On Sunday 24 July 2022 at 11:58:01, Olaf Meeuwissen wrote:

> Hi Antony,
>
> Thanks for the feedback. I've been researching a bit myself in the mean
> time as well but still value additional input from the list.

I completely agree - asking people with experience, and with whom you can have
a bit of a dialogue, is always a bit more encouranging than finding informatin
of random ageas from random people on the Internet :)

> > The only part of this you need to remember to do manually is grub-install
> > /dev/thing2 if there's ever a new version of grub itself.
>
> I vaguely recall reading that you could enter a list of space separated
> devices to install GRUB to in the installer.

True, you can do this in the installer, but if grub gets updated later on, my
experience is that it only updates the boot loader on the primary disk.

> > Er, what's ESP?
>
> It's not Extra-Sensory Perception in this context :-P
> It's the EFI System Partition and is what gets mounted on /boot/efi/.

Ah, right, I seriously doubt you can put that on Raid, because it's not being
read by Linux - it's being read by the UEFI/Bios ystsem itself in the machine,
in order to find the boot loader (as far as I understand this process).

However, I also think it's something that you would simply install on both
disksk and then leave it thre - either disk can then get the machien going.

> > >    - if not, how do I keep the copies in sync?

As far as *that* one goes, I don't think you need to - I don't think this ever
gets updated.

> > > - do I need a separate partition for /boot?
> >
> > You do not need one, but you can have one.
>
> Then I'd rather do without. I asked because on a few of my systems it
> *is* a separate partition.

Yes, it used to be necessary before Linux could find /boot in LVM on Raid, for
example. You could put that separate /boot on Raid, but the LVM bit in the
middle confused Grub before 2.00, as I recall.

> Thinking about that, I believe these were installed to use a "fully"
> encrypted system, i.e. the partition mounted on / encrypted as well. In
> that case it makes sense because most BIOSs probably do not handle that.

It's not the Bios that's doing anything at this stage - it's Grub.

Bios looks at the boot sector on the disk, discovers Grub, and hands control
over to it. Grub then needs to know where / how to find /boot, because that
contains /boot/grub/grub.cfg, which has all the details of everything want to
be able to start up.

But, the Grub loader in the boot sector is small and simple, and also needs to
be able to find an encryption key if it's going to be able to decipher /boot in
an encrypted file system.

> If I only want/need an encrypted /home then I should be okay with /boot
> on the partition that's mounted on /.

Precisely.

> > >  - does randomizing the partition for /home make sense if on LVM and may
> > >    get resized sometime in the future?

> >
> > What do you mean by randomizing?
>
> Writing random data to the partition before using it. This is supposed
> to make it harder to decrypt for prying eyes.

Ah, right.

> After I sent my mail, I thought I could randomize the whole disk (or
> that part that's used as an LVM PV) but that might take a while ...

Well, let's just think about that - if you write random data to a device and
then use it as a PV for a VG, anyone who can get into the LVM system can see
the VG and whatever LVs it contains, and therefore just ignores the random
data. Unless you can put LVM2 onto an encrypted block device (?), then I
don't think this helps you. All you can do is create a VG (that's visible to
anyone who can get this far into your machine) and then create an encrypted FS
on it.

However, as you may have worked out, this is beyond my eperience of setting
things up - I do LVM on RAID all the time (both RAID 1 and RAID5), but I've
never bothered to set up an encrypted file system.

I'm sure others can offer expertise here :)

> Thanks again and looking forward to other opinions and follow-up!

Indeed - I hope other people chip in with different opinions and expertise of
doing things outside my habits.


Antony.

--
When you find yourself arguing with an idiot,
you should first of all make sure
that the other person isn't doing the same thing.

                                                   Please reply to the list;
                                                         please *don't* CC me.