On Fri, Jul 31, 2015 at 4:21 PM, Gordon Messmer gordon.messmer@gmail.com wrote:
On 07/31/2015 02:00 PM, inode0 wrote:
grub2 supports LUKS. You'll need to add GRUB_ENABLE_CRYPTODISK=y to /etc/sysconfig/grub
Interesting. Thanks for the tip! :)
For anyone adventurous enough to try I will mention that if something goes wrong and grub doesn't boot you can still boot the from other media in rescue mode and that will prompt for the encryption keys and mount everything so you can chroot in and go back to work fixing things. Spoken from experience earlier today.
And if you think about it this is obvious but will probably annoy some people. Since grub asks for your password to decrypt /boot and then passes control to a kernel extracted from there you will get asked again for passwords by the kernel for whatever it needs access to - so depending on how you set up the keys you'll get asked for at least one additional password during boot.
John