encryption with two disk?

[msvnix]

Hi everybody, I have a Thinkpad T420 with 2 disk (120GB SSD and 500GB HDD) I would like to encrypt both disk and install it's that possible? I know how two do it with one disk but not two. Thanks in advance

[jggimi]

Hello, and welcome!

I know how two do it with one disk but not two.

The only difference between using one and two physical drives is that you need to run MAKEDEV to create a special file for the second drive, and then you will run bioctl(8) twice instead of once.

MAKEDEV is needed because the installer's tiny RAMDISK environment does not have room for a complete list of /dev special files. So, if your two drives are sd0 and sd1, before beginning the creation of partitions on both and running bioctl twice, you just need to start with:

# cd /dev
# sh MAKEDEV sd1

Please let us know if you have any specific questions.

[msvnix]

thanks I will try when I finish setting the other laptop

[msvnix]

Originally Posted by jggimi

Hello, and welcome!The only difference between using one and two physical drives is that you need to run MAKEDEV to create a special file for the second drive, and then you will run bioctl(8) twice instead of once.

MAKEDEV is needed because the installer's tiny RAMDISK environment does not have room for a complete list of /dev special files. So, if your two drives are sd0 and sd1, before beginning the creation of partitions on both and running bioctl twice, you just need to start with:

# cd /dev
# sh MAKEDEV sd1

Please let us know if you have any specific questions.

I get

Can't open DUID.a: No such file or directory
CAN'T CHECK FILE SYSTEM
DUID.a: UNEXPECTED INCONSISTENCY; TUN fsck_ffs MANUALLY

THE FOLLOEING FILE SYSTEM HAD AN UNEXPECTED INCONSISYENCY:
    ffs: DUID.a (/home)

I think its not decrypting the second hard drive but don't know why

[jggimi]

I've been able to recreate this on a test system. The cause is clear: the bootloader decrypts only the boot drive.

My test system had /home on the second drive. And I had thought a solution would be to set the fstab(5) /home entry to include the noauto option, then issue a bioctl(8) and mount(8) from an rc.local(5) script.

However, rc(8) still attempts and fails to mount the /home mount point. The reason is as yet unclear to me, as noauto works fine when issuing # mount -a or # mount -A manually.

Removing the fstab(5) entry permits rc(8) to complete processing and pass control to rc.local(8), where bioctl(8) and mount(8) commands can be executed. You will want to test the bioctl(8) results, so that in the event of an incorrect passphrase, bioctl can be retried.

EDIT:

Here is an example rc.local(5) script that permits three attempts to enter the correct passphrase before mounting the partition.

for tries in 1 2 3; do
   bioctl -c C -l /dev/sd1a softraid0
   if [ $? -eq 0 ] ; then
      break
   fi
done
mount 5435133273012c81.a /home

[TronDD]

That works for me with also a 0 in the last numeric parameter in fstab which excludes the partition from automated fsck.

a6d775ee96227348.a /mnt/backup ffs rw,nodev,nosuid,noauto,softdep,noatime 0 0

I also disable dump(8) backups since it's actually my dump(8) destination drive.

Since fsck will not be run automatically, I also run it whenever I mount in rc.local at boot up

bioctl -c C -l /dev/sd1a softraid0 || bioctl -c C -l /dev/sd1a softraid0 || bioctl -c C -l /dev/sd1a softraid0 && fsck a6d775ee96227348.a && mount /mnt/backup

EDIT: I meant the last fstab option, the second number.

[jggimi]

Originally Posted by TronDD

That works for me with also a 0 in the last numeric parameter in fstab which excludes the partition from automated fsck.

Ah, thank you for the explanation - it's an fsck(8) rather than a mount(8) by rc(8), that explains the failure.

Since fsck will not be run automatically, I also run it whenever I mount in rc.local at boot up

Good point!

[msvnix]

So there is no way to do it without entering the password another time when mounting /home right?

[jggimi]

The bioctl(8) tool can also use a keydisk and/or a passphrase file.

[jggimi]

Correction, keydisk OR passfile. Not both.

[msvnix]

Originally Posted by jggimi

Correction, keydisk OR passfile. Not both.

Originally Posted by TronDD

That works for me with also a 0 in the last numeric parameter in fstab which excludes the partition from automated fsck.

a6d775ee96227348.a /mnt/backup ffs rw,nodev,nosuid,noauto,softdep,noatime 0 0

I also disable dump(8) backups since it's actually my dump(8) destination drive.

Since fsck will not be run automatically, I also run it whenever I mount in rc.local at boot up

bioctl -c C -l /dev/sd1a softraid0 || bioctl -c C -l /dev/sd1a softraid0 || bioctl -c C -l /dev/sd1a softraid0 && fsck a6d775ee96227348.a && mount /mnt/backup

EDIT: I meant the last fstab option, the second number.

Thanks today I have reinstalled and it's working perfectly with with a file pass unlock