Re: [linux-lvm] Can I combine LUKS and LVM to achieve encryption and snapshots?
Zdenek Kabelac <[email protected]>
| Newsgroups | dev.linux.lists.linux-lvm |
|---|---|
| Message-ID | <[email protected]> |
Dne 25. 09. 23 v 0:09 Jean-Marc Saffroy napsal(a): > Hello LVM experts, > > I am trying to create a volume with the following properties: > - the volume can be resized > - the volume is encrypted > - the volume can be snapshotted (for online backups) > > So I thought I'd create the volume with LVM, encrypt it with LUKS, and > snapshot it with LVM. However, LVM doesn't want to snapshot the unencrypted > LUKS volume, as it is not an actual logical volume known to LVM (and I am not > keen on snapshotting the encrypted volume, as that means the backup process > would need the passphrase to mount the encrypted snapshot). > > Is there a good way to achieve this with LUKS and LVM, or should I look elsewhere? > > I have two ideas but I don't know if they are safe or practical: > - I could try running LVM (snapshots) ontop of LUKS (encryption)itself ontop > of LVM (resize) Hi Yep typical usage is to encrypt underlying PV - and then create LVs and its snapshots on encrypted device. > - or I could try working with dmsetup to fill the gap between LUKS and LVM > > I did simple tests with dmsetup, and that *seems* to work, however I am not > sure at all if that would be robust. An outline of my test: > - create an LVM volume (lvcreate) from a larger volume group > - make it a LUKS volume (cryptsetup lukfsFormat) > - "open" the LUKS volume (cryptsetup open) > - create a snapshot-origin volume from the open LUKS volume (dmsetup create) > - mount that as my active volume > - every time I want to do a backup: > create a temporary snapshot volume from the origin, mount it, run the > backup, unmount it, delete it Usually those 'into encryption' want to have encrypted everything - thus even layout of the whole storage. Encrypting 'individual' LVs - while certainly 'doable' would i.e. create a considerable larger amount of volumes that would need individual 'unlocking' with each activation. Speaking about snapshots - you should consider switching to 'thin-pools' for far better performance... Regards Zdenek _______________________________________________ linux-lvm mailing list [email protected] https://listman.redhat.com/mailman/listinfo/linux-lvm read the LVM HOW-TO at http://tldp.org/HOWTO/LVM-HOWTO/