Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

In previous versions of Ubuntu, and current versions of Debian, you can unlock a fully encrypted system (using dmcrypt and LUKS) at boot time over SSH.

It was as easy as:

  1. Installing the encrypted system using the Ubuntu alternate installer disk or normal Debian installer disk and choosing to encrypt the system.
  2. After the system is installed, adding the dropbear and busybox packages.
  3. Updating the initram-fs to authorize your ssh key.

At boot time, you'd just ssh to the machine, and do:

echo -ne "keyphrase" > /lib/cryptsetup/passfifo

The machine would then unlock and boot the encrypted system.

Using the exact same steps on Ubuntu 11.10, I can ssh to the machine, but /lib/cryptsetup/passfifo doesn't exist.

There appears to be no way to unlock the system over ssh. I'm not sure where to look to see if this functionality changed or if it was removed.

share|improve this question
    
On a system that worked with the old way, can you do dpkg -S /lib/cryptsetup/passfifo ? I can't find any packages on packages.ubuntu.com for either Natty or Maverick that contain this file. –  maco Nov 7 '11 at 19:02

1 Answer 1

Just done some googling and it appears that plymouth gets in the way. If plymouth is there then on boot then cryptsetup will ask plymouth for the password and that means it's not using passfifo.

The best workaround appears to be putting the following script in the directory /usr/share/initramfs-tools/hooks/ After you've put it there you can chmod +x and then you have to update-initramfs -u. You should then be able to use the unlock command (which is created by the script below).

This relies on you using an ssh key to login with. If you want to use a password then you need to put SSHUSERPASS=<username> into /etc/initramfs-tools/initramfs.conf

#!/bin/sh

PREREQ="dropbear"

prereqs() {
    echo "$PREREQ"
}

case "$1" in
    prereqs)
        prereqs
        exit 0
    ;;
esac

. "${CONFDIR}/initramfs.conf"
. /usr/share/initramfs-tools/hook-functions

if [ "${DROPBEAR}" != "n" ] && [ -r "/etc/crypttab" ] ; then
    cat > "${DESTDIR}/bin/unlock" <<-EOF
        #!/bin/sh
        if PATH=/lib/unlock:/bin:/sbin /scripts/local-top/cryptroot
        then
            /sbin/pkill cryptroot
            /sbin/pkill -f "plymouth ask-for-pass"
            /sbin/pkill cryptsetup
            exit 0
        fi
        exit 1
    EOF
    chmod 755 "${DESTDIR}/bin/unlock"

    mkdir -p "${DESTDIR}/lib/unlock"
    cat > "${DESTDIR}/lib/unlock/plymouth" <<-EOF
        #!/bin/sh
        [ "\$1" == "--ping" ] && exit 1
        /bin/plymouth "\$@"
    EOF
    chmod 755 "${DESTDIR}/lib/unlock/plymouth"

    # Enable password login
    if [ -n "$SSHUSERPASS" ]
    then
        sed -n "s/^${SSHUSERPASS}:/root:/p" /etc/shadow > "${DESTDIR}/etc/shadow"
        chmod 640 "${DESTDIR}/etc/shadow"
    fi
fi

You can read more in this post on the ubuntuforums, this launchpad bug and the german post I nicked most of this from.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.