@@ -100,6 +100,11 @@ In the default install, these items are, respectively, located at:
100
100
2 . /etc/petera/encrypt.pem
101
101
3 . /etc/petera/decrypt.d
102
102
103
+ On important note is necessary. The encryption certificate advertised to the
104
+ client MUST have a subject with a commonName that resolves to the decryption
105
+ server. This is the hostname that the client will use during decryption. This
106
+ hostname may be an IP address.
107
+
103
108
###### Enablement
104
109
105
110
To enable the server, just run the following as root:
@@ -117,20 +122,23 @@ Second, you must have a client with LUKS disk encryption already enabled.
117
122
###### Setup
118
123
Both of the following commands are run as root.
119
124
120
- The first command we will run simply adds a new random key to the pre-existing
121
- LUKS encrypted disk and then encrypts it using Petera in a known location:
125
+ First, we will configure the initramfs for networking. If you are using IPv4
126
+ DHCP, no configuration is needed. For other setups, please consult the dracut
127
+ documentation.
122
128
123
- # petera cryptsetup -d /dev/<disk> -a <anchor> <target>
129
+ Second, we will add a new random key to the pre-existing LUKS encrypted disk
130
+ and then encrypt it using Petera in a known location. This command works
131
+ exactly like the encrypt command with the exception that a LUKS encrypted disk
132
+ must be specified:
124
133
125
- Next, we will configure the initramfs for networking. For more information,
126
- please consult the dracut documentation.
134
+ # petera cryptsetup -d /dev/<disk> -a <anchor> <target>
127
135
128
136
Finally, we need to rebuild the system's initramfs:
129
137
130
138
# dracut -f
131
139
132
140
That's it! Once you reboot, the disk should unlock automatically so long as
133
- one of the specified encryption target servers is available.
141
+ one of the specified encryption targets is available.
134
142
135
143
##### Future Improvements
136
144
0 commit comments