Spyke

Syndicated from the fediverse. Read and engage on the original instance.

View original on lemmy.today
linux·Linuxbysic_semper_tyrannis

BTRFS Question

I've been using Mint for a number of years and I encrypted the drive. An annoyance is I have two drives and the second one needs a different encryption and needs to be mounted seperately when I log in (besides if I tell it to automount with a saved password) I've been looking to change distros and finally chose one, this time though it uses BTRFS. I read over a number of differences but am not technical enough to know what it all means.

My question for now is with BTRFS, when installing the distro, can I tell it to use my second drive as an extension of the main drive so it all gets recognized as one, seamless?

View original on lemmy.today
21
Comments10

10 replies

med
sh.itjust.works

I've seen the recommendations of software raid0. The answers are all technically correct.

Don't do this. Especially with real hardware. If you lose one drive, you will lose both the drives.

Could you give us more info on how your other encrypted drive is mounted and meant to be used?

  • It is possible to get the second encrypted drive to decrypt and mount automatically, without logging in.
  • It's possible to do it without leaving a key for your second drive on your primary hard drive using a TPM
  • It is possible to get both drives to decrypt automatically and mount

It all depends how the encryption is being done, and where the mount points are.

Could you give us:

  • The rough dimensions of the drive partitions (fdisk -l)
  • Your current mount points after mounting the second drive (df -h)
1
Ooops
feddit.org

Your best options when you are already doing a fresh new install:

  • make both drives one virtual one with LVM, then encrypt that virtual drive

But that's not related to BTRFS at all and can be done with any file system

  • encrypt both drives with the same password, format them as BTRFS raid0 (again making it one big virtual drive), use the systemd hooks in your initramfs because then the first password you will provide on boot will unlock both drives (only if this fails on the first try you will be asked for additional passwords - also if you mistype your password once you will then have to unlock both by typing the password both; you only get one attempt to unlock everything with the same password).

If you can do this is mostly depending on the specific installer (I would assume only the first option works by default...). It's definitely possible in general but "I'm not technical enough" doesn't go well with all the details you have to figure out yourself when the installer doesn't do all the work.

7
sic_semper_tyrannisreply
lemmy.today

This all makes enough sense to me. I know enough to be able to figure out what you said here and to learn a few more things along the way. Thank you very much!

1
Flyswat
lemmy.dbzer0.com

I might be wrong, but isn't encryption done at disk block level, and then the filesystem sits on top of that? Meaning that changing the filesystem to BTRFS will not change the fact that you still have 2 different decryptions to set up.

2
crystalwalrus
programming.dev

Software raid 0 with btrfs will make the two drives one but I have no idea how that works if you are still going to have separate encryption keys and params for the second physical drive. If they have the same encryption it should be possible to have the device mapper write to the software raid.

3
Ooopsreply
feddit.org

If they have the same password you can just unlog them at boot with one password. They SystemD hook for unlocking LUKS drives automatically tries the first provided password on all encrypted drives it's supposed to unlock. Only if that fails it will ask for additional passwords.

6
Ooopsreply
feddit.org

When using the systemd hooks for your initramfs (and using rd.luks.name=<UUID>=<name> instead of cryptdevice=UUID=<UUID>:<name> in the kernel parameters) it will try to decrypt all listed drives with the first password typed in, and only ask for additional passwords if that fails. Unlike the "traditional" busybox hooks that will ask for a password for each device. Doesn't matter what you actually do with the drives themselves.

So yes, you can for example have partitions/devices /dev/sda1, /dev/sda2, /dev/sdb1 all encrypted with the same password, format sda1 as your classic swap partition, sda2 as the first half of your btrfs raid0 root device and sdb1 as the second half (let's give them fitting names when decrypting, so /dev/mapper/cryptswap, /dev/mapper/cryptroot-a and /dev/mapper/cryptroot-b), with rd.luks.name=<UUID>=cryptswap rd.luks.name=<UUID>=cryptroot-a rd.luks.name=<UUID>=cryptroot-b in your kernel parameters.

And at boot you will be asked for the password only once, which will unlock all three encrypted partitions. (Unless you mistype. Then it will fall back to the default behavior of asking for 3 passwords, one for each.)

(PS: You can also just unlock other encrypted devices via /etc/crypttab later in the boot process. That's the much easier option and should be prefered unless you really need them early... as in they are your (or part of your) root device, swap etc.)

The actual real question if you don't want to figure out everything manually is which options the installer supports.

2
sic_semper_tyrannisreply
lemmy.today

Thank you very much! I messed with this stuff a little in the past but have since learned more about Linux and the info you give here will really help. I'll definitely check the installer first hoping it'll be easier to setup

1

You reached the end

BTRFS Question | Spyke