What would be the perfect way to encrypt the swap?

[elover]

Following the wiki, they do it with a file, and creating a couple of scripts to mount and format, I have done exactly the same, but not with a file, but with a partition. Everything mounts fine but in the boot log it shows me that it does not find the partition.

Now I wonder if it can be mounted without having to format at each boot.

These are the steps I have done

cat /etc/local.d/swap.start
cryptsetup -d /etc/keys/swap.key open /dev/md/gentoo:swap cryptswap
mkswap /dev/mapper/cryptswap
swapon /dev/mapper/cryptswap


cat /etc/local.d/swap.stop
swapoff /dev/mapper/cryptswap
cryptsetup close cryptswap

cat /etc/conf.d/dmcrypt
swap=cryptswap
source=/dev/md/gentoo:swap
key=/etc/keys/swap.key
options='--key-file /etc/keys/swap.key'

The error: swapon: can't open /dev/mapper/cryptswap: File or directory does not exist

[szatox]

The easiest way to do that is LVM on LUKS, which allows you to encrypt everything except for boot. You seem to have gotten creative though.
Is it a valid device path? /dev/md/gentoo:swap? : is not a common character, are you sure it's not e.g. substituted with - by the devicemapper/udev/whatever manages human-readable links?

Also, show us your lsblk
_________________
Make Computing Fun Again

[elover]

I will try what you tell me

Edit: I remember that with /dev/md126 and /dev/md127 when I boot it changes, sometimes md126 is the root and sometimes the swap

[grknight]

If you use the dmcrypt init script, do not use local.d scripts in addition to it.

The dmcrypt init prepares the swap to be mounted automatically. Then, since you should list swap in fstab, the swap script will come after dmcrypt and do swapon as normal.

The question of the source from szatox is still valid and should be clarified.

edit: What does ls /dev/mapper output as well

[elover]

I remember that with /dev/md126 and /dev/md127 when I boot it changes, sometimes md126 is the root and sometimes the swap

[elover]

[grknight]

[szatox]

Well, there's already some good info here, so I'll just add one more thing:
I don't know what raid mode you're using for SWAP, but it is definitely suboptimal.
6 individual partitions would give you more capacity, more IO, and probably some access pattern optimization at the cost of crashing something in case of a disk failure. In the unlikely case you really really can't afford crashing any swapped out process, 3 SWAPs on 2-disk mirrors would still create less artificial load than your current setup.
_________________
Make Computing Fun Again

[elover]

Does not mount swap, but manual does

sudo cryptsetup luksOpen /dev/md/gentoo:swap -d /etc/keys/swap.key cryptswap

sudo swapon /dev/mapper/cryptswap

[grknight]

dmcrypt OpenRC service for swap does not use LUKS and does not use "key="
Use the /dev/mapper path in the fstab not a UUID since it is formatted every boot

Make sure that no LUKS header is on the swap device or dmcrypt service will fail

If you want to mimic what dmcrypt is doing, then the command is: cryptsetup -c aes -h sha1 -d /dev/urandom create $target $source

[elover]

Then I have to remove the key, and remove luks? the swap can not be encrypted with openrc?


because I have done this.


Remove the swap from the fstab

create /etc/local.d/swap.start
cryptsetup -d /etc/keys/swap.key open /dev/md/gentoo:swap cryptswap
swapon /dev/mapper/cryptswap


And now it works and I don't get error in log rc.log Edit: if it shows the luks error, I'm going to leave it unencrypted as I had it before.

log rc.log

[gentoo_ram]

Is there a reason you need to use a particular key? Is this so you can resume out of swap or something? Otherwise, why do you care about the key for swap?

The default configuration in /etc/conf.d/dmcrypt is to initialize swap with a random key every time the machine boots. The idea is that swap will be encrypted on disk and you can't recover the swap data between boots. That's usually what people want.

/etc/conf.d/dmcrypt:

[elover]

In the rc.log I get this:
WARNING: Default encryption options (aes-xts-plain64, key size 256 bits) are being used and may be incompatible with earlier versions of dmcrypt. For unencrypted mode, always use the --cipher, --key-size and, if no key file is used, also --hash options.

[grknight]