I'm trying to unlock a headless server running an encrypted version of Ubuntu 14.04. It is a clean 14.04.2 install with all updates as of writing.
I went thtrough the standard shenanigans with
# INSTALL sudo apt-get install dropbear busybox # on server # ENABLE AND CONFIGURE IP sudo sed -i 's/NO_START=1/NO_START=0/g' /etc/default/dropber sudo sed -i 's/BUSYBOX=y/BUSYBOX=y\nDROPBEAR=y\n/g' \ /etc/iniramfs/iniramfs.conf sudo sed -i 's/DEVICE=.+/DEVICE=etho0/g' \ /etc/iniramfs/initramfs.conf sudo sed -i 's/IP=.+/IP=IP=192.168.0.11:::255.255.255.0::eth1:off' \ /etc/initramfs/initramfs.conf sudo update-initramfs # COPY DROPBEAR SSH KEY # WRONG: sudo cp /etc/dropbear/dropbear_*_host_key /tmp sudo cp /etc/initramfs-tools/root/.ssh/id_rsa /tmp # BETTER! sudo chown $USER:$USER /tmp/id_rsa scp server:/tmp/id_rsa ~/.ssh/id_rsa_dropbear_server # on client sudo reboot # on server # CONNECT TO SERVER ssh -vv -i ~/.ssh/id_rsa_dropbear_server \ -o 'UserKnownHostsFile=~/.ssh/known_hosts.initramfs' \ firstname.lastname@example.org # on client
So I copied the auto-generated ssh-key and did a minimal configuration of dropbear. To my surprise
two three things are malfunctioning:
- The system ignores the IP settings. I found in my router's "connected devices" site, that the server has the ip
192.168.0.27despite my configuration. So I tried the listed wrong IP with:
ssh -vv -i ~/.ssh/dropbear_dss_host_key -o 'UserKnownHostsFile=~/.ssh/known_hosts.initramfs' email@example.com. That connects to dropbear but:
- Dropbear ignores all public keys other than its own in
/etc/initramfs-tools/root/.ssh/authorized_keys(tested with dss - maybe also rsa).
Dropbear wants a passphrase for the key, which I do not have. So I tried an empty passphrase. With which dropbear drops to password authentication and wants the root password, that is not set.
- Custom hook scripts seem to be partially ignored. These are scripts that worked in older install!
Here is the whole ssh session.
I added my usual public key file to dropbear's known hosts in the server's
/etc/initramfs-tools/root/.ssh/authorized_keys and tried to ssh with my usual key. That didn't work.
I added the line
GRUB_CMDLINE_LINUX_DEFAULT="ip=192.168.0.11::192.168.0.1:255.255.255.0::eth0:none" to the server's
/etc/default/grup and updated grup. That was meant to fix the IP issue. But that didn't work either.
I'm now thoroughly annoyed and at the end of my patience. Where did I go wrong? Also, is the syntax for the IP settings right because one guide says
::eth0:off and the next says
There is someone with what seems to be the same problem on 15.04.
I can now connect to the server. Turns out, I had copied the wrong private key to use with dropbear. The error has been corrected in my script above. But adding keys still doesn't work (i.e. to dropbear's
authorized_keys file). There's word you need to convert the public keys, that you want to add to
/etc/initramfs-tools/root/.ssh/authorized_keys to dropbear's format, but I don't want to spend time searching how. I only tried
dss public keys. Maybe dropbear just likes
Also I noticed, that custom hook scripts don't seem to work. They are not included in the initramfs' directories but
lsinitramfs -l /boot/initrd.img-3.16.0-43-generic lists them as part of the image. The IP settings are still ignored as well. Even if I add
GRUB_CMDLINE_LINUX_DEFAULT="ip=192.168.0.11::192.168.0.1:255.255.255.0::eth0:none" to the grubconfig in
/etc/default/grub and update everything.
So it seems that
/usr/lib/dropbear/dropbearconvert INPUTFORMAT OUTPUTFORMAT INFILE OUTFILE is the program to convert keys. The FORMAT parameter can be either
dropbear. But it doesn't seem that's the answer on how to add keys to the servers
/etc/initramfs-tools/root/.ssh/authorized_keys. The existing key there already is in openssh's public key file format. So adding other openssh-format keys shouldn't be a problem. Yet it is.