d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Move the passphrase and iteration count into variables.

Browse Source 
This is purely to make it easier to tweak them locally; the machine I have
for testing takes forever to do 50,000 pw strengthening iterations, and
we're not testing the strength of geli's anti-pw-guessing logic here
(especially given that our test passphrase is "passphrase", except that
I tend to tweak that also, to 'x', because typing is hard).

Some day these should be settable as cmdline args.  But then, some day this
whole script should probably get a rewrite. :)
This commit is contained in:
Ian Lepore 2018-07-02 22:58:04 +00:00
parent 432b49211c
commit 595deaf7f1
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=335877
1 changed files with 15 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
tools/boot/rootgen.sh
View File

@ -2,6 +2,9 @@
# $FreeBSD$
passphrase=x
iterations=5000
do_boot1_efi=0
#
@ -394,8 +397,8 @@ mk_geli_gpt_ufs_legacy() {
gpart add -t freebsd-boot -s 400k -a 4k ${md} # <= ~540k
gpart add -t freebsd-ufs -l root $md
# install-boot will make this bootable
echo passphrase | geli init -bg -e AES-XTS -i 50000 -J - -l 256 -s 4096 ${md}p2
echo passphrase | geli attach -j - ${md}p2
echo ${passphrase} | geli init -bg -e AES-XTS -i ${iterations} -J - -l 256 -s 4096 ${md}p2
echo ${passphrase} | geli attach -j - ${md}p2
newfs /dev/${md}p2.eli
mount /dev/${md}p2.eli ${mntpt}
cpsys ${src} ${mntpt}
@ -430,8 +433,8 @@ mk_geli_gpt_ufs_uefi() {
gpart add -t efi -s 800k -a 4k ${md}
gpart add -t freebsd-ufs -l root $md
# install-boot will make this bootable
echo passphrase | geli init -bg -e AES-XTS -i 50000 -J - -l 256 -s 4096 ${md}p2
echo passphrase | geli attach -j - ${md}p2
echo ${passphrase} | geli init -bg -e AES-XTS -i ${iterations} -J - -l 256 -s 4096 ${md}p2
echo ${passphrase} | geli attach -j - ${md}p2
newfs /dev/${md}p2.eli
mount /dev/${md}p2.eli ${mntpt}
cpsys ${src} ${mntpt}
@ -467,8 +470,8 @@ mk_geli_gpt_ufs_both() {
gpart add -t freebsd-boot -s 400k -a 4k ${md} # <= ~540k
gpart add -t freebsd-ufs -l root $md
# install-boot will make this bootable
echo passphrase | geli init -bg -e AES-XTS -i 50000 -J - -l 256 -s 4096 ${md}p3
echo passphrase | geli attach -j - ${md}p3
echo ${passphrase} | geli init -bg -e AES-XTS -i ${iterations} -J - -l 256 -s 4096 ${md}p3
echo ${passphrase} | geli attach -j - ${md}p3
newfs /dev/${md}p3.eli
mount /dev/${md}p3.eli ${mntpt}
cpsys ${src} ${mntpt}
@ -504,8 +507,8 @@ mk_geli_gpt_zfs_legacy() {
gpart add -t freebsd-boot -s 400k -a 4k ${md} # <= ~540k
gpart add -t freebsd-zfs -l root $md
# install-boot will make this bootable
echo passphrase | geli init -bg -e AES-XTS -i 50000 -J - -l 256 -s 4096 ${md}p2
echo passphrase | geli attach -j - ${md}p2
echo ${passphrase} | geli init -bg -e AES-XTS -i ${iterations} -J - -l 256 -s 4096 ${md}p2
echo ${passphrase} | geli attach -j - ${md}p2
zpool create -O mountpoint=none -R ${mntpt} ${pool} ${md}p2.eli
zpool set bootfs=${pool} ${pool}
zfs create -po mountpoint=/ ${pool}/ROOT/default
@ -547,8 +550,8 @@ mk_geli_gpt_zfs_uefi() {
gpart add -t efi -s 800k -a 4k ${md}
gpart add -t freebsd-zfs -l root $md
# install-boot will make this bootable
echo passphrase | geli init -bg -e AES-XTS -i 50000 -J - -l 256 -s 4096 ${md}p2
echo passphrase | geli attach -j - ${md}p2
echo ${passphrase} | geli init -bg -e AES-XTS -i ${iterations} -J - -l 256 -s 4096 ${md}p2
echo ${passphrase} | geli attach -j - ${md}p2
zpool create -O mountpoint=none -R ${mntpt} ${pool} ${md}p2.eli
zpool set bootfs=${pool} ${pool}
zfs create -po mountpoint=/ ${pool}/ROOT/default
@ -591,8 +594,8 @@ mk_geli_gpt_zfs_both() {
gpart add -t freebsd-boot -s 400k -a 4k ${md} # <= ~540k
gpart add -t freebsd-zfs -l root $md
# install-boot will make this bootable
echo passphrase | geli init -bg -e AES-XTS -i 50000 -J - -l 256 -s 4096 ${md}p3
echo passphrase | geli attach -j - ${md}p3
echo ${passphrase} | geli init -bg -e AES-XTS -i ${iterations} -J - -l 256 -s 4096 ${md}p3
echo ${passphrase} | geli attach -j - ${md}p3
zpool create -O mountpoint=none -R ${mntpt} ${pool} ${md}p3.eli
zpool set bootfs=${pool} ${pool}
zfs create -po mountpoint=/ ${pool}/ROOT/default