Imagine a system with one or more LUKS encrypted partitions (root or others) or volumes and you need to unlock these partitions/volumes during startup. In this case you need to be able to log in remotely and provide a password at the early boot phase. This can be achieved by using one or more mkinitcpio hook(s) that configure a network interface and start some kind of SSH server. Some packages listed below contribute various mkinitcpio build hooks to ease the configuration. The following tutorials add a remote unlocking method in addition to the existing local console password prompt.
In diesem Artikel gebe ich euch einen Überblick, was Network Bound Disk Encryption (NBDE) ist und beschreibe einen konkreten Anwendungsfall. Am Ende des Artikels führe ich einige Verweise auf, mit deren Hilfe ihr NBDE bei Interesse selbst implementieren könnt.
NixOS is a Linux distribution where everything is described as code, with one exception: during installation, the disk partitioning and formatting are manual steps. disko aims to correct this sad 🤡 omission.
This is especially useful for unattended installations, re-installation after a system crash or for setting up more than one identical server.
disko can either be used after booting from a NixOS installer, or in conjunction with nixos-anywhere if you're installing remotely.
Before using disko, the specifications of the disks, partitions, type of formatting and the mount points must be defined in a Nix configuration. You can find examples of typical configurations in the Nix community repository, and use one of these as the basis of your own configuration.
You can keep your configuration and re-use it for other installations, or for a system rebuild.
disko is flexible, in that it supports most of the common formatting and partitioning options, including:
Disk layouts: GPT, MBR, and mixed.
Partition tools: LVM, mdadm, LUKS, and more.
Filesystems: ext4, btrfs, ZFS, bcachefs, tmpfs, and others.It can work with these in various configurations and orders, and supports recursive layouts.
People often tell me they don't understand performance tool output because they can't tell what's "good" or "bad." It can be hard as performance is subjective. What's good for one user may be bad for another. There are also cases where I can't tell either: The tools only provide clues for further analysis.
Brendan Gregg from Sun's Fishworks team makes an interesting discovery about inducing disk latency. For more details, see Brendan's blog entry: (not available anymore)
So you’ve just rented a new server, in some random data center, from one of the popular hosting providers. You don’t have physical access to the machine, but you rely on your data to be stored securely on the server. You probably want to encrypt the entire system, even the swap partition. The server needs to be able to decrypt the filesystems to boot, but you don’t want the encryption key to be accessible by it, so nobody with physical access can access your data or even tamper with it.
Collecting benchmark results is the first step to solving disk I/O performance problems. Unfortunately, many bug reports and performance investigations fall down at the first step because bogus benchmark data is collected. This post explains common mistakes when running disk I/O benchmarks.
To give you a little bit of background when the OSD writes into his journal it uses D_SYNC and O_DIRECT. Writing with O_DIRECT bypasses the Kernel page cache, while D_SYNC ensures that the command won’t return until every single write is complete. So yes, basically the OSD forces all the writes to be flushed prior to start the next IO.
EnhanceIO driver is based on EnhanceIO SSD caching software product
developed by STEC Inc. EnhanceIO was derived from Facebook's open source
Flashcache project. EnhanceIO uses SSDs as cache devices for
traditional rotating hard disk drives (referred to as source volumes
throughout this document).
EnhanceIO can work with any block device, be it an entire physical
disk, an individual disk partition, a RAIDed DAS device, a SAN volume,
a device mapper volume or a software RAID (md) device.
The source volume to SSD mapping is a set-associative mapping based on
the source volume sector number with a default set size
(aka associativity) of 512 blocks and a default block size of 4 KB.
Partial cache blocks are not used. The default value of 4 KB is chosen
because it is the common I/O block size of most storage systems. With
these default values, each cache set is 2 MB (512 * 4 KB). Therefore,
a 400 GB SSD will have a little less than 200,000 cache sets because a
little space is used for storing the meta data on the SSD.
EnhanceIO supports three caching modes: read-only, write-through, and
write-back and three cache replacement policies: random, FIFO, and LRU.
Read-only caching mode causes EnhanceIO to direct write IO requests only
to HDD. Read IO requests are issued to HDD and the data read from HDD is
stored on SSD. Subsequent Read requests for the same blocks are carried
out from SSD, thus reducing their latency by a substantial amount.
In Write-through mode - reads are handled similar to Read-only mode.
Write-through mode causes EnhanceIO to write application data to both
HDD and SSD. Subsequent reads of the same data benefit because they can
be served from SSD.
Write-back improves write latency by writing application requested data
only to SSD. This data, referred to as dirty data, is copied later to
HDD asynchronously. Reads are handled similar to Read-only and
Write-through modes.VeraCrypt is a free disk encryption software brought to you by IDRIX (https://www.idrix.fr) and that is based on TrueCrypt.