Let me begin by saying I'm not new to LUKS. I've set up LUKS with keyscripts numerous times with and without LVM. I'm not sure what is actually going on here though. I have a system that has a single encrypted partition. My drive is organized as follows:

# lsblk

sda                8:0    0  128G  0 disk  
└─sda1             8:1    0  128G  0 part  
  ├─vg0-root     253:1    0   20G  0 lvm   /
  ├─vg0-secure   253:6    0  100M  0 lvm   
  │ └─secure     253:7    0   98M  0 crypt /root/secure
  └─vg0-swap     253:4    0    1G  0 lvm   [SWAP]

My /etc/crypttab file looks something like this

# UUID is not required here since the path to the LV won't change
secure      /dev/vg0/secure       none      luks,keyscript=/lib/cryptsetup/scripts/insecure

My /lib/cryptsetup/scripts/insecure file is executable and looks something like this

# My actual file looks somewhat different because it dumps the key file with dd.
# This accomplishes virtually the same thing though.

echo -n "my-encryption-password"

I have run update-initramfs -k all -u a number of times after configuring crypttab and putting my keyscript file in place.

As far as I can tell, my script file isn't even getting copied to the initrd.img file. Now that I think about it, I don't think it would get copied to the initrd.img file since the root partition is not encrypted and the script file should be easily accessible from there.

Upon rebooting, the system sees the record from crypttab and asks for a password (which in my case doesn't actually exist because the only key is a keyfile full of random bits) rather than using the keyscript to unlock the LUKS partition. I have tried taking LUKS out of the LVM and putting it on sda2, and the results were the same. I also know that the keyscript works because cryptsetup luksOpen /dev/vg0/secure secure -d - <<< "$(/lib/cryptsetup/scripts/insecure)" works like a charm and decrypts my LUKS partition.

I've tried this in Ubuntu 16.04.2 and Ubuntu Mate 16.04.2 with the same results. I've used keyscripts before without any trouble. The only difference was that, in the past, my / partition was always encrypted. If anyone can shed some light, I'd appreciate it. I only want a very small encrypted partition because I plan on cloning this system, and I don't want to clone it with the entire / partition encrypted.

UPDATE 2017-04-26

In digging through logs, I found a line with the following error which makes no sense. Since when is 'keyscript=/path/to/script' an unknown option for crypttab?

... systemd-cryptsetup[737]: Encountered unknown /etc/crypttab option 'keyscript=/lib/cryptsetup/scripts/insecure', ignoring.

Just for kicks, I tried removing the keyscript option and using a keyfile, and it all just worked! In fact, I tried other options like keyfile-offset, and they work too. Hence, the problem lies somewhere with the keyscript option. Does anyone have any idea why?

  • 3
    I think systemd is your problem. A quick google for systemd and keyscript shows a bug and a pull request for implementing keyscript in systemd here. There's even a workaround available from the first link. – sergtech Apr 27 '17 at 10:01
  • This has been my suspicion as well as I have continued digging into my issue and searching results I've found online. I tried some recommendations here, but I'm not sure how to get the script file into the initrd. – b_laoshi Apr 28 '17 at 5:37

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.