Add FDE installation guide for Guix.
Guide for setting up Guix System (stand-alone Guix), with Full Disk Encryption (FDE), on devices powered by Libreboot.
This commit is contained in:
Raghav Gururajan
parent
f482022dbf
commit
1c4024210f
|
|
@ -0,0 +1,376 @@
|
||||||
|
---
|
||||||
|
title: Encrypted Guix GNU+Linux
|
||||||
|
x-toc-enable: true
|
||||||
|
...
|
||||||
|
|
||||||
|
Objective
|
||||||
|
=========
|
||||||
|
|
||||||
|
To provide step-by-step guide for setting up guix system (stand-alone guix) with
|
||||||
|
full disk encryption (including /boot) on devices powered by Libreboot.
|
||||||
|
|
||||||
|
Scope
|
||||||
|
=====
|
||||||
|
|
||||||
|
Any users, for their generalised use cases, need not stumble away from this
|
||||||
|
guide to accomplish the setup.
|
||||||
|
|
||||||
|
Advanced users, for deviant use cases, will have to explore outside this guide
|
||||||
|
for customisation; although this guide provides information that is of paramount
|
||||||
|
use.
|
||||||
|
|
||||||
|
Process
|
||||||
|
=======
|
||||||
|
|
||||||
|
Preparation
|
||||||
|
-----------
|
||||||
|
|
||||||
|
In your current GNU+Linux System, open terminal as root user.
|
||||||
|
|
||||||
|
Insert USB drive and get the USB device name /dev/sdX, where “X” is the variable
|
||||||
|
to make a note of.
|
||||||
|
|
||||||
|
lsblk
|
||||||
|
|
||||||
|
Unmount the USB drive just in case if it’s auto-mounted.
|
||||||
|
|
||||||
|
umount /dev/sdX
|
||||||
|
|
||||||
|
Download the latest (a.b.c) Guix System ISO Installer Package (sss) and it’s GPG
|
||||||
|
Signature; where “a.b.c” is the variable for version number and “sss” is the
|
||||||
|
variable for system architecture.
|
||||||
|
|
||||||
|
wget https://ftp.gnu.org/gnu/guix/guix-system-install-a.b.c.sss-linux.iso.xz
|
||||||
|
|
||||||
|
wget https://ftp.gnu.org/gnu/guix/guix-system-install-a.b.c.sss-linux.iso.xz.sig
|
||||||
|
|
||||||
|
Import required public key.
|
||||||
|
|
||||||
|
gpg --keyserver pool.sks-keyservers.net --recv-keys 3CE464558A84FDC69DB40CFB090B11993D9AEBB5
|
||||||
|
|
||||||
|
Verify the GPG Signature of the downloaded package.
|
||||||
|
|
||||||
|
gpg --verify guix-system-install-a.b.c.sss-linux.iso.xz.sig
|
||||||
|
|
||||||
|
Extract the ISO Image from the downloaded package.
|
||||||
|
|
||||||
|
xz --decompress guix-system-install-a.b.c.sss-linux.iso.xz
|
||||||
|
|
||||||
|
Write the extracted ISO Image to the USB drive.
|
||||||
|
|
||||||
|
dd if=guix-system-install-a.b.c.sss-linux.iso of=/dev/sdX; sync
|
||||||
|
|
||||||
|
Reboot the device.
|
||||||
|
|
||||||
|
reboot
|
||||||
|
|
||||||
|
Pre-Installation
|
||||||
|
----------------
|
||||||
|
|
||||||
|
On reboot, as soon as you see the Libreboot Graphic Art, press arrow keys to
|
||||||
|
change the menu entry.
|
||||||
|
|
||||||
|
Choose “Search for GRUB2 configuration on external media [s]” and wait for the
|
||||||
|
Guix System from USB drive to load.
|
||||||
|
|
||||||
|
Set your keyboard layout lo, where “lo” is the two-letter keyboard layout code
|
||||||
|
(example: us or uk).
|
||||||
|
|
||||||
|
loadkeys lo
|
||||||
|
|
||||||
|
Unblock network interfaces (if any).
|
||||||
|
|
||||||
|
rfkill unblock all
|
||||||
|
|
||||||
|
Get the names of your network interfaces.
|
||||||
|
|
||||||
|
ifconfig -a
|
||||||
|
|
||||||
|
Bring your required network interface nwif (wired or wireless) up, where “nwif”
|
||||||
|
is the variable for interface name. For wired connections, this should be
|
||||||
|
enough.
|
||||||
|
|
||||||
|
ifconfig nwif up
|
||||||
|
|
||||||
|
For wireless connection, create a configuration file using text editor, where
|
||||||
|
“fname” is the variable for any desired filename.
|
||||||
|
|
||||||
|
nano fname.conf
|
||||||
|
|
||||||
|
Choose, type and save ONE of the following snippets, where ‘nm’ is the name of
|
||||||
|
the network you want to connect, ‘pw’ is the corresponding network’s password or
|
||||||
|
passphrase and ‘un’ is user identity.
|
||||||
|
|
||||||
|
For most private networks:
|
||||||
|
|
||||||
|
network={
|
||||||
|
ssid="nm"
|
||||||
|
key_mgmt=WPA-PSK
|
||||||
|
psk="pw"
|
||||||
|
}
|
||||||
|
|
||||||
|
(or)
|
||||||
|
|
||||||
|
For most public networks:
|
||||||
|
|
||||||
|
network={
|
||||||
|
ssid="nm"
|
||||||
|
key_mgmt=NONE
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
(or)
|
||||||
|
|
||||||
|
For most organisational networks:
|
||||||
|
|
||||||
|
network={
|
||||||
|
ssid="nm"
|
||||||
|
scan_ssid=1
|
||||||
|
key_mgmt=WPA-EAP
|
||||||
|
identity="un"
|
||||||
|
password="pw"
|
||||||
|
eap=PEAP
|
||||||
|
phase1="peaplabel=0"
|
||||||
|
phase2="auth=MSCHAPV2"
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
Connect to the configured network, where “fname” is the filename and “nwif” is
|
||||||
|
the network interface name.
|
||||||
|
|
||||||
|
wpa_supplicant -c fname.conf -i nwif -B
|
||||||
|
|
||||||
|
Assign an IP address to your network interface, where “nwif” is the network
|
||||||
|
interface name.
|
||||||
|
|
||||||
|
dhclient -v nwif
|
||||||
|
|
||||||
|
If your Guix installation image doesn't have support for LVM, do the following.
|
||||||
|
|
||||||
|
guix pull --branch=master && guix install lvm2
|
||||||
|
|
||||||
|
Obtain the device name /dev/sdX in which you would like to deploy and install
|
||||||
|
Guix System, where “X” is the variable to make a note of.
|
||||||
|
|
||||||
|
lsblk
|
||||||
|
|
||||||
|
Wipe the respective device. Wait for the command operation to finish.
|
||||||
|
|
||||||
|
shred --random-source=/dev/urandom /dev/sdX
|
||||||
|
|
||||||
|
Load device-mapper module in the current kernel.
|
||||||
|
|
||||||
|
modprobe dm_mod
|
||||||
|
|
||||||
|
Partition the respective device. Just do, GPT --> New --> Write --> Quit;
|
||||||
|
defaults will be set.
|
||||||
|
|
||||||
|
cfdisk /dev/sdX
|
||||||
|
|
||||||
|
Encrypt the respective partition.
|
||||||
|
|
||||||
|
cryptsetup --verbose --hash whirlpool --cipher serpent-xts-plain64 --verify-passphrase --use-random --key-size 512 --iter-time 500 luksFormat /dev/sdX1
|
||||||
|
|
||||||
|
Obtain and note down the “LUKS UUID”.
|
||||||
|
|
||||||
|
cryptsetup luksUUID /dev/sdX1
|
||||||
|
|
||||||
|
Open the respective encrypted partition and map it as 'fde'.
|
||||||
|
|
||||||
|
cryptsetup luksOpen /dev/sdX1 fde
|
||||||
|
|
||||||
|
Create a physical volume in the partition.
|
||||||
|
|
||||||
|
pvcreate /dev/mapper/fde
|
||||||
|
|
||||||
|
Create a volume group in the physical volume, named 'matrix'.
|
||||||
|
|
||||||
|
vgcreate matrix /dev/mapper/fde
|
||||||
|
|
||||||
|
Create a logical volume of 2GiB for swap, named 'swapvol'.
|
||||||
|
|
||||||
|
lvcreate --size 2G matrix --name swapvol
|
||||||
|
|
||||||
|
Create a logical volume of rest of free-space for root, named 'rootvol'.
|
||||||
|
|
||||||
|
lvcreate --extents 100%FREE matrix --name rootvol
|
||||||
|
|
||||||
|
Create swap space in the logical volume 'swapvol', labeled 'swap'.
|
||||||
|
|
||||||
|
mkswap --label swap /dev/matrix/swapvol
|
||||||
|
|
||||||
|
Create filesystem in the logical volume 'rootvol', labeled 'root'.
|
||||||
|
|
||||||
|
mkfs.btrfs --metadata dup --label root /dev/matrix/rootvol
|
||||||
|
|
||||||
|
Mount the root filesystem under the current system.
|
||||||
|
|
||||||
|
mount --label root --target /mnt --types btrfs
|
||||||
|
|
||||||
|
Installation
|
||||||
|
------------
|
||||||
|
|
||||||
|
Make the installation packages to be written on the respective mounted
|
||||||
|
filesystem.
|
||||||
|
|
||||||
|
herd start cow-store /mnt
|
||||||
|
|
||||||
|
Create the required directory.
|
||||||
|
|
||||||
|
mkdir /mnt/etc
|
||||||
|
|
||||||
|
Create, edit and save the configuration file by typing the following code
|
||||||
|
snippet. WATCH-OUT for variables in the code snippet and replace them with your
|
||||||
|
relevant values.
|
||||||
|
|
||||||
|
nano /mnt/etc/config.scm
|
||||||
|
|
||||||
|
Snippet:
|
||||||
|
|
||||||
|
(use-modules
|
||||||
|
(gnu)
|
||||||
|
(gnu system nss))
|
||||||
|
(use-package-modules
|
||||||
|
certs
|
||||||
|
gnome
|
||||||
|
linux)
|
||||||
|
(use-service-modules
|
||||||
|
desktop
|
||||||
|
xorg)
|
||||||
|
(operating-system
|
||||||
|
(kernel linux-libre-lts)
|
||||||
|
(bootloader
|
||||||
|
(bootloader-configuration
|
||||||
|
(bootloader
|
||||||
|
(bootloader
|
||||||
|
(inherit grub-bootloader)
|
||||||
|
(installer #~(const #t))))
|
||||||
|
(keyboard-layout keyboard-layout)))
|
||||||
|
(keyboard-layout
|
||||||
|
(keyboard-layout
|
||||||
|
"xy"
|
||||||
|
"altgr-intl"))
|
||||||
|
(host-name "hostname")
|
||||||
|
(mapped-devices
|
||||||
|
(list
|
||||||
|
(mapped-device
|
||||||
|
(source
|
||||||
|
(uuid "luks-uuid"))
|
||||||
|
(target "fde")
|
||||||
|
(type luks-device-mapping))
|
||||||
|
(mapped-device
|
||||||
|
(source "matrix")
|
||||||
|
(targets
|
||||||
|
(list
|
||||||
|
"matrix-rootvol"
|
||||||
|
"matrix-swapvol"))
|
||||||
|
(type lvm-device-mapping))))
|
||||||
|
(file-systems
|
||||||
|
(append
|
||||||
|
(list
|
||||||
|
(file-system
|
||||||
|
(type "btrfs")
|
||||||
|
(mount-point "/")
|
||||||
|
(device (file-system-label "root"))
|
||||||
|
(flags '(no-atime))
|
||||||
|
(options "space_cache=v2")
|
||||||
|
(needed-for-boot? #t)
|
||||||
|
(dependencies mapped-devices)))
|
||||||
|
%base-file-systems))
|
||||||
|
(swap-devices
|
||||||
|
(list
|
||||||
|
(file-system-label "swap")))
|
||||||
|
(users
|
||||||
|
(append
|
||||||
|
(list
|
||||||
|
(user-account
|
||||||
|
(name "username")
|
||||||
|
(comment "Full Name")
|
||||||
|
(group "users")
|
||||||
|
(supplementary-groups '("audio" "cdrom" "kvm" "lp" "netdev" "tape" "video" "wheel"))))
|
||||||
|
%base-user-accounts))
|
||||||
|
(packages
|
||||||
|
(append
|
||||||
|
(list
|
||||||
|
nss-certs)
|
||||||
|
%base-packages))
|
||||||
|
(timezone "Zone/SubZone")
|
||||||
|
(locale "ab_XY.1234")
|
||||||
|
(name-service-switch %mdns-host-lookup-nss)
|
||||||
|
(services
|
||||||
|
(append
|
||||||
|
(list
|
||||||
|
(service gnome-desktop-service-type))
|
||||||
|
%desktop-services)))
|
||||||
|
|
||||||
|
Initialise new Guix System.
|
||||||
|
|
||||||
|
guix system init /mnt/etc/config.scm /mnt
|
||||||
|
|
||||||
|
Reboot the device.
|
||||||
|
|
||||||
|
reboot
|
||||||
|
|
||||||
|
Post-Installation
|
||||||
|
------------
|
||||||
|
|
||||||
|
On reboot, as soon as you see the Libreboot Graphic Art, choose the option
|
||||||
|
'Load Operating System [o]'
|
||||||
|
|
||||||
|
Enter LUKS Key, for Libreboot's grub, as prompted.
|
||||||
|
|
||||||
|
You may have to go through warning prompts by repeatedly pressing the
|
||||||
|
"enter/return" key.
|
||||||
|
|
||||||
|
You will now see guix's grub menu from which you can go with the default option.
|
||||||
|
|
||||||
|
Enter LUKS Key again, for kernel, as prompted.
|
||||||
|
|
||||||
|
Upon login screen, login as "root" with password field empty.
|
||||||
|
|
||||||
|
Open terminal from the GNOME Dash.
|
||||||
|
|
||||||
|
Set passkey for "root" user. Follow the prompts.
|
||||||
|
|
||||||
|
passwd root
|
||||||
|
|
||||||
|
Set passkey for "username" user. Follow the prompts.
|
||||||
|
|
||||||
|
passwd username
|
||||||
|
|
||||||
|
Update the guix distribution. Wait for the process to finish.
|
||||||
|
|
||||||
|
guix pull
|
||||||
|
|
||||||
|
Update the guix system. Wait for the process to finish.
|
||||||
|
|
||||||
|
guix system reconfigure /etc/config.scm
|
||||||
|
|
||||||
|
Reboot the device.
|
||||||
|
|
||||||
|
reboot
|
||||||
|
|
||||||
|
Conclusion
|
||||||
|
==========
|
||||||
|
|
||||||
|
Everything should be stream-lined from now. You can follow your regular boot
|
||||||
|
steps without requiring manual intervention. You can start logging in as regular
|
||||||
|
user with the respective "username".
|
||||||
|
|
||||||
|
You will have to periodically (at your convenient time) login as root and do the
|
||||||
|
update/upgrade part of post-installation section, to keep your guix distribution
|
||||||
|
and guix system updated.
|
||||||
|
|
||||||
|
That is it! You have now setup guix system with full-disk encryption on your
|
||||||
|
device powered by Libreboot. Enjoy!
|
||||||
|
|
||||||
|
References
|
||||||
|
==========
|
||||||
|
|
||||||
|
[1] Guix Manual (http://guix.gnu.org/manual/en/).
|
||||||
|
|
||||||
|
Acknowledgements
|
||||||
|
================
|
||||||
|
|
||||||
|
[1] Thanks to Guix Developer, Clement Lassieur (clement@lassieur.org),
|
||||||
|
for helping me with the Guile Scheme Code for the Bootloader Configuration.
|
||||||
|
|
@ -25,6 +25,7 @@ Refer to the following pages:
|
||||||
* [Modifying the GRUB Configuration in Libreboot Systems](grub_cbfs.md)
|
* [Modifying the GRUB Configuration in Libreboot Systems](grub_cbfs.md)
|
||||||
* [Installing Hyperbola GNU+Linux, with Full-Disk Encryption (including /boot)](https://wiki.hyperbola.info/en:guide:encrypted_installation)
|
* [Installing Hyperbola GNU+Linux, with Full-Disk Encryption (including /boot)](https://wiki.hyperbola.info/en:guide:encrypted_installation)
|
||||||
* [Installing Debian or Devuan GNU+Linux-Libre, with Full-Disk Encryption (including /boot)](encrypted_debian.md)
|
* [Installing Debian or Devuan GNU+Linux-Libre, with Full-Disk Encryption (including /boot)](encrypted_debian.md)
|
||||||
|
* [Installing Guix System, with Full-Disk Encryption (including /boot)](guix.md)
|
||||||
* [How to Harden Your GRUB Configuration, for Security](grub_hardening.md)
|
* [How to Harden Your GRUB Configuration, for Security](grub_hardening.md)
|
||||||
|
|
||||||
Guix, Parabola, Trisquel
|
Guix, Parabola, Trisquel
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue