From owner-freebsd-current@FreeBSD.ORG Fri Jul 29 14:10:02 2005 Return-Path: X-Original-To: freebsd-current@freebsd.org Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E7CF716A41F for ; Fri, 29 Jul 2005 14:10:02 +0000 (GMT) (envelope-from nike_d@cytexbg.com) Received: from office.suresupport.com (office.suresupport.com [213.145.98.15]) by mx1.FreeBSD.org (Postfix) with SMTP id C8EF643D49 for ; Fri, 29 Jul 2005 14:10:01 +0000 (GMT) (envelope-from nike_d@cytexbg.com) Received: (qmail 2888 invoked by uid 1026); 29 Jul 2005 14:11:54 -0000 Received: from 213.145.98.14 by office.suresupport.com (envelope-from , uid 1004) with qmail-scanner-1.23 (f-prot: 4.4.2/3.14.11. Clear:RC:1(213.145.98.14):. Processed in 0.133722 secs); 29 Jul 2005 14:11:54 -0000 Received: from unknown (HELO 14.98.145.213.in-addr.arpa) (213.145.98.14) by office.suresupport.com with SMTP; 29 Jul 2005 14:11:54 -0000 From: Niki Denev To: freebsd-current@freebsd.org Date: Fri, 29 Jul 2005 17:09:58 +0300 User-Agent: KMail/1.8 References: <20050728205413.GB762@darkness.comp.waw.pl> <42EA205B.2000907@cytexbg.com> <42EA2EFE.3030800@centtech.com> In-Reply-To: <42EA2EFE.3030800@centtech.com> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200507291709.58568.nike_d@cytexbg.com> Subject: Re: GELI - disk encryption GEOM class committed. X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jul 2005 14:10:03 -0000 On Friday 29 July 2005 16:28, Eric Anderson wrote: > Niki Denev wrote: > > Pawel Jakub Dawidek wrote: > > > +> Booting from Encrypted Root: > >> > >> +> GELI - Works. How'd one load the kernel from an encrypted root > >> though? > >> > >> Kernel has to be loaded from a USB Pen-Drive or a CD-ROM. > >> You need to put /boot/ directory in there. GELI will ask for the > >> passphrase > >> before root file system is mounted. After that you can remove > >> Pen-Drive/CD-ROM. > > > > Wouldn't it work if /boot is small separate unencrypted partition? > > ( Well, there is the possibility that someone replaces your kernel > > with one with keylogger to catch your password next time you type it :)) > > I use this method for bootable RAID1+0 with GEOM's stripe and mirror, > > and it seems to work great. > > Maybe you could write up a quick howto on your setup, and post it/submit > it to the doc@ team. > > Eric I've thought about that, and will do it when time permits. Right now i have as present for sysadminday 8 production servers with failed disks ... :( --niki