11

I'm a long-time Linux user, but I'm not well-versed with the newer developments, esp. wrt Ubuntu and system(d) administration.

I have a very old PC that I want to use for a file server, Mercurial repo, FTP and WWW server, and a few other small company-internal webapps I made with Django. Previously this all ran on an ancient Fedora, on an unencrypted disk, and all was launched from /etc/rc.local.

I've put a new HDD, and got Ubuntu 18.04 LTS on it. I'm now onto restoring the services, but I want to improve as well.

First, I want the valuable data (Django database, files in the file server, ...) to be on an encrypted partition. However my experience with disk encryption is that something asks you for the passphrase during bootup. I want to avoid that, since the server won't have a monitor or a keyboard attached. Second, I want to administer the services in a bit more official ("Ubuntian") way.

Current idea

  • have the services' data on an encrypted partition, that is not listed in /etc/fstab.
  • upon restart, the server will only have sshd, but the services won't be started and partition not mounted.
  • I'd ssh to the machine, and run a script, that mounts the partition (asking me for the passphrase), and launches the services.

The machine is on an UPS, I expect to run the above procedure rarely (few times a year).

Question

Is the current idea any good? Better ways to do it?

If it's good, how to implement it? I can certainly go the "total DIY way" and write a huge script with the luks commands, iptables commands to open the ports, and invoke the services' daemons directly, but I want to learn something new here and do it the proper Ubuntu way™ :)

Any pointers or code/script examples are kindly appreciated!

2
  • I have a similar setup on my nas using Openmediavault as my OS, which has a LUKS encryption addon. With that addon you can mount the encrypted disks from the web page. Another idea would be to have the decryption keyfile on a USB stick that you can attach or detach as you wish.
    – pLumo
    Commented Aug 25, 2020 at 13:03
  • Hmm, yeah, whether the mounting is done via SSH or a webpage, that's similar, and indeed a webpage can be a bit more convenient. I don't like the USB stick idea though, the whole point of the encryption is to keep the data secure in the event of a burglary in the office.
    – anrieff
    Commented Aug 25, 2020 at 15:55

1 Answer 1

13

Remote unlocking of encrypted partition

There is a easy and more or less standard way to unlock encrypted partitions on start-up, without modification of the root-partition. It requires dropbear, busybox and dropbear-initramfs.

$ sudo apt install dropbear busybox dropbear-initramfs

Add busybox to initramfs

To enable busybox in the initial RAM disk, set BUSYBOX=y in /etc/initramfs-tools/initramfs.conf. The dropbear SSH host keys are stored in the /etc/dropbear-initramfs or /etc/dropbear/initramfsfolder (since Ubuntu 22.04).

Add public keys to authorized_keys of dropbear

There is no user management in the initial RAM disk, so only the root-user with a public key in the /etc/dropbear-initramfs/authorized_keys can login via ssh. You can add any public or simply copy the one of your user:

$ sudo cp ~/.ssh/authorized_keys /etc/dropbear/initramfs/authorized_keys

Warning: Some older dropbear versions do not support ed25519 keys.

Update initramfs with dropbear keys

After that, initial RAM disk needs to be updated:

$ sudo update-initramfs -u

That's it, now reboot the system and wait for the cryptsetup dialog.

Unlocking the system remotely

After the reboot, the system will wait for the unlocking of the encrypted device. Login via ssh with the root user and the corresponding private key.

# From a remote system
$ ssh -i ~/.ssh/my_private.id_rsa [email protected]
Enter passphrase for key '~/.ssh/my_private.id_rsa':


BusyBox v1.30.1 (Ubuntu 1:1.30.1-4ubuntu6.1) built-in shell (ash)
Enter 'help' for a list of built-in commands.

#
# cryptroot-unlock
Please unlock disk ubuntu-root:
cryptsetup: ubuntu-root set up successfully
# Connection to my.system.waiting.for.a.password.com closed by remote host.
Connection to my.system.waiting.for.a.password.com closed.

And the system will start with unlocked root device.

Update for Ubuntu 22.04

Brough up by Sjors Provoost - This approach stop working in Ubuntu 22.04. The reason behind is the change in the package dependencies of dropbear-initramfs. In 20.04 this packages was a recommend, in 22.04 it is a suggest. As a result, the packages will not be installed without explicit selection. In addition to that, the position of the dropbear keys changed from /etc/dropbear-initramfs to /etc/dropbear/initramfs --> Update included in answer.

14
  • Wouldn't this require two separate ssh keys to login to the box, depending on whether it's stuck in initramfs, or already logged in? Please note I don't require that the OS (root) partition be encrypted, only the data partition.
    – anrieff
    Commented Aug 26, 2020 at 13:34
  • No, you can use the same RSA key for both, however the user name is different. If you just need the data partition to be encrypted, you can just login with the root user and mount it... Commented Oct 14, 2020 at 23:09
  • Yes, just the data partition. The question is more about how to do the mounting & starting of services in an official way, not a hacky script that just runs the needed commands (of course that's always a valid Plan B)
    – anrieff
    Commented Oct 15, 2020 at 7:45
  • 1
    Error messages cannot be stored in this early stage of the boot process (disk encrypted and not mounted). You should ask this in e separate questions... the comment section is not helpful for solving this. Commented May 24, 2022 at 18:55
  • 1
    @Harry, no that is not possible, because the kernel and initrd image, which is handling the encryption is in /boot. From a security perspective, this should not be an issue, because the kernel is singed (cannot be altered) and there is nothing "secrete" in the kernel or initrd image. Same is true for /boot/efi Commented Jan 18, 2023 at 20:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .