My /etc/conf.d/dmcrypt

dmcrypt (text/plain), 3.17 KB, created by Jack Lloyd on 2009-07-23 00:46:51 UTC

# /etc/conf.d/cryptfs

#--------------------
# Instructions
#--------------------

# Note regarding the syntax of this file.  This file is *almost* bash,
# but each line is evaluated separately.  Separate swaps/targets can be
# specified.  The init-script which reads this file assumes that a
# swap= or target= line starts a new section, similar to lilo or grub
# configuration.

# Note when using gpg keys and /usr on a separate partition, you will
# have to copy /usr/bin/gpg to /bin/gpg so that it will work properly
# and ensure that gpg has been compiled statically.
# See http://bugs.gentoo.org/90482 for more information.

# Note that the init-script which reads this file detects whether your
# partition is LUKS or not. No mkfs is run unless you specify a makefs
# option.

# Global options:
#----------------

# Max number of checks to perform (1 per second)
#dmcrypt_max_timeout=120

# Arguments:
#-----------
# target=<name>                      == Mapping name for partition.
# swap=<name>                        == Mapping name for swap partition.
# source='<dev>'                     == Real device for partition.
# key='</path/to/keyfile>[:<mode>]'  == Fullpath from / or from inside removable media.
# remdev='<dev>'                     == Device that will be assigned to removable media.
# gpg_options='<opts>'               == Default are --quiet --decrypt
# options='<opts>'                   == cryptsetup, for LUKS you can only use --readonly
# loop_file='<file>'                 == Loopback file.
# pre_mount='cmds'                   == commands to execute before mounting partition.
# post_mount='cmds'                  == commands to execute after mounting partition.
#-----------
# Supported Modes
# gpg					== decrypt and pipe key into cryptsetup.
#						Note: new-line character must not be part of key.
#						Command to erase \n char: 'cat key | tr -d '\n' > cleanKey'

#--------------------
# dm-crypt examples
#--------------------

## swap
# Swap partitions. These should come first so that no keys make their
# way into unencrypted swap.
# If no options are given, they will default to: -c aes -h sha1 -d /dev/urandom
# If no makefs is given then mkswap will be assumed
swap=crypt-swap
source='/dev/disk/by-id/ata-ST3320620AS_5QF0H22G-part5'

## /home with passphrase
#target=crypt-home
#source='/dev/hda5'

## /home with regular keyfile
#target=crypt-home
#source='/dev/hda5'
#key='/full/path/to/homekey'

## /home with gpg protected key
#target=crypt-home
#source='/dev/hda5'
#key='/full/path/to/homekey:gpg'

## /home with regular keyfile on removable media(such as usb-stick)
#target=crypt-home
#source='/dev/hda5'
#key='/full/path/to/homekey'
#remdev='/dev/sda1'

##/home with gpg protected key on removable media(such as usb-stick)
#target=crypt-home
#source='/dev/hda5'
#key='/full/path/to/homekey:gpg'
#remdev='/dev/sda1'

##/tmp with random key
target=tmp
source='/dev/disk/by-id/ata-ST3320620AS_5QF0H22G-part6'
key='/dev/urandom'
options='-c aes-cbc-essiv:sha256'
pre_mount='/sbin/mkfs.ext2 -L /tmp ${dev}'
post_mount='/bin/setup_crypt_tmp ${mount_point}'
#pre_mount='/sbin/mkreiserfs -f -f ${dev}'

## Loopback file example
#mount='crypt-loop-home'
#source='/dev/loop0'
#loop_file='/mnt/crypt/home'