LinuxMusicians

Hi all,
I am computer stupid, so I'll tell you what I am trying to accomplish the way that seems clear to me.
The plan is to eventually move away from Ubuntu Studio (U-Studio), but first I wish to know that AV Linux mx-21 will suit my needs. If it does I will switch out of ubuntu fully.

For the load of AV Linux, I will select a custom disk layout, I wish to use encryption, which complicates the situation of unknowns. I want a minimal size home folder of 50 - 60 GB, encrypted. I also want the OS encrypted to prevent external intrusions. Then I will use the remaining space on the ssd for personal storage of data in a separate partition. So this is my goal as a final outcome. Yet there is a lot of ignorance in me, and reading the instructions in the install program is both difficult for my dyslexic brain, poorly written, having little in specific detail as to its requirements and a lack of cohesive fluidity (that's my own perception).

So for the time being what I wish to achieve: I want to dual boot, in order to preserve U-Studio. I want the OS and the home folders both encrypted. I will use a 1 TB ssd to implement the new install on, partitioning it for both installation of AV Linux and its required partitions, with its remaining space partitioned to hold personal data, while keeping it separate from the OS and its required partitions. I've kept my own data in separate locations from the HDDs and SSD's for many years, as a better methodology for security of said data. It is my belief that having an encrypted OS pretty much eliminates snooping via firewall holes and other unknowns.

In my research prior to an attempt at loading AV Linux MX-21, looking at the U-studio ssd specs with gparted, looking at many videos Youtube, and other website sources supposedly on the subject. Yet I notice no concrete answer to the settings that pertain to the version of GRub, within the installer menu. I am unsure that it matters, but in all likelihood it does, having to be compatible with the drive partition(s) now holding U-Studio. So that is question #1. How to find out what version of GRub is used when booting to U-Studio 20.04.x, to correct any potential issues?

Then comes partition set up for the 1 TB ssd I am going to load AV Linux upon. I now know to begin by creating a Device partition table, type, "gpt." From there after creating a partition (the U-studio os has a 3.9 GB for its UEFI partition, but is this adequate? over-kill?) for UEFI I know to then flag it with "efi, boot" but the remaining specifics are quite blurry to me.

I have made a chart via researching the process, that shows what I know, what I don't know, and then there is something else that I remain fully ignorant to. The instructions with the MX system loader tells of a couple partitions strictly for implementation of encryption. I have no idea as to their size, I don't know were to put the second one, nor do I know what format either of them should have.


So here is the chart, having question marks in places that I know not what value to give, the x's are representations requiring a check mark, and the y is for the remaining un- allocated space remaining after the above is satisfied to be used for personal data. A couple other questions remain. I remain unclear about the requirement for a boot partition being separate from the home folder, and there in I understand that for future upgrading that they need to be separate partitions, well that is if I understand the text. I don't know the syntax required for having both, believing that there can only be one / mount point on a disk, but that is my ignorance showing up strongly. So if there are obvious errors in the chart below, could you please assist me in knowing the correct way(s) to proceed?

I am also unsure as to what three of these columns represent. Used For? and Pass? Options? Dump I hear/see is for a backup program, a methodology I have not used in years via a program, but I may take some time to go through that learning process to somewhat simplify life and accuracy in preservation of data.

Device.........Size..........Used For.........Label,,,,,,,,,Encrypt..........Format...........Check....Options....Dump....Pass
sda...........931 GB.......................................................................GPT...............................................................
sda1..........3.9 GB...........ESP.............avl-efi.........................Preserve (vfat)....................................................
sda2...........39 GB..............?..........Linux-swap..........x................swap.............................................................
sda3.............? GB..............?.......LUKS-encrypt.........?..................?.................................................?..............
sda4...........50 GB..............?............avl-home............x................ext4..............................................x..............
sda5,,,,,,,,,,,,y GB...............?..............Storage............x................ext4..............................................x..............

Sorry it is so long winded, but the only way I know to state the case from my own fogged up point of view where it comes to technology.

If you made it this far, thanks for reading. Any assistance would be greatly appreciated.

Tom

Hi, I suggest burning a live dvd of pclinuxos, which I think you'll find has a wonderful
gui based tool for creating custom partitions, as part of it's installer. Here's an xfce variant
link (kde and mate versions also officially nearby)

https://www.pclinuxos.com/?page_id=3836

The partitoning app should also be available from the typical menus, if you choose to boot that distro.
Once the partitions are in place, and labeled, but before installation, power-off and boot the avlinux installer,
which has encryption choices clearly displayed among the early options. The setup of user and root accounts is uncluttered,
and the rest is easy. Once installed, you'll be able to watch netflix, and jam along to the soundtrack
with guitarix or yoshimi, and launch the included Reaper demo, or other installed daw,
for whatever the muse whispers. Bottom line, make sure you can positively ID any partition you need to keep,
to isolate it from installer actions.
Cheers

You can run AVL-MXE live from a USB device and do partitioning from there. No need for a separate distro.
As you claim you are computer stupid, I recommend you go for a much simpler setup. For starters 3.9GB is way overkill for ESP. I have a 512MB ESP and have 8 operating systems installed; only 29MB is used.
Also 39GB is way overkill for swap. I have 16GB RAM and 4GB swap which barely gets used. The more RAM you have, the less swap you need generally, but still some is occasionally used. I recommend 4GB swap.
I also don't use encryption, that's your choice but is also an extra complication.
I'd recommend something like this:
ESP - 500MB
AVL root (/) - 50GB (include /home in this. You can mount your data partition on /home/data/ or something.)
Swap - 4GB
Data storage - rest of available space or a bit less (mount this inside /home if you wish and put all your music sessions etc. in here)

GRUB setup during installation of AVL-MXE should automatically configure to boot other operating systems.

It is my belief that having an encrypted OS pretty much eliminates snooping via firewall holes and other unknowns.

That's not how it works and getting lulled into a false sense of security - because you have some kind of security approximating features enabled or installed which do not work the way you hope it does - is way more dangerous than running an inherently insecure system where you already know better than to store highly sensitive information on or use to perform sensitive operations.

It's your system but it's better not to set it up to be too much all-singing all dancing with too many uses & features. If you want to make music set up an instance that concentrates on that without all the other possible add-ons & features. You want things optimized to provide a slick & smooth & fast experience. Not burden it with additional tasks that weigh it down.

Hi, thanks to others for their good advice!

I know what I need to know about Linux and regarding installation I'm no more savvy than your average Linux user, I've never written or developed the various installers for AV Linux and I've never been comfortable giving people installation advice and putting their data at stake. Your current setup is far more convoluted than anything I've ever installed on and I never use encryption and only recently have I used more than one Operating System... I have no time to even try another one!

I've said all I have to say on this topic in the User Manual:

Installation Suggestions

Depending on your experience with using Linux you may have some pre-conceived ideas about how a
Linux system should be installed and what the HDD partition layout of your installation should be. Many
people like to have a separate root and home partition, some like to go with full-blown LVM (Linux Volume
Management) setup. Depending on what you are using your installed Operating System for there are
certainly valid use-cases for every kind of setup. Because of the intended purpose of AVL-MXE I’m going to
suggest some things that may seem out of the ordinary but many years of experience have shown me
that there is some merit and solid logic in setting up a Workstation system a bit differently.
When you are using an Operating System as a Multimedia Workstation you have to take into
consideration that you will be working with a lot of large files, you will most likely be working on projects
for days or even months and since you are creating Audio and Video works that are unique to you and
your talents your data will be very precious and not easily replaceable so the safety of important Data is
always a concern but the safety of artistic creations are that much more of a concern. Another important
consideration is being able to quickly restore and re-install a very complex and specialized Operating
System in the case that there is either a Hardware or Software System failure.

Because of these and other considerations I strongly suggest to Install AVL-MXE on it’s own system root
(‘/’) partition with the home folder contained within the same root partition. I suggest all important Data
and Projects should be kept on other separate Data partitions and not in the User’s home folder. In a
setup like this the system partition that AVL-MXE is installed to does not have to be overly large but I do
suggest a minimum of 25 Gb. If you have a large HDD to work with then focus on allocating the largest
amounts of space to creating other partitions for your Data. You may wonder and ask “why can’t I just
keep all my Data in my home folder like I usually would”? The answer is because in the event that you ever
need to either reinstall AVL-MXE (or install a whole different OS) then you want to ensure your precious
Data is on a separate partition that is not targeted by an installer and does not need to move or be backed
up elsewhere, this way you can install an Operating System on one single dedicated partition without
disturbing your Data. In this scenario your home folder should be seen as a temporary staging area to
download to, organize, and use for short term purposes while your important Data is stored elsewhere. In
the event you have a sudden major system failure you can rest assured that you won’t lose everything
and will be back up and running in short order.

Even with these precautions I cannot overstate the extreme importance of backing up your Data to an
external source even when it is on separate partitions in the System. Keeping Data on separate partitions gets
us some of the way toward preserving and protecting it but external Backup copies are the only way to
guarantee it’s safety.

asbak wrote: ↑Fri Feb 18, 2022 7:31 am

It is my belief that having an encrypted OS pretty much eliminates snooping via firewall holes and other unknowns.

That's not how it works and getting lulled into a false sense of security - because you have some kind of security approximating features enabled or installed which do not work the way you hope it does - is way more dangerous than running an inherently insecure system where you already know better than to store highly sensitive information on or use to perform sensitive operations.

Hey,

I have considered what you stated here for a couple of days now. I believe I understand now, the encryption is only for physical intrusion, like by a thief can't take the ssd, hook it up to another box and see the data, without the key. But the internet is not protected because data comes in and goes out for internet to work. I was lulled by a false impression. Still encryption has its place, and I will use it. Thanks for that assisting info. And by the way I always use a firewall and take other precautions as well.

Onward, I succeeded in loading that system, by its default load settings. From that, I was able to see the information that I asked for, well it is some information and values that work at least. It shows the basic needed partitions. I was surprised to see that it didn't make a swap partition, but I know that one.
Another thing I found was in the MX Linux manual, about the size of swap partitions should be as large or greater than the computer's memory. In my researching prior I saw swap should be 110% of the computer's memory. I truly don't understand that. My own computer has 32 GB and I've never seen it using swap, Probably that is for high demand computing, gaming, and the such. I don't look at those stats when I am doing my music work. It might use more memory when I am exporting a large mixed music file our of Ardour, but I've not looked to see what is real while in process.

From hear, i can go through the process again, reload, to achieve what I want with partition sizes.

Thanks again,

Then play on....

baconature wrote: ↑Sun Feb 20, 2022 5:44 amAnother thing I found was in the MX Linux manual, about the size of swap partitions should be as large or greater than the computer's memory. In my researching prior I saw swap should be 110% of the computer's memory. I truly don't understand that. My own computer has 32 GB and I've never seen it using swap, Probably that is for high demand computing, gaming, and the such.

That recommendation may be true if you wish to use hibernation, in which the contents of memory is written to the swap file to allow it to resume in the same state. Otherwise, as I said, more memory generally equates to less swap usage. Mine has been up for 4 days now and shows 2MB swap used.

baconature wrote: ↑Sun Feb 20, 2022 5:44 am Hey,

I have considered what you stated here for a couple of days now. I believe I understand now, the encryption is only for physical intrusion, like by a thief can't take the ssd, hook it up to another box and see the data, without the key. But the internet is not protected because data comes in and goes out for internet to work. I was lulled by a false impression. Still encryption has its place, and I will use it. Thanks for that assisting info. And by the way I always use a firewall and take other precautions as well.

Hi there

Encryption, if done properly, can be useful for a level of data protection against physical theft as you mentioned, but nevertheless "security measures" are only as good as the weakest chain in the link. Keeping that chain in good shape all of the time and to a degree that it really works is very difficult. Many security measures are good enough for discouraging amateurs but to what extent they're going to defeat a professional adversary (who knows the tricks of the trade better than you or I ever will) will depend on many factors.

For doing audio on Linux one really wants a system that is under a minimum burden to get the best results. Encryption operations is one way to burden it. It may not seem like much extra hard work but it could mean the difference between getting or not getting intermittent xruns. Every additional task the machine has to do brings it closer to the point where it will xrun. If you must do encryption then use it for volumes that aren't critical to the daily operation of the system.

A firewall on the local machine is useful but your home router should already be blocking external attempts to access your system. If not you have bigger problems. A firewall is also not typically going to protect you or your system from accessing compromised websites, running compromised applications and files or prevent installed malware from opening up undesired connections to the outside world. Security only works up to a point, and only if the operator really knows what they are doing, and only if they stay on top of it ALL of the time (very difficult) and only if their adversaries are amateurs.

Try to be secure and not do stupid things but be careful of becoming convinced security measures work as you believe they work, because very often they don't. It's safer to assume that despite best efforts, there is and will always still be a high element of risk and uncertainty and unknown flaws and weaknesses in the security regime. Certain vendors, corporations, online sellers etc will all promise and guarantee you things - but many are liars because they want to take your money or they want to ensnare you for other purposes.

This probably isn't what you want to hear but even hardware is sometimes compromised to the extent that no matter what you do on the OS and on software, you're already owned.

Thank you both, again.

This is a very good thing learning from the experience of others. I don't know any one who uses Linux, or records music for that matter. Really I know few people and the numbers dwindle as we age. Current conditions have halted my will to socialize which confounds the potential to expand greatly.

I am quite aware of those out in the world with malicious intent, The spam filter is a blessing as is avoiding social media, or signing up for anything that expands even ones email address to other entities. They then sell your email address and the spam snowballs. I learned that a few decades ago, when the world was safer than now.

The issue with system burden via encryption seems odd, yet I have experienced that since I started using encryption, to never figure it out. Where-as, encryption is the only thing that was knowingly different beyond the upgrade to the next LTR release. Because they occurred at the same time, I was not able to draw any conclusion. I may change my mind about encryption with this information.

I also shut my computer off every night, so I have never wanted or used hibernation. The system boots up quick enough and even strong random passwords are rather easy to memorize quickly.

Cheers
Tom

@baconature I would definitely avoid encrypting all your filesystems: encryption is about protecting data from snoops, much more than systems from crackers. If you are running a music business, I would definitely keep accounting / tax / legal stuff on a separate system, or (if you must) on a separate HDD/SSD with its filesystem encrypted.

My own music machine has separate SSDs with the "high performance" data (samples, DAW projects / recordings, etc.) on each. The "root" filesystem is just one of a couple of partitions on the onboard SSD. None of those seem to me to be worth encrypting.

Hey out there in LInuxMusician-land,
With the assistance of those whom contributed to this thread, I learned a whole lot about the numerous ways to view OS installation and more. The process also solved one of the unknowns that I had noticed over the past 18 months, since upgrading from UbuntuStudio 18.04 to 20.04 which crashed my system entirely. It is usually my ignorance which causes problems as was that issue, due to the OS switching from the old BIOS system to the supposedly more secure EFI system. At that point it took me more than a week to figure out how to set up the new system having lost all computer functionality with needed accessibility function absent. I can't read fluently, and this associated issue proved very difficult to work around at that point.

When attempting to set up AV Linux MX-21 (on a separate ssd) I found some further discrepancy between it's setup in EFI and the other which I am using now, for Ubuntu Studio 20.04, an issue that remains. I have figured a workaround, but Grub won't see the two setups at the same time. The work around is to change the settings in EFI in selecting which ssd to look at for boot. Regardless of this issue, which at this time is rather mute being somewhat content with Ubuntu Studio at present, in the back of my mind I know I shall want to upgrade to 22.04 at some time. I may even switch to AV Linux at that point, who knows, surely not me at present. At that time (likely in the fall, after there has been adequate time to resolve issues which seem quite typical in new systems.

Next time I know to avoid use of encryption, probably the largest error of assumption that I have made in some time. The next thing is figuring out why the two EFI systems are not seen by grub simultaneously, which if corrected can again allow true duel boot to happen. Then again, that may no longer be possible. I only use Linux and like having two functional Linux OSs on my system in the case of a disc failure which is likely to occur at some point in time. Yes it is a true pain in the butt to fully set up two linux systems, redundant in itself, but come a system failure it is quite handy. Maybe one day I will try the new backup systems available now days. The old ones seemed unworthy of use over the long term, as they didn't transit time effectively, resulting in large blocks of data storage that was obsolete and unusable. At least this is how it seemed to me over the years. It is so time consumptive for me to stay aligned with technology that for the most part, I lack the time required to do so. I'd much rather work at recording my music beside the other preferences I choose, gardening, learning things of science, geology for the most part.

I suppose this is really another thank you to all for the assist, and your own sharing of information. I am grateful for having received the inputs, stepping stones for the tomorrows to come. I wish I knew enough to assist in turn but I doubt that is possible where it comes to computing. I am a dinosaur treading in a modern realm, sort of in awe at what the experience shows.

Stay safe out there in the real world!

Regards

Tom
I fully rebuilt my website last month if you want to see and hear a mere glimpse of what I do in my own part of the real world.