[DRBD-user] Best practice: drbd+lvm+gfs2+dm-crypt on dual primary

Patrick Prilisauer prilisauer at googlemail.com
Mon Feb 2 18:22:42 CET 2015

Note: "permalinks" may not be as permanent as we would like,
direct links of old sources may well be a few messages off.

Well in fact I'm not familiar on this system, I'd like to find out what
known setup works and are there guides on these setups.

I could tell you how to solve it on an enterprises storage e.g. EMC, but,
I'm just started on DRBD.

Ps.: unlocking should be done by usb stick and an keyfile or even better
remotely through putty.

The target is to have a encrypted GFS2 Store in an untrusted environment

I'm affraid on reading blogs telling me, that there could be a possible
corruption, or showing me only 50 % ot an setup
that finally "should" work

2015-02-02 18:10 GMT+01:00 Digimer <lists at alteeve.ca>:

> On 02/02/15 12:02 PM, Ivan wrote:
>> On 02/02/2015 05:50 PM, Digimer wrote:
>>> I see no particular problem with this. I use DRBD -> Clustered LVM ->
>>> GFS2 all the time. If you wanted to add LUKS, I'd probably do it as DRBD
>>> -> Clustered LVM -> LUKS'ed LV -> GFS2.
>> I'm not sure that two (or more) LUKS partitions are identical given
>> exactly the same cleartext content and the same keys. There must be some
>> kind of sector randomization when writing data to make cryptoanalysis
>> harder, so it makes me think that it's not the case (that would require
>> testing though).
>> If I'm right, I don't see how DRBD could work in that setup. (or maybe I
>> just need more sleep).
> LUKS is working on the LV, which will be backed by the PV on DRBD. DRBD
> doesn't know data, so it will simply replicate the LUKS structure
> faithfully to both nodes.
> Remember, for all intent and purpose, there is only one device/luks
> partition. DRBD is really no different from LUKS on /dev/mdX devices in
> this regard.
> --
> Digimer
> Papers and Projects: https://alteeve.ca/w/
> What if the cure for cancer is trapped in the mind of a person without
> access to education?
> _______________________________________________
> drbd-user mailing list
> drbd-user at lists.linbit.com
> http://lists.linbit.com/mailman/listinfo/drbd-user
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linbit.com/pipermail/drbd-user/attachments/20150202/67811d66/attachment.htm>

More information about the drbd-user mailing list