I’ve been using Mint for a number of years and I encrypted the drive. An annoyance is I have two drives and the second one needs a different encryption and needs to be mounted seperately when I log in (besides if I tell it to automount with a saved password) I’ve been looking to change distros and finally chose one, this time though it uses BTRFS. I read over a number of differences but am not technical enough to know what it all means.

My question for now is with BTRFS, when installing the distro, can I tell it to use my second drive as an extension of the main drive so it all gets recognized as one, seamless?

  • Ooops@feddit.org
    7·
    3 days ago

    Your best options when you are already doing a fresh new install:

    • make both drives one virtual one with LVM, then encrypt that virtual drive

    But that’s not related to BTRFS at all and can be done with any file system

    • encrypt both drives with the same password, format them as BTRFS raid0 (again making it one big virtual drive), use the systemd hooks in your initramfs because then the first password you will provide on boot will unlock both drives (only if this fails on the first try you will be asked for additional passwords - also if you mistype your password once you will then have to unlock both by typing the password both; you only get one attempt to unlock everything with the same password).

    If you can do this is mostly depending on the specific installer (I would assume only the first option works by default…). It’s definitely possible in general but “I’m not technical enough” doesn’t go well with all the details you have to figure out yourself when the installer doesn’t do all the work.

  • Flyswat@lemmy.dbzer0.com
    2·
    2 days ago

    I might be wrong, but isn’t encryption done at disk block level, and then the filesystem sits on top of that? Meaning that changing the filesystem to BTRFS will not change the fact that you still have 2 different decryptions to set up.

  • crystalwalrus@programming.dev
    3·
    3 days ago

    Software raid 0 with btrfs will make the two drives one but I have no idea how that works if you are still going to have separate encryption keys and params for the second physical drive. If they have the same encryption it should be possible to have the device mapper write to the software raid.

    • Ooops@feddit.org
      6·
      3 days ago

      If they have the same password you can just unlog them at boot with one password. They SystemD hook for unlocking LUKS drives automatically tries the first provided password on all encrypted drives it’s supposed to unlock. Only if that fails it will ask for additional passwords.

        • Ooops@feddit.org
          1·
          2 days ago

          When using the systemd hooks for your initramfs (and using rd.luks.name=<UUID>=<name> instead of cryptdevice=UUID=<UUID>:<name> in the kernel parameters) it will try to decrypt all listed drives with the first password typed in, and only ask for additional passwords if that fails. Unlike the “traditional” busybox hooks that will ask for a password for each device. Doesn’t matter what you actually do with the drives themselves.

          So yes, you can for example have partitions/devices /dev/sda1, /dev/sda2, /dev/sdb1 all encrypted with the same password, format sda1 as your classic swap partition, sda2 as the first half of your btrfs raid0 root device and sdb1 as the second half (let’s give them fitting names when decrypting, so /dev/mapper/cryptswap, /dev/mapper/cryptroot-a and /dev/mapper/cryptroot-b), with rd.luks.name=<UUID>=cryptswap rd.luks.name=<UUID>=cryptroot-a rd.luks.name=<UUID>=cryptroot-b in your kernel parameters.

          And at boot you will be asked for the password only once, which will unlock all three encrypted partitions. (Unless you mistype. Then it will fall back to the default behavior of asking for 3 passwords, one for each.)

          (PS: You can also just unlock other encrypted devices via /etc/crypttab later in the boot process. That’s the much easier option and should be prefered unless you really need them early… as in they are your (or part of your) root device, swap etc.)

          The actual real question if you don’t want to figure out everything manually is which options the installer supports.