laptop security - encryption - does not work cleanly on F7

[Mail List]

Attempting to improve laptop security using  luks encrypted home partition.

 Summary:

                   root is a non-starter -
                  /home can be made to work via custom rc.local but not 
cleanly using  /etc/crypttab.

Details:

  Been struggling with this - sure could use some  help. After much reading 
and fiddlingI gave up trying to get fedora working with luks dm-crypted root 
as it seems there are limitations with mkinitrd or something. Instead I have 
swap (which does work aside from a resume error on boot) and encrytped /home 
which is a problem and is not working quite right.

  I cannot get machine to boot correctly and mount /home using the 
standard /etc/crypttab /etc/fstab files.

  If anyone can help I'd be very grateful - I know this should work - a friend 
with ubuntu has root encrypted and it runs no prob - so I just need help with 
the fedora magic.

 Here's what is going on.

  I created luks encrypted /home - put info in /etc/crypttab. Set fstab to now 
mount /dev/mapper/XX onto /home. Hand mounts all work fine. So far so good.

 Now try booting.

 First problem was if fstab has fsck on - then on booting the /etc/crypttab 
triggers a pass-phrase request - which appears to work (small yay) - next 
fsck fails with bad superblock error. I suspect the fsck is done on /dev/sdaX 
instead of /dev/mapper/xx. Obvisously this cannot work.

 Q) what needs changing to fix this?

I edited fstab to skip any fsck - now boot proceeds further - then it says 
re-mounting read write - now it prompts for pass phrase a second time (bug?). 
That seems to fail anyway in that /dev/mapper/xx is not created and thus the 
mount fails. Boot proceeds ok - but ends with no /dev/mapper/xx and /home 
cannot be mounted.

 Presumbaly 

       a) I did something wrong (most likely?)

       b) fedora tools are just not ready encrytion (seems so in part)
           Possible things to look at: rc.sysinit, mkinitrd

       c) other.

 Given the importance of laptop security these days I do so hope this can be 
made to work smoothly and so would very much appreciate some help.

   Since I cannot get even a non-root to boot smoothly - I have a ways to go 
before attempting encrypted root - seems debian based distros may be ahead of 
us in this regard.

   For those interested - my work around - is to remove the /etc/crypttab 
file - change fstab to noauto for /home and create a custom script which does 
the crypto by hand - then run it out of rc.local. This gets me going but I 
know there is a "proper" way to do this. I just dont know what it is!

  If anyone is interested in all the details I can share.

thanks.

g/