USB QOS411 With Separate LUKS Partition For Storage. Issues Accessing Partition From APPVMs

[dracoren]

I tried the traditional method from @51lieal 's guide and following links :

Installation guide

Qubes OS Installation - Detached encrypted boot and header

Used device in testing and confirm is worked : windows vmware (host using old pc) and my laptop. both are using uefi. Keep in mind that below are disk i used in the tutorial, you can use 2 flashdrive (1 boot, 1 header) + 1 hdd or whatever you want. /dev/nvme0n1 = system /dev/sda = flashdrive Please watch out any space, slash, periode in command issue / files IT REALLY MATTER After booting into installation in language section, press ctrl + alt + f2 —# WARNING CONFIRM YOUR DISK FIRST BEF…

Qubes OS Install on a 1TB SSD USB. Best configuration for two separate partitions (installation + Storage)?

I am using a highspeed SSD /dev/sda1 for /boot/efi /dev/sda2 for /boot /dev/sda3 for lvm (root and vm-pool) /dev/sda4 storage So I should be encrypting both sda3 and sda4. I need luks2 encryption. And after installation will the gui be demanding password for both partitions separately?

and achieved this structure with a few changes in the code (luks2, no header or separate boot and header etc):

Install was successful, except for two error messages which didn’t prevent a successful boot.

1. For the lvcreate commands for root-pool and vm-pool
   “/usr/sbin/dmeventd: stat failed: No such file or directory
   WARNING: Failed to monitor qubes_dom0/root-pool”
2. During the first reboot, the lightdm.service failed to start and a couple of lines of Ext2fs4 errors came up. I just rebooted again, and the “complete configuration” gui came up. The rest went well to a successful boot.

One funny thing is happening though.
The luks encrypted sdb4 appears as a device in the USB applet.
When mounted in an AppVM, it appears with a lock symbol and asks for password when clicked.
On password supply, it again reappears as unencrypted drive in the applet. This time the options exclude the AppVM where it was decrypted.
If I mount this in another AppVM, it doesn’t appear at all. I even followed the steps creating a Volume-group “qubes_storage” etc replicating the steps for root-pool and vm-pool, including the ext4 filesystem formatting. The outcome is the same.

Any hints or suggestions please?
Thank you.

[51lieal]

@dracoren

For the lvcreate commands for root-pool and vm-pool

The error messages shouldn’t be a problem.

@dracoren

During the first reboot, the lightdm.service failed to start and a couple of lines of Ext2fs4 errors came up.

Have you wiped out your drive before installing? it might lead problem like this.

@dracoren

The luks encrypted sdb4 appears as a device in the USB applet.

It’s normal.

[dracoren]

The errors were inconsequential to the OS function. I listed them just to leave no stone un-turned.
How to I save data into luks2 sdb4 and access it from USB QOS411?
Can somebody try to replicate this situation? Just an external HDD or if possible a luks2 partition in a OS installed drive.

[dracoren]

Almost always problems leave a lot of open ends.
Not this one, for me. I have reached a dead end. It’s like a prompt without response.
(&# ( (& %&*%^ (?
that looks more meaningful than any question I can ask now.
Maybe a screwdriver can help.

[tripleh]

As an alternative: [1] is intended for portability across Qubes OS installations.

Otherwise look out for external storage pool threads on the forum.

[1] GitHub - 3hhh/qcrypt: multilayer encryption tool for Qubes OS

[dracoren]

Thanks.
I will try out this solution too.
I removed the luks2 and encrypted the partition using veracrypt.
I installed veracrypt in the template, and now I can access the encrypted drive from any operating system.

[51lieal]

I don’t get what you mean by “storage”
Is this a storage for “Data” or “Storage Pool” ? but I believe if it was for Data ?

if you using sys-usb, then assign the partition first to appvm, and in the appvm, simply open the encrypted partition, mount to /mnt, and you are done.

[dracoren]

I have the same QOS411 structure on an externally bootable USB, as in the OP, except that sdb4 is veracrypted and working as I need it - encrypted data storage. I would like to encrypt sdb4 with lukscrypt since I need to store multiple veracrypt encrypted containers in sdb4. Is it enough to just run the luks commands for the sdb4 partition from dom0?
Sorry if this is too simple.