a /home, a /var, a /usr, etc. For example, + if you will be running a web/mail server then you want /var in it's own partition (so that if it fills up with logs, it won't crash your system). + For a home/laptop system (typical use case), a root and a swap will do (really). +

+ Verify that the logical volumes were created, using the following command:
+ # lvdisplay +

+ +

Create / and swap partitions

+ For the swapvol LV I use:
+ # mkswap /dev/mapper/matrix-swapvol +

+ For the rootvol LV I use:
+ # mkfs.ext4 /dev/mapper/matrix-rootvol +

+ +

Continue with Parabola installation

+ Mount the root (/) partition:
+ # mount /dev/matrix/rootvol /mnt
+

+ This guide is really about GRUB, Parabola and cryptomount. I have to show how to install Parabola + so that the guide can continue. +

+ Now I am following the rest of https://wiki.parabolagnulinux.org/Installation_Guide. + I also also cross referencing https://wiki.archlinux.org/index.php/Installation_guide. +

+ Create /home and /boot on rootvol mountpoint:
+ # mkdir /mnt/home
+ # mkdir /mnt/boot +

+ The wiki says to enable the swap so that it can be detected by 'genfstab':
+ # swapon /dev/matrix/swapvol +

+ DHCP was already working for me, so I had internet during the install. Therefore, I ignore the 'Connect to the Internet' section of the install guide. + I also ignore wifi, since I can set that up after the install. For now, I am just using ethernet. + Otherwise, refer to https://wiki.archlinux.org/index.php/Configuring_Network. + You can test to see if internet is already working by pinging a few domains. +

+ The following is based on 'Verification of package signatures' in the Parabola install guide. Check there first to see if steps differ by now. + Now you have to update the default Parabola keyring. This is used for signing and verifying packages:
+ # pacman -Sy parabola-keyring
+ It says that you you get GPG errors, it's probably an expired key so do:
+ # pacman-key --populate parabola
+ # pacman-key --refresh-keys
+ # pacman -Sy parabola-keyring
+ To be honest, you should do the above anyway. Parabola has a lot of maintainers, and a lot of keys. Really!
+ Also, it says that if the clock is set incorrectly then you have to manually set the correct time (if keys are listed as expired because of it):
+ # date MMDDhhmm[[CC]YY][.ss] +

+ +

Install the base system

+ I commented out all lines except the Server line for the UK Parabola server (main server) in /etc/pacman.d/mirrorlist and then did:
+ # pacman -Syu
+ I also had to upgrade pacman and then do the above again:
+ # pacman -Sy pacman +

+ I also like to install other packages (base-devel, compilers and so on) and wpa_supplicant/dialog are needed for wireless after the install:
+ # pacstrap /mnt base base-devel wpa_supplicant dialog +

+ +

Configure the system

+ From the Parabola installation guide (Arch's one was identical):
+ # genfstab -p /mnt >> /mnt/etc/fstab +

+ Chroot into new system:
+ # arch-chroot /mnt +

+ It's a good idea to have this installed:
+ # pacman -S linux-libre-lts +

+ This is another kernel that sits inside /boot, which you can use. LTS means 'long-term support'. These are so-called 'stable' kernels + that can be used as a fallback during updates, if a bad kernel causes issues for you. +

+ Parabola does not have wget. This is sinister. Install it:
+ # pacman -S wget +

Write your hostname to /etc/hostname
+ Symlink /etc/localtime to /usr/share/zoneinfo/Zone/SubZone. Replace Zone and Subzone to your liking. For example: +
- # ln -s /usr/share/zoneinfo/Europe/London /etc/localtime
+
+ Set locale preferences in /etc/locale.conf. In my case, I did:
+ + LANG="en_GB.UTF-8"
+ # Keep the default sort order (e.g. files starting with a '.'
+ # should appear at the start of a directory listing.)
+ LC_COLLATE="C"
+ # Set the short date to YYYY-MM-DD (test with "date +%c")
+ LC_TIME="en_GB.UTF-8" + +
+ Add console keymap and font preferences in /etc/vconsole.conf. In my case:
+ + KEYMAP=dvorak-uk
+ FONT=Lat2-Terminus16 + +
+ Uncomment the selected locale (same as what you specified in /etc/locale.conf) in /etc/locale.gen and generate it with: +
- # locale-gen
+
+ Configure /etc/mkinitcpio.conf as needed (see mkinitcpio) + Specifically, for this use case:
+
- + add i915 to the MODULES array (forces the driver to load earlier, so that the consolefont isn't wiped out after getting to login).
  + add encrypt and lvm2 in that order, before the 'filesystems' entry in the HOOKS array.
  + add keymap, consolefont and shutdown to the end of the HOOKS array in that order.
  + move keyboard, keymap and consolefont in that order, to go before 'encrypt' in the HOOKS array.
  + At the end your HOOKS array will look like this:
  + HOOKS="base udev autodetect modconf block keyboard keymap consolefont encrypt lvm2 filesystems fsck shutdown" +
  - keymap adds to initramfs the keymap that you specified in /etc/vconsole.conf
  - consolefont adds to initramfs the font that you specified in /etc/vconsole.conf
  - encrypt adds LUKS support to the initramfs - needed to unlock your disks at boot time
  - lvm2 adds LVM support to the initramfs - needed to mount the LVM partitions at boot time
  - shutdown is needed according to Parabola wiki for unmounting devices (such as LUKS/LVM) during shutdown
  - + Runtime modules can be found in /usr/lib/initcpio/hooks, and build hooks can be found in + /usr/lib/initcpio/install. +
  - mkinitcpio -H hookname gives information about each hook.
  +
+
+ Now using mkinitcpio, you can create the kernel and ramdisk for booting with (note, this is different than Arch, specifying linux-libre instead of linux):
+ # mkinitcpio -p linux-libre
+ Also do it for linux-libre-lts:
+ # mkinitcpio -p linux-libre-lts +

+ +

Set a root password

+ At the time of writing, Parabola used SHA512 by default for it's password hashing. +

+ I referred to https://wiki.archlinux.org/index.php/SHA_password_hashes. +

+ Open /etc/pam.d/passwd and add rounds=65536 at the end of the uncommented 'password' line. +

+ # passwd root
+ Make sure to set a secure password! Also, it must never be the same as your LUKS password. +

+ +

Extra security tweaks

+ Based on https://wiki.archlinux.org/index.php/Security. +

+ Restrict access to important directories:
+ # chmod 700 /boot /etc/{iptables,arptables} +

+ Lockout user after three failed login attempts:
+ Edit the file /etc/pam.d/system-login and comment out that line:
+ # auth required pam_tally.so onerr=succeed file=/var/log/faillog
+ Or just delete it. Above it, put:
+ auth required pam_tally.so deny=2 unlock_time=600 onerr=succeed file=/var/log/faillog
+ To unlock a user manually (if a password attempt is failed 3 times), do:
+ # pam_tally --user --reset + What the above configuration does is lock the user out for 10 minutes, if they make 3 failed login attempts. +

+ Configure sudo - not covered here. Will be covered post-installation in another tutorial, at a later date. + If this is a single-user system, you don't really need sudo. +

+ +

Unmount, reboot!

+ Exit from chroot:
+ # exit +

+ unmount:
+ # umount /mnt
+ # swapoff -a +

+ deactivate the lvm lv's:
+ # lvchange -an /dev/matrix/rootvol
+ # lvchange -an /dev/matrix/swapvol
+

+ Lock the encrypted partition (close it):
+ # cryptsetup luksClose lvm +

+ # shutdown -h now
+ Then boot up again. +

+ +

Booting from GRUB

+ Initially you will have to boot manually. Press C to get to the GRUB command line. The underlined parts are optional + (using those 2 underlines will boot lts kernel instead of normal). +

+ grub> cryptomount -a (ahci0,msdos1)
+ grub> set root='lvm/matrix-rootvol'
+ grub> linux /boot/vmlinuz-linux-libre-lts root=/dev/matrix/rootvol cryptdevice=/dev/sda1:root
+ grub> initrd /boot/initramfs-linux-libre-lts.img
+ grub> boot
+

+ +

Modify grub.cfg inside the ROM

+ +

+ Now you need to modify the ROM, so that Parabola can boot automatically with this configuration. + grub_cbfs.html shows you how. Follow that guide, using the configuration details below. +

+ Inside the 'Load Operating System' menu entry, change the contents to:
+ + cryptomount -a (ahci0,msdos1)
+ set root='lvm/matrix-rootvol'
+ linux /boot/vmlinuz-linux-libre-lts root=/dev/matrix/rootvol cryptdevice=/dev/sda1:root
+ initrd /boot/initramfs-linux-libre-lts.img + +

+ +

+ Note: the underlined parts above (-lts) can also be removed, to boot the latest kernel instead of LTS (long-term support) kernels. + You could also copy the menu entry and in one have -lts, and without in the other menuentry. +

+ +

+ Above the 'Load Operating System' menu entry you should also add a GRUB password, like so: +

set superusers="root"
+password_pbkdf2 root grub.pbkdf2.sha512.10000.711F186347156BC105CD83A2ED7AF1EB971AA2B1EB2640172F34B0DEFFC97E654AF48E5F0C3B7622502B76458DA494270CC0EA6504411D676E6752FD1651E749.8DD11178EB8D1F633308FD8FCC64D0B243F949B9B99CCEADE2ECA11657A757D22025986B0FA116F1D5191E0A22677674C994EDBFADE62240E9D161688266A711
+

+ +

+ Note that the above entry specifies user 'root'; this is just a username for GRUB. You don't even need to use root. + Change root on both of those 2 lines to whatever you want. +

+ +

+ Start dhcp on ethernet:
+ # systemctl start dhcpcd.service + This is just for the step below. I won't cover network configuration here. That is for another Parabola article. +

+ +

+ The password hash (it's password, by the way) after 'password_pbkdf2 root' should be changed and is created by the grub-mkpasswd-pbkdf2 utility, which you need to install or otherwise compile, + like so:
+ # pacman -S grub +

+ +

+ GRUB isn't needed for booting, since it's already included as a payload in libreboot. This is only so that the utility needed becomes available. Get your hash + by entering your chosen password at the prompt, when running this command:
+ # grub-mkpasswd-pbkdf2 +

+ +

+ It will output the hash for the password that you entered. Make sure to specify a password that is different from both your LUKS *and* your root/user password. + Use it to replace the default hash mentioned above. +

+ +

+ With this setup, you will have to enter a password at boot time, in GRUB, before being able to use any of the menu entries or switch to the terminal. + This protects your system from an attacker simply booting a live usb distro and re-flashing the boot firmware. +

+ +

+ You probably only need base-devel (compilers and so on) to build and use cbfstool. It was already installed if you followed this tutorial, but here it is:
+ # pacman -S base-devel +

+ +

+ For flashing the modified ROM, I just used flashrom from the Parabola repo's:
+ # pacman -S flashrom
+ I also installed dmidecode:
+ # pacman -S dmidecode +

+ +

+ If you followed all that correctly, you should now have a fully encrypted Parabola installation. + This is a very barebones Parabola install (the default one). Refer to the wiki for how to do the rest + (desktop, etc). +

+ +

Further security tips

+ https://wiki.archlinux.org/index.php/Security.
+ https://wiki.parabolagnulinux.org/User:GNUtoo/laptop +

+ +

+ Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
+ This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

+ +

+ This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

+ + + -- cgit v0.9.1