/boot and encrypted partitions?

[inode0]

On Fri, Jul 31, 2015 at 4:21 PM, Gordon Messmer
<gordon.messmer at gmail.com> wrote:
> On 07/31/2015 02:00 PM, inode0 wrote:
>>
>> grub2 supports LUKS. You'll need to add GRUB_ENABLE_CRYPTODISK=y to
>> /etc/sysconfig/grub
>
>
> Interesting.  Thanks for the tip! :)

For anyone adventurous enough to try I will mention that if something
goes wrong and grub doesn't boot you can still boot the from other
media in rescue mode and that will prompt for the encryption keys and
mount everything so you can chroot in and go back to work fixing
things. Spoken from experience earlier today.

And if you think about it this is obvious but will probably annoy some
people. Since grub asks for your password to decrypt /boot and then
passes control to a kernel extracted from there you will get asked
again for passwords by the kernel for whatever it needs access to - so
depending on how you set up the keys you'll get asked for at least one
additional password during boot.

John