3. Setting up the boot device

3.1. Creating the ramdisk

To begin with, chroot inside the encrypted partition and create the boot device mount point:

chroot /mnt/efs mkdir /loader

Then, create the initial ramdisk (initrd), which will be needed afterwards:

cd dd if=/dev/zero of=initrd bs=1k count=4096 mke2fs -F initrd mkdir ramdisk mount -o loop initrd ramdisk

Create the filesystem hierarchy and copy the required files in it:

mkdir ramdisk/{bin,dev,lib,mnt,sbin} cp /bin/{bash,mount,umount} ramdisk/bin/ ln -s bash ramdisk/bin/sh mknod -m 600 ramdisk/dev/console c 5 1 mknod -m 600 ramdisk/dev/hda2 b 3 2 mknod -m 600 ramdisk/dev/loop0 b 7 0 cp /lib/{ld-linux.so.2,libc.so.6,libdl.so.2} ramdisk/lib/ cp /lib/{libncurses.so.5,libtermcap.so.2} ramdisk/lib/ cp /sbin/{losetup,pivot_root} ramdisk/sbin/

It's ok if you see a message like "/lib/libncurses.so.5: No such file or directory", or "/lib/libtermcap.so.2: No such file or directory"; bash only requires one of these two libraries. You can check which one is actually needed with:

ldd /bin/bash

Create the init script (don't forget to replace "xxxxxxxxxx" with your chosen seed):

cat > ramdisk/sbin/init << "EOF" #!/bin/sh /sbin/losetup -e aes256 -S xxxxxxxxxx /dev/loop0 /dev/hda2 /bin/mount -r -n -t ext2 /dev/loop0 /mnt while [ $? -ne 0 ] do /sbin/losetup -d /dev/loop0 /sbin/losetup -e aes256 -S xxxxxxxxxx /dev/loop0 /dev/hda2 /bin/mount -r -n -t ext2 /dev/loop0 /mnt done cd /mnt /sbin/pivot_root . loader exec /usr/sbin/chroot . /sbin/init EOF chmod 755 ramdisk/sbin/init

Umount the loopback device and compress the initrd:

umount -d ramdisk rmdir ramdisk gzip initrd mv initrd.gz /boot/

3.2. Booting with a CD-ROM

I strongly advise you to start your system with a read-only media, such as a bootable CD-ROM.

Download and unpack syslinux:

wget ftp://ftp.kernel.org/pub/linux/utils/boot/syslinux/syslinux-2.07.tar.gz tar -xvzf syslinux-2.07.tar.gz

Configure isolinux:

mkdir bootcd cp /boot/vmlinuz-2.4.23 bootcd/vmlinuz cp /boot/initrd.gz syslinux-2.07/isolinux.bin bootcd/ echo "DEFAULT vmlinuz initrd=initrd.gz ro root=/dev/ram0 vga=4" \ > bootcd/isolinux.cfg

Create and burn the bootable cd-rom iso image:

mkisofs -o bootcd.iso -b isolinux.bin -c boot.cat \ -no-emul-boot -boot-load-size 4 -boot-info-table \ -J -hide-rr-moved -R bootcd/ cdrecord -dev 0,0,0 -speed 4 -v bootcd.iso rm -rf bootcd{,.iso}

3.3. Booting from a partition

The boot partition is an alternate boot device: you might need it if your bootable CD gets lost. Remember that hda1 is a writable media and is thus insecure; use it only in case of emergency!

Create and mount the ext2 filesystem:

dd if=/dev/zero of=/dev/hda1 bs=8192 mke2fs /dev/hda1 mount /dev/hda1 /loader

Copy the kernel and the initial ramdisk:

cp /boot/vmlinuz-2.4.23 /loader/vmlinuz cp /boot/initrd.gz /loader/

If you use grub:

mkdir /loader/boot cp -av /boot/grub /loader/boot/ cat > /loader/boot/grub/menu.lst << EOF default 0 timeout 10 color green/black light-green/black title Linux root (hd0,0) kernel /vmlinuz ro root=/dev/ram0 vga=4 initrd /initrd.gz EOF grub-install --root-directory=/loader /dev/hda umount /loader

If you use lilo:

mkdir /loader/{boot,dev,etc} cp /boot/boot.b /loader/boot/ mknod -m 600 /loader/dev/hda b 3 0 mknod -m 600 /loader/dev/hda1 b 3 1 mknod -m 600 /loader/dev/ram0 b 1 0 cat > /loader/etc/lilo.conf << EOF lba32 boot=/dev/hda prompt timeout=100 image=/vmlinuz label=Linux initrd=/initrd.gz read-only root=/dev/ram0 vga=4 EOF lilo -r /loader umount /loader