3. Set the system up for encryption by booting into a live environment. I used an Ubuntu 23.10 Live USB drive for this and connected display, mouse and keyboard to the server.
3.1. First we need a separate /boot partition that remains unencrypted. (Newer versions of cryptsetup can work with encrypted /boot partitions but I haven't tried that yet.)
a. We use Gparted to shrink our OMV system partition by a few GiB (I did 4, but 2 should be enough as well).
b. Create a new ext4 partition in the freed space. Use boot as label and as name (LABEL and PARTNAME).
c. Find out the device name of our system partition via sudo lsblk or sudo blkid. In my case /dev/nvme1n1p2
d. Mount it: sudo mount /dev/nvme1n1p2 /mnt
e. Now we backup our /boot folder and create an empty one:
sudo mv /mnt/boot /mnt/boot.old
sudo mkdir /mnt/boot
f. We mount our new partition: sudo mount LABEL=boot /mnt/boot
g. We copy the old /boot folder to the new partition: sudo cp -a /mnt/boot.old/* /mnt/boot/
h. We add the following line to /mnt/etc/fstab:
LABEL=boot /boot ext4 defaults 0 2
i. We unmount both the system and the boot partition:
sudo umount /mnt/boot
sudo umount /mnt
3.2. We stay in the live environment. Now we need to prepare our system partition to be able to be encrypted.
The LUKS Header needs up to 32 MB of space at the beginning of the partition, that we need to create.
a. Check the partition for errors. This needs to be done before changing it. sudo e2fsck -f /dev/nvme1n1p2
b. Now we need to resize the filesystem inside the partition (not the partition itself!) to make room for our LUKS header. Here it is advisable to be generous with space, the change is only temporary. My partition was 32 GiB with only about 10 used, so I resized to 20 G: sudo resize2fs /dev/nvme1n1p2 20G
c. Now we can create the LUKS header and initialize the encryption: sudo cryptsetup reencrypt --encrypt --init-only --reduce-device-size 32m /dev/nvme1n1p2 root_crypt After setting a passphrase the partition has a LUKS header and we are asked for its passphrase during boot. It is still unencrypted though. The actual encryption can be started at any time now, and also from within the running system.
d. We check our new LUKS partition: sudo e2fsck -f /dev/mapper/root_crypt.
e. And now we can resize the filesystem to use the whole partition again: sudo resize2fs /dev/mapper/root_crypt
3.3 Now we need to chroot into our omv system to update the system to the new configuration.
a. Find our EFI partition via sudo lsblk, sudo blkid, Gnome Disks or Gparted (for me it's /dev/nvme1n1p1).
b. Mount our partitions:
sudo mount /dev/mapper/root_crypt /mnt
sudo mount LABEL=boot /mnt/boot
sudo mount /dev/nvme1n1p1 /mnt/boot/efi
c. chroot in our omv system:
for d in dev sys proc tmp; do sudo mount --bind /${d} /mnt/${d}; done
sudo chroot /mnt
d. Now we can find out the UUID of /dev/mapper/root_crypt via sudo blkid /dev/mapper/root_crypt and change the root partition's /etc/fstab entry to the new UUID:
# / was on /dev/nvme0n1p2 during installation
UUID=xxxx / ext4 errors=remount-ro 0 1
When editing the /etc/fstab be aware that the text between # >>> [openmediavault] and # <<< [openmediavault] should remain unchanged.
e. Now we find out the UUID of the encrypted partition via sudo blkid /dev/nvme1n1p2 and add that to the /etc/crypttab:
# <target name> <source device> <key file> <options>
cswap1 PARTUUID=xxx /dev/urandom swap,cipher=aes-xts-plain64,size=256,discard
root_crypt UUID=xxx none luks,discard
f. Now we can also add our encrypted data disks to the /etc/crypttab with their respective UUIDs. If we want them to be automatically unlocked when unlocking the root partition, we need to use the same key for them as we used for the root partition.
I use the same passphrase, I guess it would also work with keyfiles. If one uses different passphrases, the passphrase we used for the root partition can simply be added to the existing disks in another keyslot (either via command line or via the OMV plugin).
If the same key is used we just need to add keyscript=decrypt_keyctl to the options and all drives get unlocked when unlocking the root partition during the boot process. The /etc/crypttab should look like this:
# <target name> <source device> <key file> <options>
cswap1 PARTUUID=xyz /dev/urandom swap,cipher=aes-xts-plain64,size=256,discard
root_crypt UUID=xxx none luks,discard,keyscript=decrypt_keyctl
data1_crypt UUID=yyy none luks,discard,keyscript=decrypt_keyctl
data2_crypt UUID=zzz none luks,discard,keyscript=decrypt_keyctl
g. Now we update our initramfs and reinstall the bootloader:
sudo update-initramfs -c -k all
sudo grub-install
sudo update-grub
h. We can now leave the chroot-environment: exit and unmount our devices:
for d in dev sys proc tmp boot/efi boot ""; do sudo umount /mnt/${d}; done
sudo cryptsetup close root_crypt
i. Shut down the live environment. Display, mouse and keyboard shouldn't be needed anymore.
4. Booting the system and finishing the encryption
a. Power up the server.
b. We can ping the IP we set up for the server to see when it is available:
user@Desktop:~$ ping 192.xxx.xxx.xx
c. When we see a response we can connect to dropbear using ssh and the port we configured in the beginning:
user@Desktop:~$ ssh -p 33333 root@192.xxx.xxx.xx
(Connecting as root is necessary. Dropbear doesn't know our OMV users.)
d. We can now enter the password for our root partition. The output should be something like this:
Please unlock disk root_crypt:
cryptsetup: root_crypt set up successfully
Connection to 192.xxx.xxx.xx closed.
e. Now the system will start, unlock all drives from crypttab and we can use our regular ssh connection to connect to the server. Dropbear is only reachable during boot and closes the connection after unlocking the system partition.
f. Now, whenever we want, we can finish the encryption with the command sudo cryptsetup reencrypt --active-name root_crypt. This can be interrupted with Ctrl+Cwhen necessary and resumed at any time. In my case it took only a few minutes though.
g. If everything works, we could delete the /boot.old folder now.
That's it. Full disk encryption with automatic unlock for data drives.
Addditionally to what I already mentioned, here are some guides that helped me a lot when trying to figure this out (two in German, one behind paywall):
LUKS-Festplatten-Vollverschlüsselung per SSH entsperren - codingblatt.de
https://www.cyberciti.biz/security/how-to-unlock-luks-using-dropbear-ssh-keys-remotely-in-linux/
sorry. Anyway: