This is a quick overview which attempts to synthesize DW Armstrong's tutorial on NetBSD encryption with the cgdroot page from the NetBSD wiki in a single MBR partition, divided into multiple disklabel slices to preserve MBR entries.
Some of the commenting is sparse, and copied from DW Armstrong's page in order to preserve the order, but more rationale for them can be found there. Some steps from there are skipped, out of personal preference.
There are some additional steps to resolve issues this may create with firmware or not installing through sysinst (e.g. setting up root certificate hashes).
In the examples below, we'll assume you're trying to install into the second MBR partition, which is wd0f by default.
| disklabel -i /dev/wd0 |
IMPORTANT! Confirm the offset and size of wd0c match those of the partition you intend to install to. For example, if it's the second MBR partition, make sure wd0c matches wd0f (the first MBR partition being wd0e by default).
wd0a should be a small unencrypted 4.2BSD partition at the beginning of the MBR partition (starting at the same sector as wd0f for MBR partition 2, to continue the example above).
wd0b can take up the rest of the MBR partition (wd0f in the previous paragraphs). Use the formula: wd0g_offset - (wd0a_offset + wd0a_size) - 1 (Again, assuming wd0f, with wd0g being the partition immediately following wd0f.)
Format the new /boot slice. Here, we use FFSv2 (2) and not FFSv2 with extended attributes (2ea) so that grub can read it, but this isn't technically necessary, since we'll be using the NetBSD bootloader. Nevertheless:
| newfs -O 2 /dev/wd0a |
Mount it temporarily to /targetroot so that the cgd parameters file can be written to it.
| mount /dev/wd0a /targetroot |
This is the wd0b slice created when creating the outer partition disklabel.
This will be further subdivided into slices inside of the cgd disklabel, so one is enough.
| # create the parameters file | |
| cgdconfig -g -V disklabel -o /targetroot/wd0b aes-xts 512 | |
| # perform the encryption | |
| cgdconfig -V re-enter cgd0 /dev/wd0b /targetroot/wd0b |
| disklabel -i /dev/cgd0 |
IMPORTANT! Make sure to W changes, even if you don't make any!
Make sure your / is cgd0a. The rest can be up to you.
These include the second-stage bootloader and cgd config.
The ramdisk-cgdroot.fs file is an image which contains scripts which look for and attempt to automatically decrypt wd0a and boot from the resulting root on cgd0a. Please see the cgdroot page from the NetBSD wiki for more information.
These scripts copy cgd.conf and the parameters file to /etc/cgd on the ramdisk during runtime, negating the need to modify the ramdisk in many cases. This also means the cgd service and configuration doesn't neet to exist in the running (encrypted) system's /etc/cgd directory.
| cp /amd64/installation/ramdisk/ramdisk-cgdroot.fs /targetroot/ | |
| cp /usr/mdec/boot /targetroot/ | |
| echo 'cgd0 /dev/wd0b' > /targetroot/cgd.conf | |
| echo 'menu=Boot normally:rndseed /etc/entropy-file;fs /ramdisk-cgdroot.fs;boot /netbsd' > /targetroot/boot.cfg |
We're going to unmount it, now that we're done with the wd0b parameters file. We will make changes to it later, but only once it's been remounted inside of the /targetroot.
| umount /targetroot |
This can be done whenever, but might as well do it now.
| installboot -v /dev/rwd0a /usr/mdec/bootxx_ffsv2 |
| newfs -O 2ea /dev/cgd0a | |
| mount /dev/cgd0a /targetroot |
Now, remount the unencrypted /boot inside of /targetroot:
| mkdir /targetroot/boot | |
| mount /dev/wd0a /targetroot/boot |
You can also mount your /var, /home, etc. here, if you created those in the encrypted disklabel.
This is as obvious as it seems. The system can function with as little as just base and kern-GENERIC, and you may wish to omit the games and x* sets for e.g. servers.
| cd /amd64/binary/sets | |
| for s in base comp etc games gpufw kern-GENERIC man misc modules rescue tests text xbase xcomp xetc xfont xserver; do tar -xvpf $s.tar.xz -C /targetroot; done |
The kernel is still needed during the unencrypted phase of booting. Be sure to update the copy on the unencrypted partition if you update or compile a custom kernel in the future!
| cp /targetroot/netbsd /targetroot/boot/ |
Now it's time to chroot into the target root:
| chroot /targetroot |
| passwd |
| cd /dev | |
| sh MAKEDEV all |
This bug still seems to exist, and null is not properly created:
| rm /dev/null | |
| mknod -m 0666 -u root -g wheel /dev/null c 2 2 |
| ln -sf /usr/share/zoneinfo/America/New_York /etc/localtime |
| cat > /etc/ifconfig.wm0 << EOF | |
| up | |
| media autoselect | |
| EOF |
| cat > /etc/fstab << EOF | |
| /dev/cgd0a / ffs rw |
Again, feel free to add your extra filesystems created during the encrypted disklabel creation, for example:
| /dev/cgd0e /var ffs rw |
The cgd service is not needed, as cgd stuff is handled by the cgdroot ramdisk.
| echo >> /etc/rc.conf << EOF | |
| dhcpcd=YES | |
| dhcpcd_flags="-qM wm0" | |
| hostname=testhost.example.com | |
| sshd=YES | |
| ntpd=YES | |
| wscons=YES | |
| EOF |
Your system may need optional firmware on the ramdisk to even get to the decryption prompt. You can use vnconfig to mount the ramdisk and add this firmware like this example, for Cape Verde firmware for the radeon driver:
| cp /boot/ramdisk-cgdroot.fs /boot/ramdisk-cgdroot-good.fs | |
| vnconfig vnd0 /boot/ramdisk-cgdroot.fs | |
| mount /dev/vnd0a /mnt/ | |
| mkdir -p /mnt/libdata/firmware/radeon | |
| cp /libdata/firmware/radeon/VERDE_* /mnt/libdata/firmware/radeon | |
| umount /mnt/ | |
| vnconfig -u vnd0 |
| exit | |
| cd / | |
| umount /targetroot/* | |
| umount /targetroot | |
| cgdconfig -u cgd0 |
Without doing this, you may get certificate verification errors later:
| certctl rehash |
| PKG_PATH="https://cdn.NetBSD.org/pub/pkgsrc/packages/NetBSD/amd64/11.0/All" | |
| export PKG_PATH | |
| pkg_add pkgin |