https://www.chepkov.com/w/index.php?action=history&feed=atom&title=Encrypt_Fedora
Encrypt Fedora - Revision history
2026-04-28T17:13:31Z
Revision history for this page on the wiki
MediaWiki 1.43.6
https://www.chepkov.com/w/index.php?title=Encrypt_Fedora&diff=230&oldid=prev
Dburdick: /* Create backup */
2009-02-06T20:44:48Z
<p><span class="autocomment">Create backup</span></p>
<p><b>New page</b></p><div>This article will help you to encrypt your existing Fedora 10 installation<br />
=== Where we begin ===<br />
We have the following disk configuration:<br />
<pre><br />
# fdisk -l /dev/sda<br />
<br />
Disk /dev/sda: 40.0 GB, 40000000000 bytes<br />
255 heads, 63 sectors/track, 4863 cylinders<br />
Units = cylinders of 16065 * 512 = 8225280 bytes<br />
Disk identifier: 0x000e6cc7<br />
<br />
Device Boot Start End Blocks Id System<br />
/dev/sda1 * 1 13 104391 83 Linux<br />
/dev/sda2 14 4863 38957625 8e Linux LVM<br />
</pre><br />
<br />
* '''/dev/sda1''' is our '''/boot''' partition<br />
* '''/dev/sda2''' is physical volume for existing volume group '''vg0'''<br />
<br />
<pre><br />
# cat /etc/fstab<br />
/dev/vg0/root / ext3 noatime 1 1<br />
/dev/vg0/tmp /tmp ext2 noatime 1 2<br />
/dev/vg0/home /home ext3 noatime 1 2<br />
/dev/vg0/var /var ext3 noatime 1 2<br />
/dev/vg0/usr /usr ext3 noatime 1 2<br />
LABEL=boot /boot ext2 noatime 1 2<br />
tmpfs /dev/shm tmpfs defaults 0 0<br />
devpts /dev/pts devpts gid=5,mode=620 0 0<br />
sysfs /sys sysfs defaults 0 0<br />
proc /proc proc defaults 0 0<br />
/dev/vg0/swap swap swap defaults 0 0<br />
</pre><br />
<br />
=== Install required packages ===<br />
* dump<br />
* plymouth-system-plugin<br />
* cryptsetup-luks<br />
<br />
yum install dump plymouth-system-plugin cryptsetup-luks<br />
<br />
=== Create backup ===<br />
Mount your external USB disk, for example, to /mnt and use dump to backup your current installation.<br />
Make two copies, on two different disks, to be sure, '''this is the most important step'''<br />
<pre><br />
dump -0 -f /mnt/root.dump /<br />
dump -0 -f /mnt/usr.dump /usr<br />
dump -0 -f /mnt/var.dump /var<br />
dump -0 -f /mnt/home.dump /home<br />
</pre><br />
<br />
=== Boot in rescue mode ===<br />
Skip mounting existing installation, we are going to destroy it in the next step<br />
* Make the existing data unrecoverable<br />
shred -v -n 1 -z /dev/sda2<br />
<br />
* Create new encrypted physical volume<br />
cryptsetup --verify-passphrase luksFormat --cipher aes-cbc-essiv:sha256 --key-size 256 /dev/sda2<br />
cryptsetup --verbose luksOpen /dev/sda2 cryptpv<br />
<br />
* recreate volume group and logical volumes<br />
<pre><br />
lvm pvcreate /dev/mapper/cryptpv<br />
lvm vgcreate -s 32M vg0 /dev/mapper/cryptpv<br />
lvm lvcreate --size 512 --name root vg0<br />
lvm lvcreate --size 2G --name swap vg0<br />
lvm lvcreate --size 4G --name usr vg0<br />
lvm lvcreate --size 1G --name var vg0<br />
lvm lvcreate --size 1G --name home vg0<br />
lvm lvcreate --size 256 --name tmp vg0<br />
mke2fs -j -L root /dev/vg0/root<br />
mkswap -L swap /dev/vg0/swap<br />
mke2fs -j -L usr /dev/vg0/usr<br />
mke2fs -j -L var /dev/vg0/var<br />
mke2fs -j -L home /dev/vg0/home<br />
mke2fs -L tmp /dev/vg0/tmp<br />
</pre><br />
<br />
* remount backup and root<br />
<pre><br />
mkdir /tmp/root<br />
mkdir /tmp/mnt<br />
mount /dev/sdb1 /tmp/mnt<br />
mount -t ext3 /dev/vg0/root /tmp/root<br />
</pre><br />
<br />
* restore root<br />
<pre><br />
cd /tmp/root<br />
restore -r -f /tmp/mnt/root.dump<br />
rm restoresymtable<br />
</pre><br />
<br />
* mount and restore remaining file systems<br />
<pre><br />
mount -t ext3 -o noatime /dev/vg0/usr /tmp/root/usr <br />
cd /tmp/root/usr<br />
restore -r -f /tmp/mnt/usr.dump<br />
rm restoresymtable<br />
mount -t ext3 -o noatime /dev/vg0/var /tmp/root/var <br />
cd /tmp/root/var<br />
restore -r -f /tmp/mnt/var.dump<br />
rm restoresymtable<br />
mount -t ext3 -o noatime /dev/vg0/home /tmp/root/home <br />
cd /tmp/root/home<br />
restore -r -f /tmp/mnt/home.dump<br />
rm restoresymtable<br />
mount -t ext2 -o noatime /dev/vg0/tmp /tmp/root/tmp<br />
chmod 1777 /tmp/root/tmp<br />
</pre><br />
<br />
* unmount backup, create all device nodes for chrooted environment<br />
<pre><br />
umount /tmp/mnt<br />
cp -ax /dev/* /tmp/root/dev<br />
mkdir /tmp/root/dev/shm<br />
mount -t proc proc /tmp/root/proc<br />
mount -t sysfs sysfs /tmp/root/sys<br />
</pre><br />
<br />
* chroot into restored system<br />
<pre><br />
chroot /tmp/root<br />
mount -a<br />
swapon -a<br />
vgcfgbackup<br />
</pre><br />
<br />
* recreate initrd image<br />
cd /boot<br />
mkinitrd -v -f `ls initrd*` `ls /lib/modules`<br />
<br />
* force fsck check and selinux relabeling of the new system<br />
touch /.autofsck /.autorelabel<br />
<br />
=== You are done ===<br />
exit<br />
reboot<br />
<br />
[[Category:Linux]]</div>
Dburdick