Skip to content

Commit eebdbcf

Browse files
committed
Update documentation
1 parent d17a942 commit eebdbcf

File tree

1 file changed

+14
-6
lines changed

1 file changed

+14
-6
lines changed

README.md

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,11 @@ In the default install, these items are, respectively, located at:
100100
2. /etc/petera/encrypt.pem
101101
3. /etc/petera/decrypt.d
102102

103+
On important note is necessary. The encryption certificate advertised to the
104+
client MUST have a subject with a commonName that resolves to the decryption
105+
server. This is the hostname that the client will use during decryption. This
106+
hostname may be an IP address.
107+
103108
###### Enablement
104109

105110
To enable the server, just run the following as root:
@@ -117,20 +122,23 @@ Second, you must have a client with LUKS disk encryption already enabled.
117122
###### Setup
118123
Both of the following commands are run as root.
119124

120-
The first command we will run simply adds a new random key to the pre-existing
121-
LUKS encrypted disk and then encrypts it using Petera in a known location:
125+
First, we will configure the initramfs for networking. If you are using IPv4
126+
DHCP, no configuration is needed. For other setups, please consult the dracut
127+
documentation.
122128

123-
# petera cryptsetup -d /dev/<disk> -a <anchor> <target>
129+
Second, we will add a new random key to the pre-existing LUKS encrypted disk
130+
and then encrypt it using Petera in a known location. This command works
131+
exactly like the encrypt command with the exception that a LUKS encrypted disk
132+
must be specified:
124133

125-
Next, we will configure the initramfs for networking. For more information,
126-
please consult the dracut documentation.
134+
# petera cryptsetup -d /dev/<disk> -a <anchor> <target>
127135

128136
Finally, we need to rebuild the system's initramfs:
129137

130138
# dracut -f
131139

132140
That's it! Once you reboot, the disk should unlock automatically so long as
133-
one of the specified encryption target servers is available.
141+
one of the specified encryption targets is available.
134142

135143
##### Future Improvements
136144

0 commit comments

Comments
 (0)