Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I installed OpenSuse one year ago on my notebook. I created all partitions except /boot inside an LVM partition. I enabled encryption for it during setup. The system asked me a password on each boot later. Everything seemed fine...

But one day I wanted to cancel the boot process and did it with SysRq REISUB. During entering this combination, the system suddenly continued to boot without any password being entered. I had no /home and no swap, but / was mounted! I checked multiple times, it was inside an "encrypted" physical LVM volume.

Later I found out that OpenSuse can't encrypt / at all. There is an option to enable encryption for each logical volume, and indeed it fails for /.

Later I tried Fedora. The options during partitioning were misleading by same means. I could enable "encryption" of a physical volume and each logical subvolume. With the exception that Fedora actually allowed to encrypt /.

Question: What's the point of setting up "encryption" for a physical LVM volume, when it doesn't imply (real) encryption of its logical subvolumes? Did I get something wrong in this whole concept?

share|improve this question
    
The why you have asked your question is argumentative. We don't know why Suse designed their system they way they did. Why don't you ask this on a Suse forum? –  Zoredache Jun 23 '10 at 16:41
    
As I said, it's not only Suse but also Fedora. I thought it might be some "secret" concept behind this. –  java.is.for.desktop Jun 23 '10 at 20:55
    
+1 after the edit for removing the argumentative phrase of the question –  Mark Henderson Jun 28 '10 at 5:39

1 Answer 1

up vote 0 down vote accepted

There are two ways to encrypt an LVM volume:

  1. You create an encrypted partition, create the PV inside it and then the whole PV is encrypted
  2. You create a normal LVM, create LV inside it and then create an encrypted partition inside the LV.

If you use method 1 your root partition is encrypted. You might have gotten an emergency shell.

If you use method 2 you might want to leave the root unencrypted to simplify recovery if something goes wrong. Normally the root partition should hold system file, not private files.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.