libreboot
/
lbwww
1
0
Fork 0
Code Packages Projects Releases Activity

nuke obsolete linux fde guides

hslick-master
Leah Rowe 2022-11-19 01:16:55 +00:00
parent f4bd7ed4af
commit 3a97c3fad4
3 changed files with 26 additions and 759 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

367
site/docs/gnulinux/encrypted_debian.md
View File

@ -1,367 +0,0 @@
---
title: Encrypted Debian GNU+Linux
x-toc-enable: true
...
**TODO: This article is obsolete, and a target for future deletion.**
This guide is written for the Debian distribution, but it should also
work for Devuan with the net installer. Other Debian based GNU+Linux
distributions may also work, using these instructions.
This guide assumes that you are using the GNU GRUB bootloader as a coreboot
payload. In this configuration, GNU GRUB runs on *bare metal* instead of
relying on BIOS or UEFI. GNU GRUB has support for directly reading LUKS volumes
and it can directly boot your Linux kernel this way. With GRUB already in the
boot flash, this means that your `/boot/` directory (containing your Linux
kernel) can be fully encrypted. The same cannot be said for most other systems,
and no other coreboot payload provides this functionality.
If booting in text mode
=======================
libreboot ROM images are provided, which will either boot the system in classic
text mode, or with a framebuffer implemented by coreboot for video display
initialization (not to be confused with int10h VGA modes).
*Text mode* is the default video mode on *most* x86 platforms, using `INT 10H`
functions. It's an interrupt service that text-mode applications use, a hangover
from the days of CS/M and DOS. In this mode, no framebuffer exists and onboot
currently does not implement VGA modes. The Debian net installer will attempt
to use VGA modes that most implementations of INT 10H provide. Therefore, you
must force Debian's installation program to operate in text mode.
To boot the Debian net installer, make sure to specify `fb=false` on the linux
kernel parameters in GRUB. This will boot the installer in text mode instead
of using a framebuffer. By default, the netinstaller will try to switch to a
high resolution framebuffer. Due to lack of INT10H video BIOS services and mode
switching support in `libgfxinit`, this will fail.
In *some* setups, you don't need this. For example, if you're using an add-on
PCIe GPU on a desktop/server board (e.g. ASUS KGPE-D16/KCMA-D8, Gigabyte
GA-G41M-ES2L), you would use SeaBIOS payload with text-mode startup, but the
Video BIOS *option ROM* in your add-on graphics card would be executed, and it
would presumably handle INT10H VGA modes.
Boot the installer
==================
libreboot on x86 can use the GNU GRUB bootloader as a bare metal coreboot
[payload](http://www.coreboot.org/Payloads#GRUB_2) if you wish, which
means that the GRUB configuration file (where your GRUB menu comes from)
is stored directly alongside libreboot and its GRUB payload executable,
inside the flash chip. In context, this means that installing
distributions and managing them is handled slightly differently compared
to traditional BIOS or UEFI systems.
On most systems, the `/boot/` partition has to be left unencrypted while
the others are encrypted. This is so that GRUB, and therefore the
kernel, can be loaded and executed since the firmware can't open a LUKS
volume. Not so with libreboot! Since GRUB is already included directly
as a payload, even `/boot/` can be encrypted. This protects /boot from
tampering by someone with physical access to the system.
This guide is written for Debian net installer. You can download the ISO
from the homepage on [debian.org](https://www.debian.org/). Use this on
the GRUB terminal to boot it from USB (for 64-bit Intel or AMD):
set root='usb0'
linux /install.amd/vmlinuz
initrd /install.amd/initrd.gz
boot
If you are on a 32-bit system (e.g. X60):
set root='usb0'
linux /install.386/vmlinuz
initrd /install.386/initrd.gz
boot
[This guide](grub_boot_installer.md) shows how to create a boot USB
drive with the Debian ISO image.
*This guide is only for the GRUB payload. If you use the depthcharge payload,
ignore this section entirely.*
Note: on some thinkpads, a faulty DVD drive can cause the cryptomount -a step
during boot to fail. If this happens to you, try removing the drive.
Set a strong user password (lots of lowercase/uppercase, numbers and symbols).
Use of the *diceware method* is recommended, for generating secure passphrases
(instead of passwords).
When the installer asks you to set up encryption (ecryptfs) for your home
directory, select 'Yes' if you want to: *LUKS is already secure and performs
well. Having ecryptfs on top of it will add noticeable performance penalty, for
little security gain in most use cases. This is therefore optional, and not
recommended. Choose 'no'.*
*Your user password should be different from the LUKS password which you will set later on. Your LUKS password should, like the user password, be secure.*
Partitioning
============
Choose 'Manual' partitioning:
- Select drive and create new partition table
- Single large partition, but not with all the free space, let more than 512MB left (prevent an installer loop on Debian 11 netinst with the bootloader question on the same encrypted device).
- The following are mostly defaults:
- Use as: physical volume for encryption
- Encryption: aes
- key size: whatever default is given to you
- IV algorithm: whatever default is given to you
- Encryption key: passphrase
- erase data: Yes (only choose 'No' if it's a new drive that
doesn't contain your private data)
- Select 'configure encrypted volumes'
- Create encrypted volumes
- Select your partition
- Finish
- Really erase: Yes
- (erase will take a long time. be patient)
- (if your old system was encrypted, just let this run for about a
minute to make sure that the LUKS header is wiped out)
- Select encrypted space:
- use as: physical volume for LVM
- Choose 'done setting up the partition'
- Configure the logical volume manager:
- Keep settings: Yes
- Create volume group:
- Name: `matrix` (use this exact name)
- Select crypto partition
- Create logical volume
- select `matrix` (use this exact name)
- name: `rootvol` (use this exact name)
- size: default, minus 2048 MB
- Create logical volume
- select `matrix` (use this exact name)
- name: `swap` (user this exact name)
- size: press enter
Further partitioning
====================
Now you are back at the main partitioning screen. You will simply set
mountpoints and filesystems to use.
- LVM LV rootvol
- use as: btrfs
- mount point: /
- done setting up partition
- LVM LV swap
- use as: swap area
- done setting up partition
- Now you select 'Finished partitioning and write changes to disk'.
Kernel
======
Installation will ask what kernel you want to use. linux-generic is
fine, but you can choose whatever you want here.
Tasksel
=======
For Debian, use the *MATE* option, or one of the others if you want. The
libreboot project recommends MATE, unless you're saavy enough to choose
something else.
If you want debian-testing, then you should only select barebones
options here and change the entries in /etc/apt/sources.list after
install to point to the new distro, and then run `apt-get update` and
`apt-get dist-upgrade` as root, then reboot and run `tasksel` as
root. This is to avoid downloading large packages twice.
NOTE: If you want the latest up to date version of the Linux kernel,
Debian's kernel is sometimes outdated, even in the testing distro. You
might consider using [this repository](https://jxself.org/linux-libre/)
instead, which contains the most up to date versions of the Linux
kernel. These kernels are also deblobbed, like Debian's kernels, so you
can be sure that no binary blobs are present.
Postfix configuration
=====================
If asked, choose `No Configuration` here (or maybe you want to
select something else. It's up to you.)
Install the GRUB boot loader to the master boot record
======================================================
Choose `No`, and then it will still ask you what HDD to install GRUB on. Select
your HDD/SSD from the automatically generated list.
The installer will provide GRUB on your HDD/SSD, but not try to install it to
an MBR section. However, the `/boot/grub/grub.cfg` on your system will be
maintained automatically by `apt-get` when handling kernel packages.
Clock UTC
=========
Just say 'Yes'.
**At this point, your Debian system is installed. Shut down when the installer
tells you to.**
Booting your system
===================
If you didn't install GRUB during the net installation process, don't worry.
You can boot your installed system manually, using the *terminal* in GRUB on
your boot flash (the version that libreboot gives you).
At this point, you will have finished the installation. At your GRUB
payload, press C to get to reach the GRUB terminal and enter these commands:
cryptomount -a
set root='lvm/matrix-rootvol'
linux /vmlinuz root=/dev/mapper/matrix-rootvol cryptdevice=/dev/mapper/matrix-rootvol:root
initrd /initrd.img
boot
**If you did install GRUB, ignore the above. Just select the default `Load
Operating System` menu option and it should fully boot into your system.**
When you type your encryption passphrase in GRUB, it will seem like the process
has stalled. The same will be true when you load your linux kernel in Debian.
Just be patient and it will boot. If you see errors, just press enter to skip
them until you see the Debian GRUB menu.
ecryptfs
========
If you didn't encrypt your home directory, then you can safely ignore
this section.
Immediately after logging in, do that:
sudo ecryptfs-unwrap-passphrase
This will be needed in the future if you ever need to recover your home
directory from another system, so write it down and keep the note
somewhere secret. Ideally, you should memorize it and then burn the note
(or not even write it down, and memorize it still)>
LUKSv2
======
You do not need to downgrade LUKSv2 to v1, but you shouldn't use any of the special features that LUKSv2 offers. Basically, the partitioning should be done exactly the same way as with LUKSv1 (but with newer encryption/hashing algorithms used by LUKSv2 partitions). This is because of limitations in the implementation of LUKSv2 in GNU GRUB. GRUB uses its own custom implementation, instead of directly adapting the Linux kernel implementation. At the moment it is [only the PBKDF2](https://www.gnu.org/software/grub/manual/grub/grub.html#cryptomount) key derivation function supported. Argon2i, is not yet supported. That's the point, you must convert it from Argon2i to PBKDF2, if you wish to use LUKSv2. Therefor you can use any live distribution with the package, that include dm-crypt.
If the installation is finished, boot with a live CD and change it with:
cryptsetup luksConvertKey --pbkdf pbkdf2 /dev/sdX
If you do find that LUKSv2 is broken, just downgrade to LUKSv1.
Generate distro's grub.cfg
==========================
**If `/boot/grub/grub.cfg` already exists, ignore this step.**
Now you need to set it up so that the system will automatically boot,
without having to type a bunch of commands.
Install grub-coreboot if not already installed:
apt-get install grub-coreboot
Modify or add following lines to /etc/default/grub
GRUB_CMDLINE_LINUX="cryptdevice=/dev/mapper/matrix-rootvol:root"
GRUB_ENABLE_CRYPTODISK=y
Copy fonts/backgrounds to /boot/grub and
generate grub.cfg using following command:
grub-install --target=i386-coreboot
[Refer to this guide](grub_hardening.md) for further guidance on
hardening your GRUB configuration, for security purposes.
Troubleshooting
===============
A user reported issues when booting with a docking station attached on
an X200, while decrypting the disk in GRUB. The error `AHCI transfer
timed out` was observed. The workaround was to remove the docking
station or remove the CD/DVD drive.
Here is the information on that DVD drive, which said user had:
"sudo wodim -prcap" shows information about the drive:
Device was not specified. Trying to find an appropriate drive...
Detected CD-R drive: /dev/sr0
Using /dev/cdrom of unknown capabilities
Device type : Removable CD-ROM
Version : 5
Response Format: 2
Capabilities :
Vendor_info : 'HL-DT-ST'
Identification : 'DVDRAM GU10N '
Revision : 'MX05'
Device seems to be: Generic mmc2 DVD-R/DVD-RW.
Drive capabilities, per MMC-3 page 2A:
Does read CD-R media
Does write CD-R media
Does read CD-RW media
Does write CD-RW media
Does read DVD-ROM media
Does read DVD-R media
Does write DVD-R media
Does read DVD-RAM media
Does write DVD-RAM media
Does support test writing
Does read Mode 2 Form 1 blocks
Does read Mode 2 Form 2 blocks
Does read digital audio blocks
Does restart non-streamed digital audio reads accurately
Does support Buffer-Underrun-Free recording
Does read multi-session CDs
Does read fixed-packet CD media using Method 2
Does not read CD bar code
Does not read R-W subcode information
Does read raw P-W subcode data from lead in
Does return CD media catalog number
Does return CD ISRC information
Does support C2 error pointers
Does not deliver composite A/V data
Does play audio CDs
Number of volume control levels: 256
Does support individual volume control setting for each channel
Does support independent mute setting for each channel
Does not support digital output on port 1
Does not support digital output on port 2
Loading mechanism type: tray
Does support ejection of CD via START/STOP command
Does not lock media on power up via prevent jumper
Does allow media to be locked in the drive via PREVENT/ALLOW command
Is not currently in a media-locked state
Does not support changing side of disk
Does not have load-empty-slot-in-changer feature
Does not support Individual Disk Present feature
Maximum read speed: 4234 kB/s (CD 24x, DVD 3x)
Current read speed: 4234 kB/s (CD 24x, DVD 3x)
Maximum write speed: 4234 kB/s (CD 24x, DVD 3x)
Current write speed: 4234 kB/s (CD 24x, DVD 3x)
Rotational control selected: CLV/PCAV
Buffer size in KB: 1024
Copy management revision supported: 1
Number of supported write speeds: 4
Write speed # 0: 4234 kB/s CLV/PCAV (CD 24x, DVD 3x)
Write speed # 1: 2822 kB/s CLV/PCAV (CD 16x, DVD 2x)
Write speed # 2: 1764 kB/s CLV/PCAV (CD 10x, DVD 1x)
Write speed # 3: 706 kB/s CLV/PCAV (CD 4x, DVD 0x)
Supported CD-RW media types according to MMC-4 feature 0x37:
Does write multi speed CD-RW media
Does write high speed CD-RW media
Does write ultra high speed CD-RW media
Does not write ultra high speed+ CD-RW media

376
site/docs/gnulinux/guix.md
View File

@ -1,376 +0,0 @@
---
title: Encrypted Guix GNU+Linux
x-toc-enable: true
...
Objective
=========
To provide step-by-step guide for setting up guix system (stand-alone guix) with
full disk encryption (including /boot) on devices powered by libreboot.
Scope
=====
Any users, for their generalised use cases, need not stumble away from this
guide to accomplish the setup.
Advanced users, for deviant use cases, will have to explore outside this guide
for customisation; although this guide provides information that is of paramount
use.
Process
=======
Preparation
-----------
In your current GNU+Linux System, open terminal as root user.
Insert USB drive and get the USB device name /dev/sdX, where “X” is the variable
to make a note of.
lsblk
Unmount the USB drive just in case if it’s auto-mounted.
umount /dev/sdX
Download the latest (a.b.c) Guix System ISO Installer Package (sss) and it’s GPG
Signature; where “a.b.c” is the variable for version number and “sss” is the
variable for system architecture.
wget https://ftp.gnu.org/gnu/guix/guix-system-install-a.b.c.sss-linux.iso.xz
wget https://ftp.gnu.org/gnu/guix/guix-system-install-a.b.c.sss-linux.iso.xz.sig
Import required public key.
gpg --keyserver pool.sks-keyservers.net --recv-keys 3CE464558A84FDC69DB40CFB090B11993D9AEBB5
Verify the GPG Signature of the downloaded package.
gpg --verify guix-system-install-a.b.c.sss-linux.iso.xz.sig
Extract the ISO Image from the downloaded package.
xz --decompress guix-system-install-a.b.c.sss-linux.iso.xz
Write the extracted ISO Image to the USB drive.
dd if=guix-system-install-a.b.c.sss-linux.iso of=/dev/sdX; sync
Reboot the device.
reboot
Pre-Installation
----------------
On reboot, as soon as you see the GNU GRUB menu, press arrow keys to
change the menu entry.
Choose “Search for GRUB2 configuration on external media [s]” and wait for the
Guix System from USB drive to load.
Set your keyboard layout lo, where “lo” is the two-letter keyboard layout code
(example: us or uk).
loadkeys lo
Unblock network interfaces (if any).
rfkill unblock all
Get the names of your network interfaces.
ifconfig -a
Bring your required network interface nwif (wired or wireless) up, where “nwif”
is the variable for interface name. For wired connections, this should be
enough.
ifconfig nwif up
For wireless connection, create a configuration file using text editor, where
“fname” is the variable for any desired filename.
nano fname.conf
Choose, type and save ONE of the following snippets, where ‘nm’ is the name of
the network you want to connect, ‘pw’ is the corresponding network’s password or
passphrase and ‘un’ is user identity.
For most private networks:
network={
ssid="nm"
key_mgmt=WPA-PSK
psk="pw"
}
(or)
For most public networks:
network={
ssid="nm"
key_mgmt=NONE
}
(or)
For most organisational networks:
network={
ssid="nm"
scan_ssid=1
key_mgmt=WPA-EAP
identity="un"
password="pw"
eap=PEAP
phase1="peaplabel=0"
phase2="auth=MSCHAPV2"
}
Connect to the configured network, where “fname” is the filename and “nwif” is
the network interface name.
wpa_supplicant -c fname.conf -i nwif -B
Assign an IP address to your network interface, where “nwif” is the network
interface name.
dhclient -v nwif
If your Guix installation image doesn't have support for LVM, do the following.
guix pull --branch=master && guix install lvm2
Obtain the device name /dev/sdX in which you would like to deploy and install
Guix System, where “X” is the variable to make a note of.
lsblk
Wipe the respective device. Wait for the command operation to finish.
shred --random-source=/dev/urandom /dev/sdX
Load device-mapper module in the current kernel.
modprobe dm_mod
Partition the respective device. Just do, GPT --> New --> Write --> Quit;
defaults will be set.
cfdisk /dev/sdX
Encrypt the respective partition.
cryptsetup --verbose --hash whirlpool --cipher serpent-xts-plain64 --verify-passphrase --use-random --key-size 512 --iter-time 500 luksFormat /dev/sdX1
Obtain and note down the “LUKS UUID”.
cryptsetup luksUUID /dev/sdX1
Open the respective encrypted partition and map it as 'fde'.
cryptsetup luksOpen /dev/sdX1 fde
Create a physical volume in the partition.
pvcreate /dev/mapper/fde
Create a volume group in the physical volume, named 'matrix'.
vgcreate matrix /dev/mapper/fde
Create a logical volume of 2GiB for swap, named 'swapvol'.
lvcreate --size 2G matrix --name swapvol
Create a logical volume of rest of free-space for root, named 'rootvol'.
lvcreate --extents 100%FREE matrix --name rootvol
Create swap space in the logical volume 'swapvol', labeled 'swap'.
mkswap --label swap /dev/matrix/swapvol
Create filesystem in the logical volume 'rootvol', labeled 'root'.
mkfs.btrfs --metadata dup --label root /dev/matrix/rootvol
Mount the root filesystem under the current system.
mount --label root --target /mnt --types btrfs
Installation
------------
Make the installation packages to be written on the respective mounted
filesystem.
herd start cow-store /mnt
Create the required directory.
mkdir /mnt/etc
Create, edit and save the configuration file by typing the following code
snippet. WATCH-OUT for variables in the code snippet and replace them with your
relevant values.
nano /mnt/etc/config.scm
Snippet:
(use-modules
(gnu)
(gnu system nss))
(use-package-modules
certs
gnome
linux)
(use-service-modules
desktop
xorg)
(operating-system
(kernel linux-libre-lts)
(bootloader
(bootloader-configuration
(bootloader
(bootloader
(inherit grub-bootloader)
(installer #~(const #t))))
(keyboard-layout keyboard-layout)))
(keyboard-layout
(keyboard-layout
"xy"
"altgr-intl"))
(host-name "hostname")
(mapped-devices
(list
(mapped-device
(source
(uuid "luks-uuid"))
(target "fde")
(type luks-device-mapping))
(mapped-device
(source "matrix")
(targets
(list
"matrix-rootvol"
"matrix-swapvol"))
(type lvm-device-mapping))))
(file-systems
(append
(list
(file-system
(type "btrfs")
(mount-point "/")
(device (file-system-label "root"))
(flags '(no-atime))
(options "space_cache=v2")
(needed-for-boot? #t)
(dependencies mapped-devices)))
%base-file-systems))
(swap-devices
(list
(file-system-label "swap")))
(users
(append
(list
(user-account
(name "username")
(comment "Full Name")
(group "users")
(supplementary-groups '("audio" "cdrom" "kvm" "lp" "netdev" "tape" "video" "wheel"))))
%base-user-accounts))
(packages
(append
(list
nss-certs)
%base-packages))
(timezone "Zone/SubZone")
(locale "ab_XY.1234")
(name-service-switch %mdns-host-lookup-nss)
(services
(append
(list
(service gnome-desktop-service-type))
%desktop-services)))
Initialise new Guix System.
guix system init /mnt/etc/config.scm /mnt
Reboot the device.
reboot
Post-Installation
------------
On reboot, as soon as you see the GNU GRUB menu, choose the option
'Load Operating System [o]'
Enter LUKS Key, for libreboot's grub, as prompted.
You may have to go through warning prompts by repeatedly pressing the
"enter/return" key.
You will now see guix's grub menu from which you can go with the default option.
Enter LUKS Key again, for kernel, as prompted.
Upon login screen, login as "root" with password field empty.
Open terminal from the GNOME Dash.
Set passkey for "root" user. Follow the prompts.
passwd root
Set passkey for "username" user. Follow the prompts.
passwd username
Update the guix distribution. Wait for the process to finish.
guix pull
Update the guix system. Wait for the process to finish.
guix system reconfigure /etc/config.scm
Reboot the device.
reboot
Conclusion
==========
Everything should be stream-lined from now. You can follow your regular boot
steps without requiring manual intervention. You can start logging in as regular
user with the respective "username".
You will have to periodically (at your convenient time) login as root and do the
update/upgrade part of post-installation section, to keep your guix distribution
and guix system updated.
That is it! You have now setup guix system with full-disk encryption on your
device powered by libreboot. Enjoy!
References
==========
[1] Guix Manual (http://guix.gnu.org/manual/en/).
Acknowledgements
================
[1] Thanks to Guix Developer, Clement Lassieur (clement@lassieur.org),
for helping me with the Guile Scheme Code for the Bootloader Configuration.

42
site/docs/gnulinux/index.md
View File

@ -26,28 +26,38 @@ Refer to the following pages:
* [How to Prepare and Boot a USB Installer in libreboot Systems](grub_boot_installer.md)
* [Modifying the GRUB Configuration in libreboot Systems](grub_cbfs.md)
* [Installing Hyperbola GNU+Linux, with Full-Disk Encryption (including /boot)](https://wiki.hyperbola.info/en:guide:encrypted_installation)
* [Installing Debian or Devuan GNU+Linux-Libre, with Full-Disk Encryption (including /boot)](encrypted_debian.md)
* [Installing Guix System, with Full-Disk Encryption (including /boot)](guix.md)
* [How to Harden Your GRUB Configuration, for Security](grub_hardening.md)
Guix, Parabola, Trisquel
========================
Encrypted (LUKS/dm-crypt) installations
=======================================
These guides were outdated, so they were deleted. You can find links to them
here: <https://notabug.org/libreboot/lbwww/issues/4>
You should install with unencrypted `/boot` partition, but everything else
encrypted. The GRUB payload has LUKSv1 support and (buggy) LUKSv2 support.
The Debian guide has been retained, because it's currently up to date. The
Hyperbola guide is already on the Hyperbola website, and the above is just a
link.
There used to be guides for encrypted `/boot` on libreboot.org, but it's not
really viable to do that anymore (with GRUB), due to buggy/incomplete LUKS
support in GRUB.
In general, it is recommended that you use SeaBIOS but if you want extra security,
GRUB payload is recommended where you can then have a fully encrypted /boot
directory.
A better solution for that would be a Linux payload in flash, handling the
encryption, at least if you want to use Linux, because then it'll have
perfect LUKS support.
TODO: Nuke *all* distro-specific guides on libreboot.org. Instead, move these
instructions to the wiki pages of these projects, on their websites. The reasons
are explained in the above issue page.
GRUB otherwise has good filesystem support, so if you have a valid `grub.cfg`
in `/boot/grub` on your installed system, Libreboot's GRUB configuration has
logic in it that will try to automatically use whatever you have installed,
by switching to it. In this way, most installations Just Work, so long as
the `/boot` partition is accessible.
If you do want encrypted /boot in your distro, please ensure that you have
downgraded to LUKSv1, and generic advice for booting is this (press C to
access a GRUB terminal, when you're in the GRUB payload):
set root=`lvm/bla-bla`
linux /vmlinuz root=/dev/mapper/bla-bla cryptdevice=/dev/mapper/bla-bla:root
initrd /initrd.img
boot
Adapt according to your configuration.
Rebooting system in case of freeze
===================================