Just thought I would give a brief
update.
I tried again to install an FDE system with separate boot, root, swap and home partitions, not using LVM, and using just the Ubiquity installer.
I used the process as first tried, looking to find a way to get Ubiquity to mount sda5_crypt. Just before clicking Install Now, I checked the mount status of all partitions using a terminal and <lsblk>. Only the install DVD and loop0 were mounted.
Clicked Install and checked again. No change.
Clicked Continue and checked again. Usual error: “Mount of sda5_crypt failed”.
Lsblk now shows swap mounted, but nothing else.
I tried various ways of mounting sda5_crypt, but I suppose the less said about that the better. It's quite likely that I was going about it in an entirely wrong way, given I know so little about what is going on "under the hood". Let's just say that nothing I tried worked.
I still wanted to attempt the non-LVM kind of FDE installation, I looked around some more and found this:
http://thesimplecomputer.info/full-disk ... ith-ubuntu
I did as instructed, and carefully. When setting up the system, I used the same passphrase for root, swap and home partitions.
On reboot, I got the decrypt prompt, entered the passphrase, and the comp sat for a while, then went to BusyBox.
I typed 'exit', and BB began checking dev/mapper/root file system, then a prompt to decrypt home partition showed, within BB. I entered the passphrase, and the machine finished booting.
Opened Places and found a 4.2GB device mounted. I had created a 4GB swap partition, so I figured that had to be it, though I was not expecting it to show in Places, I clicked on it, was prompted for a passphrase, entered it, and a message said “Unable to mount...no recognizable file system”. Dismissing the message resulted in the 4.2GB partition disappearing from Places. Since no file system is on swap anyway, and it does not have to be mounted to work, I figured all was OK.
The installation seemed basically good, except the tutorial had said: “If you do have systemd (Jessie, 15.04, CentOS 7...) and /home is using the same passphrase as /, then /home will be decrypted automatically after you enter the system partition's passphrase.”
But that didn't happen for me; had to enter the pwd for each partition separately. Also, it didn't seem normal that, after the usual Mintleaf screen asking for root's pwd, BB would open, and that I would have to type 'exit' and enter a passphrase for home right there in BB. It also doesn't seem normal to have to also open up Places after full bootup and decrypt swap from there.
To see if this would resolve itself, I shutdown and rebooted. The same routine occurred. I entered the passphrase for root and home as before and got the system up and running again.
I did a little looking on the net about systemd:
https://unix.stackexchange.com/question ... dy-mounted
I began to suspect that since the tutorial was last updated in June 2015, changes to systemd had led to this abnormal boot behavior.
And it seems that, according to message #202 in the above link, systemd only works for multiple encrypted partitions if LVM is used. As of Feb.2, 2018, this bug has not been fixed.
But I checked the Updater anyway. There was indeed an update for systemd. I could not find anything in the changelog that might point to this update curing the problem, but I installed it anyway.
Reboot.
Things went as before, except that when BB opened, it was telling me: “USB2-port4 disabled by hub”. It kept trying and failing to enable it. I exited, and BB briefly attempted a scan of Btrfs file systems (of which there are none on my computer). It then opened a prompt to decrypt the home partition. I entered the passphrase, it started the Btrfs scan again, then broke off and finished booting.
I then installed upstart-sysv, which required uninstalling systemd-sysv.
Reboot.
The same as the last time; “USB2-port4 disabled by hub”, exiting causes BB to attempt a scan of Btrfs file systems; exiting causes it to open a prompt to decrypt the home partition. But this time entering the passphrase does not work; it asks for the passphrase again. So I am locked out of the computer.
Rather than do a full re-install of this non-LVM system, and try some other solution, I decided to just restore the Laurent Method LVM system that I had cloned with RedoBackup immediately after completing it.
I conclude that systemd prevents proper functioning of an install of Mint 18.3 when multiple encrypted partitions are used, but LVM is not used.
Too bad. LVM works, of course, but RedoBackup, which I use, does not allow for cloning individual logical volumes within your volume group; the whole group has to be cloned. So one of the main advantages to separate root and home partitions, which is to be able to clone the system partition alone, so your system clones are small and fast, is not possible. Even with a volume group having ca. 640GB of total space, at least backup goes quickly. In my test case, the actual used space of my up and running system was only 6.6GB. The saved backup clone totalled 22.6GB in total size. So a bit by bit backup of all volumes (i.e. including free space) is not being done, it seems. But restore takes a long time (13hrs on my machine, which has a 2.3GHz CPU and almost 4GB RAM). It seems to be copying over the entire volume group on a bit by bit basis. So there is some mystery to me here. RedoBackup is plainly not making a bit by bit backup of the volume group, including free space, but it seems to be restoring in that fashion.
Unless some expert has produced a tutorial for a workaround, it looks like Joe User at present has no way to make an FDE installation of the kind I wanted, but has to use LVM.
One thing that partially saves the situation for the LVM installation is that TimeShift sees the LVM root and home partitions, and can backup and restore them separately or together. Although I would not trust TimeShift nearly as much as a clone, I did test it, and it worked. Since I don't find anything on the forums about how to use TimeShift to backup and restore FDE LVM installations, I thought some might find it useful to have a general idea of how that works.
Backup:
With the LVM encrypted computer up and running, open TimeShift. Under Settings>Users, you will see the logical volumes root and home (not swap, since no one needs to back that up anyway). You can select either the root or the home volume, or both, for backup. If backing up the root, you should probably check the boxes for Include Hidden Items, and Include Everything. On the Location tab you can choose an external drive as the backup location.
Restore:
You can of course restore these volumes by opening TimeShift in the running system. If the system is broken and cannot boot, it can be restored from a live DVD/USB.
Boot into a live session with your Mint install DVD.
If the version of Mint your install DVD contains already has TimeShift, just open TS from the menu. If it doesn't, get on the internet and install it into the live system:
<sudo apt-get update>
<sudo apt-get install timeshift>
Now TS can be used just as it would be if your system had been able to boot.
Open TS from the main program menu.
You will see your backup in the list of backups. (If you do not, your external drive is probably not on. Turn it on. TS should see it. (If it doesn't, you may have to close out and reopen TS. Note: Clicking the Menu button in the upper right corner of TS gives you an option to refresh the disk list. It does not seem to work.) Now click Settings>Location, and select that drive from the available sources. In any case, to assure that the source drive is correct, click Settings>Location and check which drive is selected.
Go back to the main menu, select the backup you want to restore from the list (all will be from the external drive, since you selected that as your Location), and click Restore on the main menu.
A dialogue box will come up, called Select Target Device.
Assuming you have backed up boot, root and home, you will see these as available for restoration.
Clicking on the option bar for root shows all drives (greyed out) and partitions (selectable). In my case, sda2, my LUKS container, was one of these. Selecting that opens a prompt for the passphrase. Entering that unlocks sda2 and shows the logical volumes in the container. Mine were called dm-1 (that was the root) and dm-3 (home). Since I was in the root option bar, I selected dm-1.
In my case, I wanted to restore both home and root, so I clicked on the option bar for home. It shows the same possible selections. I chose dm-3. Caution: It is possible to choose any ungreyed-out option, but of course only one is correct.
A large option bar underneath the others is labeled Bootloader Options (Advanced). Clicking on this gives the following choices:
(Preselected) Reinstall GRUB2 on:
And the option bar under this had the choices: (preselected) sda, sdb
(MBR), sdb1, and sda1. The correct choice for me was sda, as preselected.
(Unpreselected) Update initramfs. Hovering the mouse over this gives info: “Generally
not needed. Select only if boot fails.”
(Preselected) Update GRUB menu. A mouse hover reveals: “This is safe to run and
should be left selected”
I proceeded with the restore. It ran very fast; maybe two minutes.
When finished, the status report said that 14 files were created, 11 deleted, and 44 changed from the original installation. Since nothing had changed on the machine, because I booted into the live DVD for the restore immediately after saving the backup that was restored, I suspect this means simply that some files were overwritten, and/or that dates were changed – at least I hope that this is the case. It does go to show why I prefer cloning.
