0

Iam trying to unlock/automount the root on my ubuntu 18.04 luks cryptsetup installation with a USB drive during boot.

With the script attached or a similar version it was already working a few weeks ago (cant recall as my drive had a hardware failure, so working off a backup which maybe has some substantial flaw as it was work in progress at time of the backup).

Maybe somebody here can help me to fix it, i have tried so many variations now and got stuck.

There aren't any up to date documentations i can find on the web, hope what i got here is close enough ....

#!/bin/bash

# https://www.oxygenimpaired.com/ubuntu-with-grub2-luks-encrypted-lvm-root-hidden-usb-keyfile # some lines taken from this link, its a bit dated tough.

#REPRODUCE START
# 1. install 18.04 with luks lvm default , set user to autologin
# 2. reboot after finished install, dont plugin any drives or main cryptoroot may end up on another part than sda3
# 3. after the new os is booted plugin the drive with this script so it ends up at sdb1
# 4. plugin the usb to be used as decrypt key so it ends up on sdc
# 5. run "sudo su" to enter root && run this script
#REPRODUCE END


# Ubuntu with Grub2 + LUKS encrypted LVM root + hidden USB keyfile
CRYPT_USB=sdc # change this for entire doc, cant use variables for the entire doc # usb drive to be used to decrypt the root
MAIN_PART=sda3 # default 18.04 cryptsetup root # change this for entire doc, cant use variables for the entire doc
UNLOCKUSB1=/lib/cryptsetup/scripts/unlkusb.sh # unlockfile

READADDKEY () { # previously filled with dev random
dd if=/dev/$CRYPT_USB of=/root/luks-secret.key bs=512 skip=4 count=8
cryptsetup luksAddKey /dev/$MAIN_PART /root/luks-secret.key --key-slot 1
shred --remove --zero /root/luks-secret.key
} # CREATE KEY END


CREATERULESFILE () {
GREP_SERIAL_CRYPT_USB=$(udevadm info -a -p `udevadm info -q path -n /dev/sdc` | grep ATTRS{serial} | head -n 1 | sed -e "s/    //g" )
#echo 'SUBSYSTEMS=="usb", ATTRS{serial}=="000A000A000x", KERNEL=="sd*", SYMLINK+="usbkey%n"' | sed -e 's/ATTRS{serial}=="//g' | sed -e 's/x"//g' | sed -e "s/000A000A000/$GREP_SERIAL_CRYPT_USB/g"  > /etc/udev/rules.d/99-unlock-luks.rules
#echo 'SUBSYSTEMS=="usb", ATTRS{serial}=="000A000A000x", DRIVERS=="usb", SYMLINK+="usbkey%n"' | sed -e 's/ATTRS{serial}=="//g' | sed -e 's/x"//g' | sed -e "s/000A000A000/$GREP_SERIAL_CRYPT_USB/g"  > /etc/udev/rules.d/99-unlock-luks.rules
echo 'SUBSYSTEMS=="usb", ATTRS{serial}=="000A000A000x", KERNEL=="sd*", DRIVERS=="usb", SYMLINK+="usbkey%n"' | sed -e 's/ATTRS{serial}=="//g' | sed -e 's/x"//g' | sed -e "s/000A000A000/$GREP_SERIAL_CRYPT_USB/g"  > /etc/udev/rules.d/99-unlock-luks.rules

udevadm control --reload-rules # 4) Reload udev rules with:
# 5 ) Test that /dev/usbkey is created when the usb stick is inserted.
} # CREATE UDEV RULE END


CREATEUNLOCKFILE () {
touch $UNLOCKUSB1

cat << 'EOF' > $UNLOCKUSB1
#!/bin/sh
TRUE=0
FALSE=1
OPENED=$FALSE # flag tracking key-file availability

cat /proc/modules | busybox grep usb_storage >/dev/null 2>&1 # check and modprobe the USB driver if not already loaded
USBLOAD=0$?
if [ $USBLOAD -gt 0 ]; then
modprobe usb_storage >/dev/null 2>&1
fi

sleep 20 # give the system time to settle and open the USB device

if [ -b /dev/usbkey ]; then # check for the specifc /dev/usbkey device created by udev using /etc/udev/rules.d/99-unlock-luks.rules
dd if=/dev/usbkey bs=512 skip=4 count=8 | cat # if device exists then output the keyfile from the usb key (hidden key is 4096 bytes long starting at 2048 bytes)
OPENED=$TRUE
fi

# something isnt working here, if usb fails there is no pass prompt
if [ $OPENED -ne $TRUE ]; then
echo 'FAILED to get USB key file ...'
#if [ -x /bin/plymouth ] && plymouth --ping; then
#plymouth ask-for-password --prompt "Enter passphrase"
#else
/lib/cryptsetup/askpass "Enter passphrase"
#fi
else
echo "Success loading key file. Moving on." 
fi

sleep 1
exit 0

EOF

chmod a+x $UNLOCKUSB1
}


CREATECRYPTTAVFILE () {
echo "sda3_crypt /dev/disk/by-uuid/$(blkid -o value -s UUID /dev/$MAIN_PART) none luks,keyscript=$UNLOCKUSB1" > /etc/crypttab
}


CREATECRYPTOROOTFILE () {
echo "CRYPTROOT=target=sda3_crypt,source=/dev/disk/by-uuid/$(blkid -o value -s UUID /dev/$MAIN_PART)" > /etc/initramfs-tools/conf.d/cryptroot
}


ADDINITRAMFS_MODULES () {
if [ $(cat /etc/initramfs-tools/modules | grep -c "usb_storage") -eq 0 ]; then
echo "usb_storage" >> /etc/initramfs-tools/modules
fi
if [ $(cat /etc/initramfs-tools/modules | grep -c "sha256") -eq 0 ]; then
echo "sha256" >> /etc/initramfs-tools/modules
fi
if [ $(cat /etc/initramfs-tools/modules | grep -c "aes-x86_64") -eq 0 ]; then
echo "aes-x86_64" >> /etc/initramfs-tools/modules
fi
if [ $(cat /etc/initramfs-tools/modules | grep -c "aes_generic") -eq 0 ]; then
echo "aes_generic" >> /etc/initramfs-tools/modules
fi
if [ $(cat /etc/initramfs-tools/modules | grep -c "crypto_api") -eq 0 ]; then
echo "crypto_api" >> /etc/initramfs-tools/modules
fi
if [ $(cat /etc/initramfs-tools/modules | grep -c "dm-crypt") -eq 0 ]; then
echo "dm-crypt" >> /etc/initramfs-tools/modules
fi
if [ $(cat /etc/initramfs-tools/modules | grep -c "scsi_dh") -eq 0 ]; then
echo "scsi_dh" >> /etc/initramfs-tools/modules
fi
if [ $(cat /etc/initramfs-tools/modules | grep -c "usbcore") -eq 0 ]; then
echo "usbcore" >> /etc/initramfs-tools/modules
fi
if [ $(cat /etc/initramfs-tools/modules | grep -c "usbhid") -eq 0 ]; then
echo "usbhid" >> /etc/initramfs-tools/modules
fi
}


CRATEUDEVUSBKEYHOOK () {
touch /etc/initramfs-tools/hooks/udevusbkey
cat << 'EOF' > /etc/initramfs-tools/hooks/udevusbkey
#!/bin/sh
# udev-usbkey script

PREREQ="udev"
prereqs()
{
echo "$PREREQ"
}


case $1 in
prereqs)
prereqs
exit 0
;;
esac

. /usr/share/initramfs-tools/hook-functions

cp /etc/udev/rules.d/99-unlock-luks.rules ${DESTDIR}/lib/udev/rules.d/ # Copy across relevant rules

exit 0

EOF

chmod a+x /etc/initramfs-tools/hooks/udevusbkey
}


SETUPGRUB () {
#sed -ie "s#quiet splash#cryptopts=target=sda3_crypt,source=/dev/disk/by-uuid/$(blkid -o value -s UUID /dev/$MAIN_PART),lvm=xubuntu-vg,keyscript=$UNLOCKUSB1#g" /etc/default/grub
#sed -ie "s#quiet splash#cryptopts=target=sda3_crypt,source=/dev/disk/by-uuid/$(blkid -o value -s UUID /dev/$MAIN_PART),lvm=/dev/mapper/xubuntu--vg-root,keyscript=$UNLOCKUSB1#g" /etc/default/grub
sed -ie "s#quiet splash#cryptopts=target=sda3_crypt,source=/dev/disk/by-uuid/$(blkid -o value -s UUID /dev/$MAIN_PART),lvm=xubuntu--vg-root,keyscript=$UNLOCKUSB1#g" /etc/default/grub
#sed -ie "s#quiet splash#ipv6.disable=1 cryptopts=target=sda3_crypt,source=/dev/disk/by-uuid/$(blkid -o value -s UUID /dev/$MAIN_PART),lvm=vg-your-root,keyscript=/lib/cryptsetup/scripts#g" /etc/default/grub
update-grub
}


UPDATEINIRAMFS () {
update-initramfs -u -k all
}


CHECKFILES() {
ls -la $UNLOCKUSB1
ls -la /etc/initramfs-tools/hooks/udevusbkey
ls -la /etc/udev/rules.d/99-unlock-luks.rules
ls -la /dev/usbkey && echo "if this fails, the usb maybe has to be replugged"
ls -la /etc/initramfs-tools/conf.d/cryptroot
cat /etc/crypttab
cat /etc/default/grub | grep GRUB_CMDLINE_LINUX_DEFAULT=
cat /etc/initramfs-tools/modules
cryptsetup luksDump /dev/sda3
}


READADDKEY
CREATERULESFILE
CREATEUNLOCKFILE
CREATECRYPTTAVFILE
CREATECRYPTOROOTFILE
ADDINITRAMFS_MODULES
CRATEUDEVUSBKEYHOOK
SETUPGRUB
UPDATEINIRAMFS
CHECKFILES

after reboot, this is what grub prints

New contributor
Aurigae is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

Aurigae is a new contributor. Be nice, and check out our Code of Conduct.

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.