Installing NetBSD UEFI + encrypted file system

tse

Hello,

I've been trying to install NetBSD on a UEFI system w/ encrypted file system, without great success. I've tried 8.0 and -CURRENT uefi installation mediums.

I am able to install - following https://wiki.netbsd.org/Installation_on_UEFI_systems/ - if I forego of encryption, however I cannot combine those instructions with https://wiki.netbsd.org/security/cgdroot/ to achieve my goal.

I thought that perhaps the best course of action would be to do a plain system installation and afterwards follow the instructions in https://www.netbsd.org/docs/guide/en/chap-cgd.html#chap-cgd-example to convert the root to cgd, but that implies a separate /boot partition, and if I create a separate /boot partition in the command line (deviating slightly from https://wiki.netbsd.org/Installation_on_UEFI_systems/) the installer fails when trying to mark the partitions as bootable and specifying the mount points (/boot /boot/UEFI/boot) (both 8.0 and 8.99).

Has anybody tried to do this with success? It's a bit disheartening that I was able to do it so easily with the FreeBSD installer ?

Thank you

Jay

tse I think encrypted boot is still experimental .. You can do UEFi though

JuvenalUrbino

tse Hi Tse, nice to see you here too (I'm sehnsucht); of all the BSDs, encrypted boot is available on FreeBSD+geli only AFAICT.

That said, as you mentioned, bootloader (either boot(8)/boot.cfg, or grub2) can perfectly reside on a separate unecrypted boot partition.

I successfully accomplished this on BIOS/MBR,but never tried on UEFI; I don't see why it shouldn't be possible; why not ask directly for a proof-of-concept walkthrough on netbsd-users mailing list?

tse My understanding was that it was not supported by sysinst(8) (given the closing remark in https://wiki.netbsd.org/security/cgdroot/)

and in fact it's not ?; want root encryption on NetBSD? old-school manual bootstrap/install; my tutorial could be a good starting point

tse the installer fails when trying to mark the partitions as bootable and specifying the mount points (/boot /boot/UEFI/boot) (both 8.0 and 8.99).

I'm positive you're doing it wrong here:

boot/UEFI/boot is a Linux/Grub ESP layout, not NetBSD's; EFI bootstrap code should rathet reside on /EFI/boot
unlike on Linux , on *BSD ESP doesn't need to be specified on /etc/fstab and is never mounted on a booted system (there's no /boot partition; once UEFI finds the ESP on the selected disk, the BSD EFI bootstrap code takes care of booting the specified root). In this case particular case, I'd dare guess that the cgdroot.kmod and ramdisk should be located at /EFI/boot as well, so as to mount the ESP at /boot/EFI/etc/cgd

tse

Jay My understanding was that it was not supported by sysinst(8) (given the closing remark in https://wiki.netbsd.org/security/cgdroot/), but the opening statement on that wiki seems to indicate that it is possible?

tse

JuvenalUrbino Thank you very much for your input.

Sadly I must say I could not make it work, and have took your advice of following the discussion to the mailing list.

Thank you.

JuvenalUrbino

tse I'm looking forward to following this thread then, you really raised my curiosity! Thank you for your feedback ?

Also, just to add more spice to the challenge, keep in mind that, similarly to Linux, NetBSD ported LVM from HP-UX long ago: I'm sure you know it comes in handy when coupled with encryption ?.

(small tip: there's a gateway for netbsd MLs on Usenet at muc.lists* hier, i.e. muc.list.netbsd.users; they're definitely easier to follow on a NNTP client, due to the thread-modeled organization, have a look below)

JuvenalUrbino

netbsd-users on tin nntp client