Initramfs + Luks - only one password prompt
What I want to achieve:
- Being asked for a password, only once during boot time;
- The other (non-root) partitions to use the keyfile inside the
/root/directory.
What I have achieved so far:
(A) The system booting, but asking for password twice (once for/, and once for/usr).- Or: (B) the system not booting, asking for password once, but then refusing the mount
/usrsaying it cannot found the LVM group/volume. I get dropped to shell, and can see that/root/.keyfileis unavailable./has not been mounted yet.
Configuration
File: /etc/crypttab
Case A
sdc3_crypt /dev/sdc3 none luks
md0_crypt /dev/md0 none luks
Case B
sdc3_crypt /dev/sdc3 none luks
md0_crypt /dev/md0 /root/.keyfile luks
What totally didn't work
- Creating script files to manually luksOpen the required drive: those in
/etc/initramfs-tools/scripts/local-premountare called before/is available, but those in/etc/initramfs-tools/scripts/local-bottomare called after it wants to open/usr(and therefore it is too late).
boot encryption lvm luks
asked Jun 14 '15 at 21:52
Etienne BruinesEtienne Bruines
11115
bumped to the homepage by Community♦ 22 hours ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
add a comment |
What I want to achieve:
- Being asked for a password, only once during boot time;
- The other (non-root) partitions to use the keyfile inside the
/root/directory.
What I have achieved so far:
(A) The system booting, but asking for password twice (once for/, and once for/usr).- Or: (B) the system not booting, asking for password once, but then refusing the mount
/usrsaying it cannot found the LVM group/volume. I get dropped to shell, and can see that/root/.keyfileis unavailable./has not been mounted yet.
Configuration
File: /etc/crypttab
Case A
sdc3_crypt /dev/sdc3 none luks
md0_crypt /dev/md0 none luks
Case B
sdc3_crypt /dev/sdc3 none luks
md0_crypt /dev/md0 /root/.keyfile luks
What totally didn't work
- Creating script files to manually luksOpen the required drive: those in
/etc/initramfs-tools/scripts/local-premountare called before/is available, but those in/etc/initramfs-tools/scripts/local-bottomare called after it wants to open/usr(and therefore it is too late).
boot encryption lvm luks
asked Jun 14 '15 at 21:52
Etienne BruinesEtienne Bruines
11115
bumped to the homepage by Community♦ 22 hours ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
The order of the entries infstabmatters. Are you sure that you have/mounted before/usrinfstab?
– Vincent Yu
Jul 9 '15 at 5:23
That is a good question. I assume/is at the top, before anything else. I would have to wait until I get home, in order to confirm.
– Etienne Bruines
Jul 9 '15 at 10:08
add a comment |
What I want to achieve:
- Being asked for a password, only once during boot time;
- The other (non-root) partitions to use the keyfile inside the
/root/directory.
What I have achieved so far:
(A) The system booting, but asking for password twice (once for/, and once for/usr).- Or: (B) the system not booting, asking for password once, but then refusing the mount
/usrsaying it cannot found the LVM group/volume. I get dropped to shell, and can see that/root/.keyfileis unavailable./has not been mounted yet.
Configuration
File: /etc/crypttab
Case A
sdc3_crypt /dev/sdc3 none luks
md0_crypt /dev/md0 none luks
Case B
sdc3_crypt /dev/sdc3 none luks
md0_crypt /dev/md0 /root/.keyfile luks
What totally didn't work
- Creating script files to manually luksOpen the required drive: those in
/etc/initramfs-tools/scripts/local-premountare called before/is available, but those in/etc/initramfs-tools/scripts/local-bottomare called after it wants to open/usr(and therefore it is too late).
boot encryption lvm luks
asked Jun 14 '15 at 21:52
Etienne BruinesEtienne Bruines
11115
What I want to achieve:
- Being asked for a password, only once during boot time;
- The other (non-root) partitions to use the keyfile inside the
/root/directory.
What I have achieved so far:
(A) The system booting, but asking for password twice (once for/, and once for/usr).- Or: (B) the system not booting, asking for password once, but then refusing the mount
/usrsaying it cannot found the LVM group/volume. I get dropped to shell, and can see that/root/.keyfileis unavailable./has not been mounted yet.
Configuration
File: /etc/crypttab
Case A
sdc3_crypt /dev/sdc3 none luks
md0_crypt /dev/md0 none luks
Case B
sdc3_crypt /dev/sdc3 none luks
md0_crypt /dev/md0 /root/.keyfile luks
What totally didn't work
- Creating script files to manually luksOpen the required drive: those in
/etc/initramfs-tools/scripts/local-premountare called before/is available, but those in/etc/initramfs-tools/scripts/local-bottomare called after it wants to open/usr(and therefore it is too late).
boot encryption lvm luks
boot encryption lvm luks
asked Jun 14 '15 at 21:52
Etienne BruinesEtienne Bruines
11115
asked Jun 14 '15 at 21:52
Etienne BruinesEtienne Bruines
11115
asked Jun 14 '15 at 21:52
Etienne BruinesEtienne Bruines
11115
asked Jun 14 '15 at 21:52
Etienne BruinesEtienne Bruines
11115
asked Jun 14 '15 at 21:52
Etienne BruinesEtienne Bruines
11115
11115
bumped to the homepage by Community♦ 22 hours ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
bumped to the homepage by Community♦ 22 hours ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
The order of the entries infstabmatters. Are you sure that you have/mounted before/usrinfstab?
– Vincent Yu
Jul 9 '15 at 5:23
That is a good question. I assume/is at the top, before anything else. I would have to wait until I get home, in order to confirm.
– Etienne Bruines
Jul 9 '15 at 10:08
add a comment |
The order of the entries infstabmatters. Are you sure that you have/mounted before/usrinfstab?
– Vincent Yu
Jul 9 '15 at 5:23
That is a good question. I assume/is at the top, before anything else. I would have to wait until I get home, in order to confirm.
– Etienne Bruines
Jul 9 '15 at 10:08
The order of the entries in
fstab matters. Are you sure that you have / mounted before /usr in fstab?– Vincent Yu
Jul 9 '15 at 5:23
The order of the entries in
fstab matters. Are you sure that you have / mounted before /usr in fstab?– Vincent Yu
Jul 9 '15 at 5:23
That is a good question. I assume
/ is at the top, before anything else. I would have to wait until I get home, in order to confirm.– Etienne Bruines
Jul 9 '15 at 10:08
That is a good question. I assume
/ is at the top, before anything else. I would have to wait until I get home, in order to confirm.– Etienne Bruines
Jul 9 '15 at 10:08
add a comment |
1 Answer
1
active
oldest
votes
On this wiki page (in german, I sadly didn't find an equivalent in english) it is suggested that you use the script /lib/cryptsetup/scripts/decrypt_derived to generate a key from the opened root device. I will try to translate the important parts, but I have NOT tried the procedure.
To add the key, you would have to execute (as root)
mkdir /mnt/ram && mount -t ramfs -o size=1m ramfs /mnt/ram && chmod 600 /mnt/ram
/lib/cryptsetup/scripts/decrypt_derived <root_dev> > /mnt/ram/tmp.key && cryptsetup luksAddKey <usr_dev> /mnt/ram/tmp.key && rm /mnt/ram/tmp.key
umount /mnt/ram && rmdir /mnt/ram
where <root_name> is the name of your root device as displayed in /dev/mapper (probably sdc3_crypt), and <usr_dev> the device where /usr is on (probably /dev/md0).
The line for crypttab is
<usr_name> UUID=<UUID> <root_name> luks,keyscript=/lib/cryptsetup/scripts/decrypt_derived
remember to run
update-initramfs -u -k all
after changing crypttab.
You should keep a "normal" password for your usr device, otherwise you won't be able to open it in case your root device is damaged.
answered Jun 14 '15 at 22:45
luckyrumoluckyrumo
40137
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "89"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f636503%2finitramfs-luks-only-one-password-prompt%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
On this wiki page (in german, I sadly didn't find an equivalent in english) it is suggested that you use the script /lib/cryptsetup/scripts/decrypt_derived to generate a key from the opened root device. I will try to translate the important parts, but I have NOT tried the procedure.
To add the key, you would have to execute (as root)
mkdir /mnt/ram && mount -t ramfs -o size=1m ramfs /mnt/ram && chmod 600 /mnt/ram
/lib/cryptsetup/scripts/decrypt_derived <root_dev> > /mnt/ram/tmp.key && cryptsetup luksAddKey <usr_dev> /mnt/ram/tmp.key && rm /mnt/ram/tmp.key
umount /mnt/ram && rmdir /mnt/ram
where <root_name> is the name of your root device as displayed in /dev/mapper (probably sdc3_crypt), and <usr_dev> the device where /usr is on (probably /dev/md0).
The line for crypttab is
<usr_name> UUID=<UUID> <root_name> luks,keyscript=/lib/cryptsetup/scripts/decrypt_derived
remember to run
update-initramfs -u -k all
after changing crypttab.
You should keep a "normal" password for your usr device, otherwise you won't be able to open it in case your root device is damaged.
answered Jun 14 '15 at 22:45
luckyrumoluckyrumo
40137
add a comment |
On this wiki page (in german, I sadly didn't find an equivalent in english) it is suggested that you use the script /lib/cryptsetup/scripts/decrypt_derived to generate a key from the opened root device. I will try to translate the important parts, but I have NOT tried the procedure.
To add the key, you would have to execute (as root)
mkdir /mnt/ram && mount -t ramfs -o size=1m ramfs /mnt/ram && chmod 600 /mnt/ram
/lib/cryptsetup/scripts/decrypt_derived <root_dev> > /mnt/ram/tmp.key && cryptsetup luksAddKey <usr_dev> /mnt/ram/tmp.key && rm /mnt/ram/tmp.key
umount /mnt/ram && rmdir /mnt/ram
where <root_name> is the name of your root device as displayed in /dev/mapper (probably sdc3_crypt), and <usr_dev> the device where /usr is on (probably /dev/md0).
The line for crypttab is
<usr_name> UUID=<UUID> <root_name> luks,keyscript=/lib/cryptsetup/scripts/decrypt_derived
remember to run
update-initramfs -u -k all
after changing crypttab.
You should keep a "normal" password for your usr device, otherwise you won't be able to open it in case your root device is damaged.
answered Jun 14 '15 at 22:45
luckyrumoluckyrumo
40137
add a comment |
On this wiki page (in german, I sadly didn't find an equivalent in english) it is suggested that you use the script /lib/cryptsetup/scripts/decrypt_derived to generate a key from the opened root device. I will try to translate the important parts, but I have NOT tried the procedure.
To add the key, you would have to execute (as root)
mkdir /mnt/ram && mount -t ramfs -o size=1m ramfs /mnt/ram && chmod 600 /mnt/ram
/lib/cryptsetup/scripts/decrypt_derived <root_dev> > /mnt/ram/tmp.key && cryptsetup luksAddKey <usr_dev> /mnt/ram/tmp.key && rm /mnt/ram/tmp.key
umount /mnt/ram && rmdir /mnt/ram
where <root_name> is the name of your root device as displayed in /dev/mapper (probably sdc3_crypt), and <usr_dev> the device where /usr is on (probably /dev/md0).
The line for crypttab is
<usr_name> UUID=<UUID> <root_name> luks,keyscript=/lib/cryptsetup/scripts/decrypt_derived
remember to run
update-initramfs -u -k all
after changing crypttab.
You should keep a "normal" password for your usr device, otherwise you won't be able to open it in case your root device is damaged.
answered Jun 14 '15 at 22:45
luckyrumoluckyrumo
40137
On this wiki page (in german, I sadly didn't find an equivalent in english) it is suggested that you use the script /lib/cryptsetup/scripts/decrypt_derived to generate a key from the opened root device. I will try to translate the important parts, but I have NOT tried the procedure.
To add the key, you would have to execute (as root)
mkdir /mnt/ram && mount -t ramfs -o size=1m ramfs /mnt/ram && chmod 600 /mnt/ram
/lib/cryptsetup/scripts/decrypt_derived <root_dev> > /mnt/ram/tmp.key && cryptsetup luksAddKey <usr_dev> /mnt/ram/tmp.key && rm /mnt/ram/tmp.key
umount /mnt/ram && rmdir /mnt/ram
where <root_name> is the name of your root device as displayed in /dev/mapper (probably sdc3_crypt), and <usr_dev> the device where /usr is on (probably /dev/md0).
The line for crypttab is
<usr_name> UUID=<UUID> <root_name> luks,keyscript=/lib/cryptsetup/scripts/decrypt_derived
remember to run
update-initramfs -u -k all
after changing crypttab.
You should keep a "normal" password for your usr device, otherwise you won't be able to open it in case your root device is damaged.
answered Jun 14 '15 at 22:45
luckyrumoluckyrumo
40137
answered Jun 14 '15 at 22:45
luckyrumoluckyrumo
40137
answered Jun 14 '15 at 22:45
luckyrumoluckyrumo
40137
answered Jun 14 '15 at 22:45
luckyrumoluckyrumo
40137
40137
add a comment |
add a comment |
Thanks for contributing an answer to Ask Ubuntu!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f636503%2finitramfs-luks-only-one-password-prompt%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
The order of the entries in
fstabmatters. Are you sure that you have/mounted before/usrinfstab?– Vincent Yu
Jul 9 '15 at 5:23
That is a good question. I assume
/is at the top, before anything else. I would have to wait until I get home, in order to confirm.– Etienne Bruines
Jul 9 '15 at 10:08