View source for LUKS encryption On LVM On Raid

This is a short guide on how to create a RAID 5 with an LVM filesystem on top and a LUKS encrypted volume on top of the LVM logical volume.

= Raid =

Create partitions on each drive with gdisk. Partition type is "Linux RAID". Partition type code is FD00.

Create the raid 5 array:

 mdadm --create /dev/md1 --level=5  --raid-devices=9 /dev/sdb1 /dev/sdd1 /dev/sde1 /dev/sdf1 /dev/sdg1 /dev/sdh1 /dev/sdi1 /dev/sdj1 /dev/sdk1

Now set read-write mode (this will cause a resync):

 mdadm --readwrite /dev/md1

Manually add lines for new raid array to /etc/madadm.con
Run the following command to get lines:

 mdadm --examine --scan 

= LVM =

Create physical lvm volume:

 pvcreate /dev/md1 # may be very very slow durin resync

Create volume group called 'sink':

 vgcreate sink /dev/md1 # slow during resync

Create logical lvm volume takin up 100% of free space with name 'sink':

 lvcreate -l 100%FREE sink -n data # slow during resync

You should now have:

 /dev/sink/data

and:

 /dev/mapper/sink-data

Now set up encryption:

 cryptsetup luksFormat /dev/sink/data

Open encrypted volume and create the filesystem:

 cryptsetup luksOpen /dev/sink/data sink-data_crypt
 mkfs.ext4 /dev/mapper/sink-data_crypt # will take a long time if resync is in progress

= Mount on boot =

Get the UUID with:

 cryptsetup luksUUID /dev/sink/data

Then add this line to /etc/crypttab:

 sink-data_crypt UUID=<the_uuid_from_previous_command> none luks

Add this line to /etc/fstab:

 /dev/mapper/sink-data_crypt /data ext4 noatime 0 2

Your encrypted partition will now mount on boot. Be aware that your system will now require the passphrase in order to boot.