2

I’m trying to setup a dedicated server with an encrypted drive, I’ve found some help online to get that up and running but I’m running in some troubles getting dropbear-initramfs to start properly. (tutorial along those lines https://hamy.io/post/0005/remote-unlocking-of-luks-encrypted-root-in-ubuntu-debian/)

So I install the dropbear-initramfs package and get an error that the keys are missing and it won’t work. I add the authorized_keys I configure dropbear to run on a different port and i update initramfs but at boot dropbear doesn’t start and I just get prompted the normal username/password. I’ve tried a couple of things to get that up and running, I tried to dpkg reconfigure the package once the keys are setup properly and I don’t get an error message anymore but dropbear still doesn’t start.

If anyone has any pointer that would be very appreciated :)

Best regards

P.S: I had a look for the already opened questions but the majority of them are now quite old and the dropbear + initramfs is suppose to be easier since ubuntu 16.04 (with the dropbear-initramfs package).

1
  • Have you tried the update guide hamy.io/post/0009/… I just tried it on 18.10 and it worked fine – Rwky Nov 4 '18 at 13:48
2

You almost did what what must be done.

###The short version:

###TL;DR Due to a security issue, the authorized_keys, containing the public key of your client was deleted...

  1. Dropbear and openssh are both SSH servers but don't share the same format of keys, although they share same principle of private-public keys:
  • DER format for dropbear
  • PEM format for openssh for private keys
  • An authorized_keys file on the server side,
  • A known_hosts file on the client side.

That's why to connect to a dropbear server, both ssh and dbclient can be used, but /usr/lib/dropbear/dropbearconvert must be used to convert the public keys ensure ssh is compatible with dropbear, or to make dbclient compatible with sshd.

  1. Dropbear is much smaller than sshd and even though it's more basic, it's good to have an SSH public key-only server available at an early stage of the Linux boot process, specifically when you use a boot loader such as PXE and/or iPXE.
    To do that, dropbear must be integrated to the init filesystem (The initrd image).
    The Ubuntu package dropbear-initramfs must be installed (I'm using version 2017.75-3build1 on Ubuntu 18.04).
    All dropbear's settings are in the /etc/dropbear-initramfs/ folder, including the configuration file (config), server private keys, rsa, dss, ecdsa (dropbear_*_host_key), and client's public keys to accepted (authorized_keys) must be placed here in the correct dropbear format.
    Then to update your current initrd image file in the /boot/ directory, you must launch:

     sudo update-initramfs -u
    

This package comes with scripts to build initrd images in /usr/share/initramfs-tools/hooks/dropbear, and scripts to run in the early stages of the boot process in /usr/share/initramfs-tools/scripts/init-premount/dropbear, and only then are those last scripts embedded inside the initrd images.

  1. Some distributions delete authorized_keys under certain conditions to prevent ssh connections in early stages. To circumvent this, you must check this and workaround such as below:

     $ cd /usr/share/initramfs-tools/scripts/
     $ grep -R authorized_keys *
     init-bottom/dropbear:# delete authorized_keys(5) file to forbid new SSH sessions
     init-bottom/dropbear:#rm -f ~root/.ssh/authorized_keys
     init-bottom/dropbear:    # just kill this script), so deleting root's authorized_keys(5) file
    

In the workaround, we mitigate the deletion of authorized_keys to be able to connect into a machine when something goes wrong in the initramfs stage.

5
  • Welcome to Ask Ubuntu! ;-) Looks like an excellent answer (I don't use dropbear, so cannot comment on the validity) but could you please do me a favour and read the editing help and have a look at my edits to improve the readability of your answers in the future, and then edit your post and leave a comment below here mentioning @Fabby and I'll come back and upvote. ;-) 0:-) – Fabby Dec 23 '18 at 0:28
  • a shorter short of a short, at the end, true knowledge will end to disappear to make you a guru... If someone truly want an answer, he must deserve it, than, at least make the effort to read hints... – Paul-et-Mickey Feb 17 '19 at 7:26
  • Si vous voulez bien rajouter une version plus courte entre The short version et TL;DR? Not everyone has 30 years of experience like us old farts... >:-) +10 already for the long version, +50 for the short version. leave a comment @Fabby after doing so, please? – Fabby Feb 17 '19 at 10:54
  • @Fabby: what are you rambling about? :D – user643011 Aug 29 '19 at 7:33
  • I cqn get into trouble in 10 languages but only out of trouble in 7... @user643011 ;-) – Fabby Aug 29 '19 at 18:14
0

Works for Debian, should work for Ubuntu too: https://github.com/ceremcem/unlock-luks-partition

Unlock LUKS Partition with SSH

Below instructions are for booting your SERVER by connecting and unlocking the encrypted partition via your CLIENT over SSH:

WARNING: Typing your crypto key over network might be secure (due to the secure nature of the SSH connection) as long as you are completely certain that the initramfs has not been subjugated so that there is no MITM attack taking place while you are typing your disk passphrase.

1. Install mandatory packages (on SERVER)

apt-get install dropbear initramfs-tools busybox

Check that Dropbear has disabled itself in /etc/default/dropbear

NO_START=1

2. Append your desired public keys into the SERVER's authorized_keys file

Just copy and paste your public key(s) into /etc/dropbear-initramfs/authorized_keys on SERVER

3. Create the unlock script

Create the following script as /etc/initramfs-tools/hooks/crypt_unlock.sh

#!/bin/sh

PREREQ="dropbear"

prereqs() {
  echo "$PREREQ"
}

case "$1" in
  prereqs)
    prereqs
    exit 0
  ;;
esac

. "${CONFDIR}/initramfs.conf"
. /usr/share/initramfs-tools/hook-functions

if [ "${DROPBEAR}" != "n" ] && [ -r "/etc/crypttab" ] ; then
cat > "${DESTDIR}/bin/unlock" << EOF
#!/bin/sh
if PATH=/lib/unlock:/bin:/sbin /scripts/local-top/cryptroot; then
kill \`ps | grep cryptroot | grep -v "grep" | awk '{print \$1}'\`
# following lines will be executed after the passphrase has been correctly entered
# kill the remote shell
kill -9 \`ps | grep "\-sh" | grep -v "grep" | awk '{print \$1}'\`
exit 0
fi
exit 1
EOF

  chmod 755 "${DESTDIR}/bin/unlock"

  mkdir -p "${DESTDIR}/lib/unlock"
cat > "${DESTDIR}/lib/unlock/plymouth" << EOF
#!/bin/sh
[ "\$1" == "--ping" ] && exit 1
/bin/plymouth "\$@"
EOF

  chmod 755 "${DESTDIR}/lib/unlock/plymouth"

  echo To unlock root-partition run "unlock" >> ${DESTDIR}/etc/motd

fi

Make it executable:

chmod +x /etc/initramfs-tools/hooks/crypt_unlock.sh

Create the cleanup script as /etc/initramfs-tools/scripts/init-bottom/cleanup.sh:

#!/bin/sh
echo "Killing dropbear"
killall dropbear
exit 0

...and make it executable:

chmod +x /etc/initramfs-tools/scripts/init-bottom/cleanup.sh

4. Create a static IP (or skip this step to use DHCP)

Edit /etc/initramfs-tools/initramfs.conf to add (or change) the line:

IP=192.168.1.254::192.168.1.1:255.255.255.0::eth0:off
format: 

    IP=${ip}::${gateway_ip}:${netmask}:[${hostname}]:${eth_device}:${autoconf}

([hostname] can be omitted)

In newer kernels eth0 is renamed to enp0s3 (or something like that). Check that out with ls /sys/class/net

5. Update initramfs

WARNING: Be careful if you directly edited /boot/grub/grub.cfg, since it will be overwritten by below command. You may end up with a broken boot sequence. See the important note.

update-initramfs -u

6. Test

  1. Reboot your server
  2. Connect to your server via ssh root@192.168.1.254 [-i ~/.ssh/id_rsa]

Advanced configuration

Create a Reverse Tunnel

You may want your SERVER to connect your Link Up Server with SSH, create a reverse tunnel to its SSH Server, so you can connect your SERVER over your Link Up Server, which eliminates the need for firewall forwarding for above process.

(see reverse-tunnel-setup.md)

Run Dropbear on additional ports

(based on https://askubuntu.com/a/840067/371730)

  1. Define extra ports:

    --- /usr/share/initramfs-tools/scripts/init-premount/dropbear   2018-09-22 01:55:50.963967412 +0300
    +++ /usr/share/initramfs-tools/scripts/init-premount/dropbear   2018-09-22 01:56:04.091945164 +0300
    @@ -26,7 +26,7 @@
    -    exec /sbin/dropbear $DROPBEAR_OPTIONS -Fs
    +    exec /sbin/dropbear $DROPBEAR_OPTIONS -Fs -p 22 -p 80
    
  2. Update initramfs:

    update-initramfs -u
    

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.