Decrypt root device at boot with keyfile on usb - Debian Stretch
Clash Royale CLAN TAG#URR8PPP
up vote
1
down vote
favorite
Basically what I need is to decrypt root device automatically with a keyfile stored on a usb with a partition scheme (ext3, ext4 I don't mind).
I successfully implemented the script method with dd command, which basically stores the key in the padding between the start of the (usb) memory and the first partition (eg, the first 2048 bits of the device). Basically this method uses a udev rule to link /dev/usbkey with e.g. /dev/sdc and a script which reads (with dd) the first 2048 bits of the former device to decipher the partition. See here.
Sadly this is not a viable method for me, I really need to mount the usb filesystem (possibly ro), read the file, unlock the encrypted device and unmount the filesystem.
I've tried different methods, like the one detailed on arch documentation, without success. Even more I cannot figure out what is explained here, some steps seems missing to me. For example in the script method if the usb key is not present, it prompts for the passphrase; on the arch method this seems unimplemented, or implemented implicitly.
With the arch method my system seems just unable to find the key (even if I've added the modules ext3 and ext4 to the initramfs) and it hangs.
So here's my question: how does ones decrypt (luks) the root partition, using a keyfile stored on a partition on a usb key?
Where may I find information about this stuff, aka where should I start?
Thanks
UPDATE:
My partition scheme looks like this:
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sdb 8:16 0 465.8G 0 disk
├─sdb1 8:17 0 243M 0 part /boot
├─sdb2 8:18 0 1K 0 part
└─sdb5 8:21 0 465.5G 0 part
└─cryptroot 254:0 0 465.5G 0 crypt
├─debian--vg-root 254:1 0 450G 0 lvm /
└─debian--vg-swap_1 254:2 0 15.6G 0 lvm [SWAP]
boot luks disk-encryption
asked Sep 27 at 15:03
LotoLo
388113
add a comment |Â
up vote
1
down vote
favorite
Basically what I need is to decrypt root device automatically with a keyfile stored on a usb with a partition scheme (ext3, ext4 I don't mind).
I successfully implemented the script method with dd command, which basically stores the key in the padding between the start of the (usb) memory and the first partition (eg, the first 2048 bits of the device). Basically this method uses a udev rule to link /dev/usbkey with e.g. /dev/sdc and a script which reads (with dd) the first 2048 bits of the former device to decipher the partition. See here.
Sadly this is not a viable method for me, I really need to mount the usb filesystem (possibly ro), read the file, unlock the encrypted device and unmount the filesystem.
I've tried different methods, like the one detailed on arch documentation, without success. Even more I cannot figure out what is explained here, some steps seems missing to me. For example in the script method if the usb key is not present, it prompts for the passphrase; on the arch method this seems unimplemented, or implemented implicitly.
With the arch method my system seems just unable to find the key (even if I've added the modules ext3 and ext4 to the initramfs) and it hangs.
So here's my question: how does ones decrypt (luks) the root partition, using a keyfile stored on a partition on a usb key?
Where may I find information about this stuff, aka where should I start?
Thanks
UPDATE:
My partition scheme looks like this:
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sdb 8:16 0 465.8G 0 disk
├─sdb1 8:17 0 243M 0 part /boot
├─sdb2 8:18 0 1K 0 part
└─sdb5 8:21 0 465.5G 0 part
└─cryptroot 254:0 0 465.5G 0 crypt
├─debian--vg-root 254:1 0 450G 0 lvm /
└─debian--vg-swap_1 254:2 0 15.6G 0 lvm [SWAP]
boot luks disk-encryption
asked Sep 27 at 15:03
LotoLo
388113
Did you forget the usb storage module? If you want to solve it yourself, perhaps these might get you started: wiki.debian.org/initramfs - manpages.debian.org/stretch/initramfs-tools/… - wiki.gentoo.org/wiki/Custom_Initramfs
– frostschutz
Sep 27 at 15:42
On a sidenote,cryptsetupis perfectly able to read a key from a raw device at an offset, no need fordd. Only reason to useddanyway is if the cryptsetup call is hidden so deep in the initramfs that you can't modify it, and doesn't already support these options. I think debian's crypttab does have keyfile, keyfile-size, and keyfile-offset support though, so you could get away without writing a custom hook - but I'm not sure.
– frostschutz
Sep 27 at 15:45
Also found this, maybe it will help you: lists.debian.org/debian-user/2017/12/msg00523.html
– frostschutz
Sep 27 at 15:54
wow! this seems perfect for me, I'll try asap. Thanks!
– LotoLo
Sep 27 at 16:08
UPDATE: I've tried to use the method described on the mail, but sadly it does not work. Or at least it works partially. I mean with a LVM partition scheme (like the one I have described in the question) it does not work: hung at boot, can't find device mapper. BUT with a 'pure' ext4 partition scheme (without LVM) it DOES work! Now that's really strange and I'm currently working to understand why this flyer does not want to work with LVM. I think it may be because of a cmdline parameter.
– LotoLo
Oct 2 at 14:13
add a comment |Â
up vote
1
down vote
favorite
up vote
1
down vote
favorite
Basically what I need is to decrypt root device automatically with a keyfile stored on a usb with a partition scheme (ext3, ext4 I don't mind).
I successfully implemented the script method with dd command, which basically stores the key in the padding between the start of the (usb) memory and the first partition (eg, the first 2048 bits of the device). Basically this method uses a udev rule to link /dev/usbkey with e.g. /dev/sdc and a script which reads (with dd) the first 2048 bits of the former device to decipher the partition. See here.
Sadly this is not a viable method for me, I really need to mount the usb filesystem (possibly ro), read the file, unlock the encrypted device and unmount the filesystem.
I've tried different methods, like the one detailed on arch documentation, without success. Even more I cannot figure out what is explained here, some steps seems missing to me. For example in the script method if the usb key is not present, it prompts for the passphrase; on the arch method this seems unimplemented, or implemented implicitly.
With the arch method my system seems just unable to find the key (even if I've added the modules ext3 and ext4 to the initramfs) and it hangs.
So here's my question: how does ones decrypt (luks) the root partition, using a keyfile stored on a partition on a usb key?
Where may I find information about this stuff, aka where should I start?
Thanks
UPDATE:
My partition scheme looks like this:
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sdb 8:16 0 465.8G 0 disk
├─sdb1 8:17 0 243M 0 part /boot
├─sdb2 8:18 0 1K 0 part
└─sdb5 8:21 0 465.5G 0 part
└─cryptroot 254:0 0 465.5G 0 crypt
├─debian--vg-root 254:1 0 450G 0 lvm /
└─debian--vg-swap_1 254:2 0 15.6G 0 lvm [SWAP]
boot luks disk-encryption
asked Sep 27 at 15:03
LotoLo
388113
Basically what I need is to decrypt root device automatically with a keyfile stored on a usb with a partition scheme (ext3, ext4 I don't mind).
I successfully implemented the script method with dd command, which basically stores the key in the padding between the start of the (usb) memory and the first partition (eg, the first 2048 bits of the device). Basically this method uses a udev rule to link /dev/usbkey with e.g. /dev/sdc and a script which reads (with dd) the first 2048 bits of the former device to decipher the partition. See here.
Sadly this is not a viable method for me, I really need to mount the usb filesystem (possibly ro), read the file, unlock the encrypted device and unmount the filesystem.
I've tried different methods, like the one detailed on arch documentation, without success. Even more I cannot figure out what is explained here, some steps seems missing to me. For example in the script method if the usb key is not present, it prompts for the passphrase; on the arch method this seems unimplemented, or implemented implicitly.
With the arch method my system seems just unable to find the key (even if I've added the modules ext3 and ext4 to the initramfs) and it hangs.
So here's my question: how does ones decrypt (luks) the root partition, using a keyfile stored on a partition on a usb key?
Where may I find information about this stuff, aka where should I start?
Thanks
UPDATE:
My partition scheme looks like this:
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sdb 8:16 0 465.8G 0 disk
├─sdb1 8:17 0 243M 0 part /boot
├─sdb2 8:18 0 1K 0 part
└─sdb5 8:21 0 465.5G 0 part
└─cryptroot 254:0 0 465.5G 0 crypt
├─debian--vg-root 254:1 0 450G 0 lvm /
└─debian--vg-swap_1 254:2 0 15.6G 0 lvm [SWAP]
boot luks disk-encryption
boot luks disk-encryption
asked Sep 27 at 15:03
LotoLo
388113
asked Sep 27 at 15:03
LotoLo
388113
edited Oct 2 at 14:16
asked Sep 27 at 15:03
LotoLo
388113
asked Sep 27 at 15:03
LotoLo
388113
asked Sep 27 at 15:03
LotoLo
388113
388113
Did you forget the usb storage module? If you want to solve it yourself, perhaps these might get you started: wiki.debian.org/initramfs - manpages.debian.org/stretch/initramfs-tools/… - wiki.gentoo.org/wiki/Custom_Initramfs
– frostschutz
Sep 27 at 15:42
On a sidenote,cryptsetupis perfectly able to read a key from a raw device at an offset, no need fordd. Only reason to useddanyway is if the cryptsetup call is hidden so deep in the initramfs that you can't modify it, and doesn't already support these options. I think debian's crypttab does have keyfile, keyfile-size, and keyfile-offset support though, so you could get away without writing a custom hook - but I'm not sure.
– frostschutz
Sep 27 at 15:45
Also found this, maybe it will help you: lists.debian.org/debian-user/2017/12/msg00523.html
– frostschutz
Sep 27 at 15:54
wow! this seems perfect for me, I'll try asap. Thanks!
– LotoLo
Sep 27 at 16:08
UPDATE: I've tried to use the method described on the mail, but sadly it does not work. Or at least it works partially. I mean with a LVM partition scheme (like the one I have described in the question) it does not work: hung at boot, can't find device mapper. BUT with a 'pure' ext4 partition scheme (without LVM) it DOES work! Now that's really strange and I'm currently working to understand why this flyer does not want to work with LVM. I think it may be because of a cmdline parameter.
– LotoLo
Oct 2 at 14:13
add a comment |Â
Did you forget the usb storage module? If you want to solve it yourself, perhaps these might get you started: wiki.debian.org/initramfs - manpages.debian.org/stretch/initramfs-tools/… - wiki.gentoo.org/wiki/Custom_Initramfs
– frostschutz
Sep 27 at 15:42
On a sidenote,cryptsetupis perfectly able to read a key from a raw device at an offset, no need fordd. Only reason to useddanyway is if the cryptsetup call is hidden so deep in the initramfs that you can't modify it, and doesn't already support these options. I think debian's crypttab does have keyfile, keyfile-size, and keyfile-offset support though, so you could get away without writing a custom hook - but I'm not sure.
– frostschutz
Sep 27 at 15:45
Also found this, maybe it will help you: lists.debian.org/debian-user/2017/12/msg00523.html
– frostschutz
Sep 27 at 15:54
wow! this seems perfect for me, I'll try asap. Thanks!
– LotoLo
Sep 27 at 16:08
UPDATE: I've tried to use the method described on the mail, but sadly it does not work. Or at least it works partially. I mean with a LVM partition scheme (like the one I have described in the question) it does not work: hung at boot, can't find device mapper. BUT with a 'pure' ext4 partition scheme (without LVM) it DOES work! Now that's really strange and I'm currently working to understand why this flyer does not want to work with LVM. I think it may be because of a cmdline parameter.
– LotoLo
Oct 2 at 14:13
Did you forget the usb storage module? If you want to solve it yourself, perhaps these might get you started: wiki.debian.org/initramfs - manpages.debian.org/stretch/initramfs-tools/… - wiki.gentoo.org/wiki/Custom_Initramfs
– frostschutz
Sep 27 at 15:42
Did you forget the usb storage module? If you want to solve it yourself, perhaps these might get you started: wiki.debian.org/initramfs - manpages.debian.org/stretch/initramfs-tools/… - wiki.gentoo.org/wiki/Custom_Initramfs
– frostschutz
Sep 27 at 15:42
On a sidenote,
cryptsetup is perfectly able to read a key from a raw device at an offset, no need for dd. Only reason to use dd anyway is if the cryptsetup call is hidden so deep in the initramfs that you can't modify it, and doesn't already support these options. I think debian's crypttab does have keyfile, keyfile-size, and keyfile-offset support though, so you could get away without writing a custom hook - but I'm not sure.– frostschutz
Sep 27 at 15:45
On a sidenote,
cryptsetup is perfectly able to read a key from a raw device at an offset, no need for dd. Only reason to use dd anyway is if the cryptsetup call is hidden so deep in the initramfs that you can't modify it, and doesn't already support these options. I think debian's crypttab does have keyfile, keyfile-size, and keyfile-offset support though, so you could get away without writing a custom hook - but I'm not sure.– frostschutz
Sep 27 at 15:45
Also found this, maybe it will help you: lists.debian.org/debian-user/2017/12/msg00523.html
– frostschutz
Sep 27 at 15:54
Also found this, maybe it will help you: lists.debian.org/debian-user/2017/12/msg00523.html
– frostschutz
Sep 27 at 15:54
wow! this seems perfect for me, I'll try asap. Thanks!
– LotoLo
Sep 27 at 16:08
wow! this seems perfect for me, I'll try asap. Thanks!
– LotoLo
Sep 27 at 16:08
UPDATE: I've tried to use the method described on the mail, but sadly it does not work. Or at least it works partially. I mean with a LVM partition scheme (like the one I have described in the question) it does not work: hung at boot, can't find device mapper. BUT with a 'pure' ext4 partition scheme (without LVM) it DOES work! Now that's really strange and I'm currently working to understand why this flyer does not want to work with LVM. I think it may be because of a cmdline parameter.
– LotoLo
Oct 2 at 14:13
UPDATE: I've tried to use the method described on the mail, but sadly it does not work. Or at least it works partially. I mean with a LVM partition scheme (like the one I have described in the question) it does not work: hung at boot, can't find device mapper. BUT with a 'pure' ext4 partition scheme (without LVM) it DOES work! Now that's really strange and I'm currently working to understand why this flyer does not want to work with LVM. I think it may be because of a cmdline parameter.
– LotoLo
Oct 2 at 14:13
add a comment |Â
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f471854%2fdecrypt-root-device-at-boot-with-keyfile-on-usb-debian-stretch%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Did you forget the usb storage module? If you want to solve it yourself, perhaps these might get you started: wiki.debian.org/initramfs - manpages.debian.org/stretch/initramfs-tools/… - wiki.gentoo.org/wiki/Custom_Initramfs
– frostschutz
Sep 27 at 15:42
On a sidenote,
cryptsetupis perfectly able to read a key from a raw device at an offset, no need fordd. Only reason to useddanyway is if the cryptsetup call is hidden so deep in the initramfs that you can't modify it, and doesn't already support these options. I think debian's crypttab does have keyfile, keyfile-size, and keyfile-offset support though, so you could get away without writing a custom hook - but I'm not sure.– frostschutz
Sep 27 at 15:45
Also found this, maybe it will help you: lists.debian.org/debian-user/2017/12/msg00523.html
– frostschutz
Sep 27 at 15:54
wow! this seems perfect for me, I'll try asap. Thanks!
– LotoLo
Sep 27 at 16:08
UPDATE: I've tried to use the method described on the mail, but sadly it does not work. Or at least it works partially. I mean with a LVM partition scheme (like the one I have described in the question) it does not work: hung at boot, can't find device mapper. BUT with a 'pure' ext4 partition scheme (without LVM) it DOES work! Now that's really strange and I'm currently working to understand why this flyer does not want to work with LVM. I think it may be because of a cmdline parameter.
– LotoLo
Oct 2 at 14:13