Skip to content

Latest commit

 

History

History
147 lines (122 loc) · 7.99 KB

cl9zcnams00vpognvf3rwavpj.md

File metadata and controls

147 lines (122 loc) · 7.99 KB
Raw

How to reinstall Linux on encrypted LVM

Please note that following approach works only when Linux was installed previously with a separate /home partition

This guide assumes you know how to install the Linux already. If not, please refer to previous article.

I'm using the Kali installer but steps should be same regardless the Linux flavour

Background

Story starts when I tried to get my CUDA working with a hashcat. I have installed video card drivers and tools with apt get install nvidia-driver nvidia-cuda-tools which leads to some serious issues that prevent me from logging into my installation.

I haven't found the complete guide on how to reinstall the system, leaving the /home (or simply any other) partition intact. So, whoever may want to do the same, here is what I did.

Unlock the LVM

%%[join-cta]

  1. Boot the system with Live CD Kali installation. ![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1667132249519/tv3tmRn1-.png align="left")

Verify the checksum of downloaded file with the one presented on the download page

Can't confirm if you have to choose the same values as it was on original installation, but it shouldn't matter. Let me know in the comments if that causes some issues on you

  • On Detecting disks step, installer should detect the encrypted volume and ask you for the passphrase. Enter it.

Partitioning

  1. When asked to choose root do not use any, instead click Go Back to display the installation steps. ![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1667137705554/45UrUJeBV.png align="left")

You can keep the existing data, because the encrypted volume itself does not change, only the LVM it contains.

This is how the partitioning schema looks like before changes are committed. ![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1667140797778/CCTpIjQY_.png align="left") ![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1667140889231/DRLuRhGoe.png align="left") Now continue with the installation.

Update crypttable

%%[support-cta]

After the booting on fresh system, Grub won't recognize/discover the encrypted volume, and it fails booting. It can show that device is not available or simply show initramfs prompt. Reason is that installer is not updating the /etc/crypttab file - probably because during the partitioning step, we actually didn't configure the encrypted partition; it was unlocked already before we entered the partitioning screen. To fix that, perform the following steps. Original author of this is Halacs from superuser.com.

  1. Boot the Live CD again, but this time actually start the Live System.

At the time of writing default credentials are kali/kali.

$ cryptsetup luksOpen /dev/sda6 gabor2-crypt

If you care of naming your encrypted volume (it will be visible on passphrase prompt each boot) change the gabor2-crypt to your liking and use that name consistently during further steps.

mount /dev/mapper/kali--vg-root /mnt
mount /dev/mapper/kali--vg-home /mnt/home
mount /dev/mapper/kali--vg-var /mnt/var
mount /dev/mapper/kali--vg-tmp /mnt/tmp
mount /dev/sda5 /mnt/boot
mount --bind /dev /mnt/dev
mount --bind /run /mnt/run
mount --bind /proc /mnt/proc
mount --bind /sys /mnt/sys
  • Switch the root to /mnt.
chroot /mnt

From now on, until leaving the chrooted scope, all commands are performed on the newly installed system

  • Get the UUID of the encrypted volume to write to crypttab.
blkid /dev/sda6

![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1667165395929/xdRbZq72h.png align="left")

  • Place these in the crypttab.
$ nano /etc/crypttab
gabor2-crypt UUID="f8da3b2d-c0d4-4d02-b45d-9917adf31931" none luks

Please note that this is not copy-paste from previous step.

  • Update initramfs and grub.
update-initramfs -u
update-grub

Watch out for warning messages, when device label in /etc/crypttab does not match current label of decoded LUKS. If that happen, please ensure the name in /etc/crypttab and name of encrypted volume are the same. ![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1667167582123/cJj2EI5Tb.png align="left")

  • Now exit chroot scope, unmount all devices and close LUKS.
exit
umount -R /mnt
vgchange -a n
cryptsetup luksClose gabor2-crypt
  • Restart.

Now your system should show passphrase prompt and boot to login screen. Unfortunately, you can't login to your user because it does not exist yet on the new system.

If you are using the system that doesn't block root account password login, you can skip the next section.

Boot into root shell

  1. Boot the system. Stop on GRUB loader. Highlight the "Kali" entry. ![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1667168628132/pZmOf6Umb.png align="left")

Add user back

  1. Add user, add to sudoers.
useradd --no-create-home -d /home/asentinn -s /bin/bash asentinn 
chown -R asentinn:asentinn /home/asentinn
sudo -l -U asentinn
passwd asentinn
  1. Reboot. Now you can login as sudo user with your old home partition. ![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1667339468994/QIDJ4giUW.png align="left")

Additional readings

%%[follow-cta]