1

I want to unlock an encrypted LVM at startup on a headless Ubuntu 16.04 server. This is a fairly fresh install. The only installs I have done are mate-desktop, xrdp, dropbear, and busybox. My client is PuTTY on a Windows machine. I am fairly new to Linux, but here is the progress I have made:

  1. Installed dropbear and busybox

  2. Used puttygen to generate a key pair

  3. Copied public key to ~/.ssh/authorized_keys and set proper permissions (700 on directory, 600 on file)

  4. Copied public key to /etc/initramfs-tools/root/.ssh/authorized_keys and set proper permissions (700 on directory, 600 on file)

  5. Confirmed my keys are good by successfully connecting to normal user session via PuTTY using key authentication

  6. Created the script and modified the config files as outlined at this link

    (Note: I did not perform step 8, but my /var/log/auth.log file did not contain the errors showcased in the Troubleshoot section of that blogpost if step 8 is not performed.)

  7. Updated initramfs

When the system boots and shows the graphical LUKS unlock prompt, I get no response from the server when I try to connect via PuTTY. The connection times out. I have not been able to find any resources that deal with dropbear/busybox not running on boot. I am certain that if I could get a response, my key would work and I could unlock without problems.

How can I find out why dropbear/busybox isn't running at boot?

(For clarification, I can still unlock at the server and SSH into user session.)

2

After what feels like an eternity of deep diving into Google and trial and error, I finally got this figured out.

Here are the steps I took relative to the steps I outlined in the question:

  1. Removed the script in the blogpost referenced in the question
  2. In the crossfire of trial and error, ended up removing ifconfig eth0 0.0.0.0 down from usr/share/initramfs-tools/scripts/init-bottom/dropbear that step 6 in the blogpost outlined; I never added it back but never needed it
  3. Modified and added the following scripts from this post:

    # Comment lines in /usr/share/initramfs-tools/scripts/local-top/cryptroot as follows:
    #
    if [ -z "$cryptkeyscript" ]; then
    cryptkey="Unlocking the disk $cryptsource ($crypttarget)\nEnter passphrase: "
    #if [ -x /bin/plymouth ] && plymouth --ping; then
    # cryptkeyscript="plymouth ask-for-password --prompt"
    # cryptkey=$(echo -e "$cryptkey")
    #else
    cryptkeyscript="/lib/cryptsetup/askpass"
    #fi
    fi
    
    
    
    # Add /usr/share/initramfs-tools/hooks/cryptroot_unlock and make executable
    #
    # Prompt to unlock LUKS encrypted root partition remotely
    #
    # See linked post for sources and acknowledgements
    #
    #!/bin/sh
    PREREQ=""
    prereqs()
    {
    echo "$PREREQ"
    }
    case $1 in
    prereqs)
    prereqs
    exit 0
    ;;
    esac
    . /usr/share/initramfs-tools/hook-functions
    #
    # Begin real processing
    #
    SCRIPTNAME=unlock
    # 1) Create script to unlock luks partitions
    cat > ${DESTDIR}/bin/${SCRIPTNAME} << '__EOF'
    #!/bin/sh
    /lib/cryptsetup/askpass "Enter volume password: " > /lib/cryptsetup/passfifo
    __EOF
    chmod 700 ${DESTDIR}/bin/${SCRIPTNAME}
    # 2) Enhance Message Of The Day (MOTD) with info how to unlock luks partition
    cat >> ${DESTDIR}/etc/motd << '__EOF'
    To unlock root-partition run "${SCRIPTNAME}"
    __EOF
    
    
    
    # Add /usr/share/initramfs-tools/scripts/local-bottom/dropbear_kill_clients and make executable
    #
    #
    # Kills all DropBear client sessions if InitRAMFS is left
    #
    # See linked post for sources and acknowledgements
    #
    #!/bin/sh
    PREREQ=""
    prereqs()
    {
    echo "$PREREQ"
    }
    case $1 in
    prereqs)
    prereqs
    exit 0
    ;;
    esac
    #
    # Begin real processing
    #
    NAME=dropbear
    PROG=/sbin/dropbear
    # get all server pids that should be ignored
    ignore=""
    for server in `cat /var/run/${NAME}*.pid`
    do
    ignore="${ignore} ${server}"
    done
    # get all running pids and kill client connections
    for pid in `pidof "${NAME}"`
    do
    # check if correct program, otherwise process next pid
    grep -F -q -e "${PROG}" "/proc/${pid}/cmdline" || {
    continue
    }
    # check if pid should be ignored (servers)
    skip=0
    for server in ${ignore}
    do
    if [ "${pid}" == "${server}" ]
    then
    skip=1
    break
    fi
    done
    [ "${skip}" -ne 0 ] && continue
    # kill process
    echo "$0: Killing ${pid}..."
    kill -KILL ${pid}
    done
    

After modifying and adding those scripts, dropbear was able to start, but my network device was failing to connect to the network, so I was still unable to connect to the server.

I finally discovered by using ls /sys/class/net that my network adapter was not called eth0; apparently that is an old notation no longer used by recent versions of Ubuntu, and since all the posts I have found are old if not ancient, eth0 is all I found references to.

So, armed with that information and a few more snippets I found from other sources, I modified initramfs.conf as follows:

  1. Modified the DEVICE= portion of /etc/initramfs-tools/initramfs.conf to read:

    DEVICE=<name of network adapter discovered using ls /sys/class/net>
    IP=<Static IP Address>::<Default Gateway>:<Subnet Mask>::<name of network adapter>:off
    
  2. Updated initramfs (sudo update-initramfs -u)

Now dropbear connects to the network and I can connect to the server and unlock remotely.

0

I was banging my head over this for almost a week with all the bad information out there (like just installing dropbear-initramfs).

Here is a script I wrote to setup and configure dropbear automatically for 16.0.4.

Be sure you read the code comments and tailor the script to your system!

#!/bin/bash
## LUKS remote decrypt for Ubuntu 16.04.1 - by BinaryShrub

# NOTES:
# Tailor lines 67 - 69 to your system before running!
# Use at your own risk!

# Safety Check
if [ "$EUID" -ne 0 ]
  then echo "You must run this as root"
  exit
fi

# Install Dropbear
apt -y install dropbear

# Setup authorized keys
mkdir -p /etc/initramfs-tools/root/.ssh
echo "Insert client id_rsa.pub (Leave empty to use ~/.ssh/authorized_keys):"
read -e r  
if [[ -z "$r" ]]; then
    cp ~/.ssh/authorized_keys /etc/initramfs-tools/root/.ssh/authorized_keys
else
    echo "$r" >> /etc/initramfs-tools/root/.ssh/authorized_keys
fi

# Add hook to create unlocker script
f=/usr/share/initramfs-tools/hooks/dropbear-unlocker
cat <<\END > "$f"
#!/bin/sh

PREREQ="dropbear"

prereqs() {
    echo "$PREREQ"
}

case "$1" in
    prereqs)
        prereqs
        exit 0
    ;;
esac

. "$CONFDIR/initramfs.conf"
. /usr/share/initramfs-tools/hook-functions

# Copy dropbear if explicitly enabled, or in case of a cryptroot setup if not explicitly disabled
[ "$DROPBEAR" = y ] || [ "$DROPBEAR" != n -a -r /etc/crypttab ] || exit 0

if [ ! -x "/usr/sbin/dropbear" ]; then
    if [ "$DROPBEAR" = y ]; then
        echo "dropbear-unlock: FAILURE: Dropbear not found, script wont start!" >&2
    else
        echo "dropbear-unlock: WARNING: Dropbear not found, script wont start" >&2
    fi
    exit 0
fi

# Copy the unlock script
s="$DESTDIR/$(ls $DESTDIR | grep root)/unlocker"
echo "#!/bin/sh

# Ask for decrypt key with one disk
# /scripts/local-top/cryptroot
# With Multiple Disks
/sbin/cryptsetup luksOpen /dev/sda3 sda3_crypt
/sbin/cryptsetup luksOpen /dev/sdb3 sdb3_crypt
/sbin/cryptsetup luksOpen /dev/sdc3 sdc3_crypt

# Hack to address https://goo.gl/2fGjCY
mknod /dev/btrfs-control c 10 234
btrfs device scan

# Kill these programs to keep 'init' moving.
echo "Loading OS..."
kill -9 \$(ps | grep cryptsetup | grep askpass | awk '{print \$1}') > /dev/null
kill -9 \$(ps | grep /bin/sh | grep cryptroot | awk '{print \$1}') > /dev/null
exit 0
" > "$s"

chmod +x "$s"

echo "unlocker: loaded"
END

chmod +x "$f"

# Rebuild initramfs
update-initramfs -u

echo "Done! Reboot to initramfs and run ~/unlocker"

https://gist.github.com/BinaryShrub/0587b170dc22b1e7ff7b435c92b53093

  • 1
    Welcome to Ask Ubuntu! I recommend editing this answer to expand it with specific details about how to use this. (See also How do I write a good answer? for general advice about what sorts of answers are considered most valuable on Ask Ubuntu.) – David Foerster Sep 24 '16 at 8:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.