Debian BTRFS Luks Encryption Installation Method Jan. 2023

Getting Started

• Boot the ISO to the command line.
• Do a ‘sudo apt update’ to be sure you’re in good shape for software.
• Go into superuser.
  sudo su -
• Show your disks.
  lsblk
• For the purpose of this tutorial, we will assume that we’re on /dev/sda.
• In the terminal, do:
  fdisk /dev/sda.
• Create four partitions:
• A 512mb EFI System Partition. Make sure you change the type of this partition to EFI with the type option.
• A swap partition of appropriate size. I prefer 10G.
• Do not change the type yet. Cryptsetup does this later.
• A 1024mb Linux partition. This will be your /boot.
• Finish the rest of the space with a Linux partition.
• Write the changes.
• Now make the EFI partition. It has to be VFAT, as EFI can only read VFAT filesystems.
  mkfs.vat /dev/sda1
• Make the boot partition.
  mkfs.ext4 /dev/sda3
• Initialize the LUKS encryption on the swap partition.
  cryptsetup luksFormat --type luks2 /dev/sda2
• Accept the question, since the partition is blank. “YES”
• Create your passcode. This is fairly permanent and critical, so use something you’d remember.
• Initialize the LUKS encryption on the main partition.
  cryptsetup luksFormat --type luks2 /dev/sda4
• Accept the question, since the partition is blank. “YES”
• Create your passcode. This is fairly permanent and critical, so use something you’d remember.
• We need to open those newly encrypted partitions. We will also be giving each a name for the devicemapper. In this case, we’ll be using ‘cryptswap’ and ‘cryptroot’ as the name.
  cryptsetup luksOpen /dev/sda2 cryptswap
cryptsetup luksOpen /dev/sda4 cryptroot
• Now we can freely format the partitions. In this example, we’ll use swap and btrfs. This has to be marked to the mapped location, since this drive is encrypted and different.
  mkswap /dev/mapper/cryptswap
mkfs.btrfs /dev/mapper/cryptroot
mount /dev/mapper/cryptroot /mnt
• You’ll be using that /dev/mapper/X location for each partition permanently.

Btrfs Setup

• Now that the drives are partitioned, we need to configure special “Subvolumes” for Btrfs.
• Create the subvolume system.
  btrfs su cr /mnt/@
• The @ symbol indicates the root subvolume.
  btrfs su cr /mnt/@home
• Creates the home subvolume.
  btrfs su cr /mnt/@snapshots
• Creates the snapshots subvolume.
• Unmount the traditional filesystem.
  umount /mnt
• Mount the subvolumes so you can install to them. (Note: The -o options speed up the process and improve performance.)
  mount -t btrfs -o noatime,compress=lzo,space_cache=v2,subvol=@ /dev/mapper/cryptroot /mnt
• Create several directories for mounting those snapshots.
  mkdir -p /mnt/{home,.snapshots,boot/efi}
mount -t btrfs -o noatime,compress=lzo,space_cache=v2,subvol=@home /dev/mapper/cryptroot /mnt/home
mount -t btrfs -o noatime,compress=lzo,space_cache=v2,subvol=@snapshots /dev/mapper/cryptroot /mnt/.snapshots

Installing the operating system

• If you haven’t already, make the boot folder and mount it. Note it retains its conventional name. That’s because you didn’t encrypt it, as was required to use it for EFI.
  mkdir -p /mnt/boot
mount /dev/sda3 /mnt/boot/
mkdir /mnt/boot/efi
mount /dev/sda1 /mnt/boot/efi
swapon /dev/mapper/cryptswap
• Install debootstrap
  apt install debootstrap
• Run debootstrap (here, we’re assuming we’re installing Debian 11.5, Bullseye).
  debootstrap bullseye /mnt
• Copy the apt sources list from the wiki and paste them into the file.
  vi /mnt/etc/apt/sources.list
• Time to chroot. First, mount the linkages.
  for dir in sys dev proc; do mount --rbind /$dir /mnt/$dir && mount --make-rslave /mnt/$dir ; done
cp /etc/resolv.conf /mnt/etc/
• Now, chroot.
  chroot /mnt /bin/bash
• Update apt.
  apt update
• Set the root password.
  passwd
• Install btrfs and encryption support.
  apt install locales btrfs-progs cryptsetup
• Reconfigure the region.
  dpkg-reconfigure locales
• Pick our region (en_US.UTF-8 UTF-8)
• Install a kernel and networking plus amd-microcode or intel-microcode.
  apt install linux-image-amd64 sudo network-manager intel-microcode
• Set up fstab.
  cp /proc/mounts /etc/fstab
• Remove lines in /etc/fstab t hat refer to proc, sys, devtmpfs and pts.
• Replace references to /dev/sdXX, /dev/nvmeXnYpZ, /dev/mapper/XXXX etc. with their respective UUID, which can be found by running blkid. [NOTE: PARTUUID is nice, but doesn’t work with Btrfs.]
• Example: UUID=ffe9419a-500c-9c49-816f-41aebf92b55e
• Change the tmpfs line so it points to /tmp, not wherever it is generated.
• Allow Grub to unlock the filesystem.
  apt install grub-efi-amd64
vi /etc/default/grub
• Add above the GRUB_CMDLINE_LINUX_DEFAULT line:
  GRUB_ENABLE_CRYPTODISK=yes
• Next, we need the kernel to find the device.
  blkid -o value -s UUID /dev/sda4
• A UUID will be printed.
• Edit /etc/default/grub again and add the following to the GRUB_CMDLINE_LINUX_DEFAULT=
  GRUB_CMDLINE_LINUX_DEFAULT=”rd.luks.uuid=<THE UUID OF THE HD>,rd.luks.uuid=<THE UUID OF THE SWAP>,resume=/dev/mapper/cryptswap”
• And now to avoid having to enter the password twice on boot, a key will be configured to automatically unlock the encrypted volume on boot. First, generate a random key for each encrypted partition.
  dd bs=1 count=512 if=/dev/urandom of=/boot/volume-root.key
dd bs=1 count=512 if=/dev/urandom of=/boot/volume-swap.key
• Next, add the key to the encrypted volume.
  cryptsetup luksAddKey /dev/sda4 /boot/volume-root.key
cryptsetup luksAddKey /dev/sda2 /boot/volume-swap.key
chmod 000 /boot/volume-root.key
chmod 000 /boot/volume-swap.key
chmod -R g-rwx,o-rwx /boot
• Update crypttab. Use the UUID for /dev/sda4 if you can.
  vi /etc/crypttab
cryptroot /dev/sda4 /boot/volume-root.key luks,discard,key-slot=1
cryptswap /dev/sda2 /boot/volume-swap.key luks,discard,key-slot=2
• Configure initramfs so the hooks are pulled
  vi /etc/cryptsetup-initramfs/conf-hook
• Add to the end of the file:
  KEYFILE_PATTERN=”/boot/*.key”
echo UMASK=0077 >> /etc/initramfs-tools/initramfs.conf
update-initramfs -u
• Check to make sure it has the appropriate info
  stat -Lc “%A %n” /initrd.img
• This shows the permissions, which should be pretty limited.
  lsinitramfs /initrd.img | grep “^cryptroot/keyfiles/”
• Set the hostname. Here, we’ll use ‘debcrypt’.
  echo debcrypt > /etc/hostname
vi /etc/hosts
• Change all references to localhost to the same name as you set in hostname.
• Install grub.
  grub-install /dev/sda
update-grub
• Enable the necessary system controls.
  systemctl enable NetworkManager dbus
• Exit.
  exit
umount -a reboot