Made a video about setting up LUKS for Proxmox EXT4

[andrew-ma]

https://youtu.be/pIjoSK1GmdY

[andrew-ma]

WARNING: only apply these steps to a new proxmox install. data will be overwritten.

################################################

Ensure UEFI mode is enabled

Ensure Secure Boot is enabled

Boot into Proxmox ISO USB device

Install proxmox normally and reboot

(OPTIONAL) edit the grub entry before installing and specify security-related kernel args (by pressing "e" key and moving cursor to end of "linux" line): "lockdown=integrity mitigations=auto random.trust_cpu=off random.trust_bootloader=off pti=on vsyscall=none page_poison=1 slub_debug=P audit=1 audit_backlog_limit=8192 init_on_free=1 crashkernel=no"

for the hard disk advanced options, I used these sizes:

total size: 20G

swap size: 1G

maximum root volume size: 10G

maximum data volume size: 1G

minimum free lvm space: 1G

After reboot, unplug Proxmox ISO USB device

################################################

login as root user

Check for internet access

ping 9.9.9.9

If no internet set the network interfaces up

ip link
ip link set ${NETWORK_INTERFACE} up

Configure apt repositories to use no-subscription repositories

vi /etc/apt/sources.list.d/*

Update packages

apt update
apt upgrade -y

Install cryptsetup and cryptsetup-initramfs packages

apt install cryptsetup cryptsetup-initramfs -y

reboot, but this time we will need to enter initramfs shell

Prevent grub from automatically booting into normal install by holding down arrow key on keyboard

################################################

Select the second option - "Advanced Options" on Grub screen with blue background, and press enter

Select the second option - "Recovery Mode" on Grub screen with black background, and press "e" to edit grub entry

move cursor to the end of the line that starts with "linux", and append these args: "rw break=premount"

boot using your added args by pressing "CTRL+X"

you will now be booted into "(initramfs)" shell

################################################

Deactivate LVM logical volumes

vgchange -an

Find the LVM partition (in my case it was /dev/nvme0n1p3)

blkid|grep -i lvm

Encrypt the LVM partition

cryptsetup reencrypt --encrypt --reduce-device-size=32m --type=luks2 --pbkdf pbkdf2 --hash sha512 --iter-time 5000 /dev/nvme0n1p3

################################################

Now the LVM partition has changed type to CRYPTO partition

blkid|grep -i crypto

Save the UUID of the CRYPTO partition to a variable

UUID="CHANGEME_TO_CRYPTO_PARTITION_UUID"

Open the CRYPTO partition and map to /dev/mapper/luks-${UUID}

cryptsetup open --type=luks2 /dev/nvme0n1p3 luks-${UUID}

################################################

Resize the LVM physical volume, because we had reduced the device size by 32m to fit the LUKS metadata

lvm pvresize /dev/mapper/luks-${UUID}

List the LVM physical volume, volume group, and logical volumes

lvm pvs
lvm vgs
lvm lvs

Activate the LVM logical volumes

vgchange -ay

################################################

Create a temporary directory that we will use to chroot into

mkdir /sysroot

Mount the "root" logical volume to /sysroot

mount /dev/mapper/pve-root /sysroot

Find the efi partition (my case was /dev/nvme0n1p2), and mount it to /sysroot/boot/efi

blkid|grep -i vfat
mount /dev/nvme0n1p2 /sysroot/boot/efi

Mount the virtual system resource directories

mount -t sysfs /sys /sysroot/sys
mount -t proc /proc /sysroot/proc
mount -o bind /dev /sysroot/dev
mount -o bind /dev/pts /sysroot/dev/pts
mount -o bind /run /sysroot/run

Change root into /sysroot

chroot /sysroot

################################################

Edit the /etc/cryptttab file to make initramfs aware of our LUKS CRYPTO PARTITION

vi /etc/crypttab

format of crypttab file is

luks-${UUID} UUID=${UUID} none luks
e.g. "luks-AAAAAAAA UUID=AAAAAAAA none luks"

Apply our /etc/crypttab changes

update-initramfs -u -k all

################################################

Edit the default grub config so grub-mkconfig will generate the "grub.cfg" file with lines to load in the needed kernel modules

vi /etc/default/grub

Add a new line under GRUB_CMDLINE_LINUX=""

GRUB_ENABLE_CRYPTODISK=y

Regenerate the Grub config file

grub-mkconfig -o /boot/efi/EFI/proxmox/grub.cfg

################################################

Now create the /dev/mapper/pve-data logical volume

lvcreate -n data --size 6G pve
lvconvert --type thin-pool pve/data

################################################

Exit out of chroot

exit

Exit out of initramfs

exit

reboot