OpenBSD Journal

Initial support for guided disk encryption in the installer

Contributed by Peter N. M. Hansteen on from the take my disk to the crypt dept.

The OpenBSD installer now has basic support for configuring disk encryption during the regular installation process. Previously, disk encryption needed to be set up manually by dropping to the shell from the installer.

Initial support, likely to be expanded upon, was committed by Klemens Nanni (kn@) on . The commit reads,

Subject:    CVS: src
From:       Klemens Nanni <kn () cvs ! openbsd ! org>

Module name:	src
Changes by:	2023/03/07 10:29:42

Modified files:
	distrib/miniroot: install.sub 

Log message:
Initial support for guided disk encryption

One new question to cover the most common use case, such that manual setup
in (S)hell or '!' prior to install is no longer required:

Encrypt the root disk? (disk, 'no' or '?' for details) [no] ?

Create a passphrase protected CRYPTO softraid volume to be used as root disk.

Available disks are: sd0.
Encrypt the root disk? (disk, 'no' or '?' for details) [no]

Use of keydisk or different disciplines are not covered.
Only asked in interactive installations;  no autoinstall(8) or upgrades.
Only reachable on i386, amd64, sparc64 and riscv64 for now (arm64 WIP).

Tested by cheloha naddy and a few users
Feedback from cheloha deraadt claudio
OK cheloha
"get it in now" deraadt

We very much look forward to seeing further development on this!

If you feel up to it, please test and report.

(Comments are closed)


Copyright © - Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to as well as images and HTML templates were copied from the fabulous original with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]