Slides:
![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEif7iSm7ZqmW1025CSXymFT-7S1Ma3mkk5R0LRqsMuxj4JPXwmzvPth58PrAfouZwptadKAt8pQebrDjBqH0Al9SGq5C-Hjk4dtOOEsgX1AOQs5heYkD2MFMl2cGLk4bCqbxdIDBYAOYNuTJED9YBv8ieorDsc9yUTTs-xX0nUAzhph0MlRRbfAlyjTgQ/s320/fosdem2023-szyklos-lokit.png)
Video:
apt-get update && apt-get upgrade
sudo shutdown -r now
4. Install deps:
apt-get install busybox cryptsetup dropbear-initramfs lvm2
5. Prepare partition:
cryptsetup -v -y --cipher aes-xts-plain64 --key-size 256 luksFormat <newroot>
cryptsetup -v luksOpen <newroot> sdcard
mkfs.ext4 /dev/mapper/sdcard
cryptsetup luksClose /dev/mapper/sdcard
6. Configure partition in the system:
check blkid | grep crypto_LUKS
open /etc/crypttab and add:
sdcard <newroot> none luks,initramfs
open /etc/fstab and replace original root partition with:
/dev/mapper/sdcard / ext4 defaults 0 1
open /boot/cmdline.txt and replace existing partition config with:
root=/dev/mapper/sdcard cryptdevice=<newroot>:sdcard
also add at the end of the same file dhcp configuration:
ip=:::::eth0:dhcp
7. Configure early decryption:
echo 'DROPBEAR_OPTIONS="-RFEsjk -c /bin/cryptroot-unlock"' > /etc/dropbear-initramfs/config
echo "CRYPTSETUP=y" >> /etc/cryptsetup-initramfs/conf-hook
8. Fix issue with short timeout for decryption:
sed -i 's/^TIMEOUT=.*/TIMEOUT=100/g' /usr/share/cryptsetup/initramfs/bin/cryptroot-unlock
9. Configure early remote access over SSH:
touch /boot/ssh
echo '<your_public_ssh_key>' > /etc/dropbear-initramfs/authorized_keys
10. Copy files from original root partition to the new encrypted partition.
11. Generate initramfs:
sudo mkinitramfs -o /boot/initramfs.gz
echo "initramfs initramfs.gz" >> /boot/config.txt
12. Reboot and try to connect remotely. Configs for ssh:
Host pi
HostName <ip>
User user
PreferredAuthentications password
Host pi-enable
HostName <ip>
User root
StrictHostKeyChecking no
UserKnownHostsFile /dev/null
IdentityFile ~/.ssh/<your_public_ssh_key>