Am 04.06.2010 14:31, schrieb Philippe Cerfon: >> The scenario dm-crypt->LVM is easier, as there is no extra layer between >> the LV and filesystem. > > Well,... I rethought the whole thing. > I still think that RAID should be at the bottom, but then we can have either: > a) disk-->RAID-->dm-crypt-->LVM-->fs > or > b) disk-->RAID-->LVM-->dm-crypt-->fs Yes, both are supported. > (a) seems to be more naturally, as LVM is (as you've said) directly > below the fs,.. but... if I now add new disk because I want to enlarge > the fs,... I'll end up in using at least different master keys, as > dm-crypt is below LVM, right? > This would be avoided with (b) as far as I understand. That is correct. I use the dm-crypt->LVM setup on laptops, where a second disk will never be added. If you expect the LVM to be split over several VGs, then a per-logical-volume encryption seems more logical. >>> 2) I guess at any of the levels from above, one can partition the >>> exported block device, right? >>> So e.g. partition the physical disks that each has one big sdX1, and >>> create the RAID on it _OR_ create the RAID directly on the disk >>> withoug partitioning. >> I wouldn't rely on partitions, LVM is way more flexible. > So what is suggested now? > > I start e.g. with /dev/sd[a-d],... putting the RAID/MD directly on > sd[a-d] or on sd[a-d]1? If you boot from an external medium (as you say below), then I see no need to even partition the drives. Linux handles sd[a-d] (without partition table) just fine. > (I ask because this might have an effect on the alignment thingy) > > Then the raid gives me the "raid-device" /dev/md0. As I want several > LUKS volumes on my RAID (all with different keys) I could now either > partition md0, or set up LVM, right? Then on top of the > partitions/volumes dm-crypt,... on top of this my filesystems. Yes. I don't know how well partitioned md0 is supported. I would prefer LVM in any case, because it is very flexible - in particular, it does not rely on a specific physical layout of the volumes.
Attachment:
signature.asc
Description: OpenPGP digital signature
_______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
