28

Goal

I am looking for non interactive way to decrypt a root file partition and a swap partition encrypted with LUKS the next time the system reboots. As well as this, I need a way to undo it after the reboot so that it after one more reboot will require the password again (or even a new password).

The system uses LVM.

I don't want to have to type the password on the system, or use a different system to unlock it, it has to unlock itself that one time.

I have the password it is encrypted with, and would be willing to save it in cleartext on the harddrive. I am not concerned with security at this step.

Background

I have a flow for deploying Ubuntu that is based on an Ubuntu server installation with a custom preseed and kickstart file, kickstart installs a service that run after the first reboot (and only the first reboot) and then reboots again. I am trying to implement LUKS disc encryption in this flow, but I need it to remain non interactive, so it has to be able to restart the first time without a password.

The password set during installation is temporary and will be changed by the service that runs after the first reboot, so the first password can be stored in clear text.

Things I have looked into before posting this question

I have done my fair bit of Googling to try and figure this one out, and most of what I find point towards a solution that swaps out the initramfs file.

I have found multiple resources that explain how to use this to allow for remote unlocking the system, but I need to do it without interaction. Here is one such resource: https://hamy.io/post/0005/remote-unlocking-of-luks-encrypted-root-in-ubuntu-debian/

The closest thing to a solution I think I have found, is this resource which is supposedly a way of accomplishing what I want for a VPS solution, but it is just a bunch of commands with no explanation, and I don't know how to adapt it: https://dradisframework.com/pro/support/guides/customization/auto-unlock-luks-encrypted-drive.html

I also found this resource for ArchLinux https://wiki.archlinux.org/index.php/Dm-crypt/System_configuration#cryptkey, and I have tried adding the kernel parameters, but I have not had any luck with that either. I don't know if it is because LUKS does not support these kernel parameters.

6
  • the first link, with the dropbear-ssh server, seems very close to what you want. It should be trivial to add a line to your scripts that executes ssh -o "HostKeyAlgorithms ssh-rsa" -p 4748 root@client-ip "cryptroot-unlock" after you boot/reboot the server Jan 18, 2018 at 16:31
  • 1
    I'm not sure I understand you, or perhaps I didn't make it clear enough, but there is only one computer involved in this process. Do you mean that I could somehow get it to start up with dropbear and initiate an ssh connection to itself? I want to be able to start the installation, and without any interaction on that computer, or from another computer, have it finish the installation, reboot, execute my service and reboot once more and be completely set up (protected by a password at this stage).
    – Tobias
    Jan 19, 2018 at 9:22
  • I'm sorry, I automatically assumed we are talking about some sort of virtualisation environment, where you would be able to execute this as some sort of post-deployment script... what kind of scenario are we talking about (besides kickstarter, and so on)? (The ssh to localhost would also be possible, but doing that automatically in initramfs seems counter productive) Jan 19, 2018 at 11:14
  • 1
    With a pair of extra eyes and a bit of more searching, I manged to find a solution. I will write it up an an answer. Thanks for taking your time though, Robert Riedl
    – Tobias
    Jan 19, 2018 at 11:37
  • Great ! I'm curious to see the solution ! Jan 19, 2018 at 11:39

2 Answers 2

30

The solution seems to be rather simple, and is sort of described in How to configure LVM & LUKS to autodecrypt partition?

Below is how I managed to do it. Please first note:

  • My /boot partition is /dev/sda1.

  • My LVM volume that I want to decrypt is /dev/sda3.

  • I was root, but if you're not, prepend sudo to all the commands.

Here are the actual steps to the solution:

  1. Start by making a keyfile with a password (I generate a pseudorandom one):

    dd if=/dev/urandom of=/boot/keyfile bs=1024 count=4
    
  2. Then set read permission for root and nothing for anyone else:

    chmod 0400 /boot/keyfile
    
  3. Then add the keyfile as an unlock key:

    cryptsetup -v luksAddKey /dev/sda3 /boot/keyfile
    

    You will then be prompted to type the encryption password.

  4. Find the UUID of the /boot partition with the following comamnd (this one doesn't require you be root):

    ls -l /dev/disk/by-uuid/
    

    Here's an example of what the output looks like (it's not the actual output as I grabbed this from another machine):

    $ ls -l /dev/disk/by-uuid/
    total 0
    lrwxrwxrwx 1 root root 10 Jan 15 03:36 025c66a2-c683-42c5-b17c-322c2188fe3f -> ../../sda2
    lrwxrwxrwx 1 root root 10 Jan 15 03:36 9e7a7336-3b81-4bbe-9f1a-d43415df1ccb -> ../../sda1
    
  5. Then edit /etc/crypttab with your favourite editor:

    nano /etc/crypttab
    

    The content will look something like this (again, this is from another machine):

    sda3_crypt UUID=025c66a2-c683-42c5-b17c-322c2188fe3f none luks,discard
    
  6. What you want to do, is replace none with /dev/disk/by-uuid/[the uuid of the /boot partition]:/keyfile and you want to replace discard with keyscript=/lib/cryptsetup/scripts/passdev.

    The result should look something like this:

    sda3_crypt UUID=025c66a2-c683-42c5-b17c-322c2188fe3f /dev/disk/by-uuid/9e7a7336-3b81-4bbe-9f1a-d43415df1ccb:/keyfile luks,keyscript=/lib/cryptsetup/scripts/passdev
    
  7. Save the file and proceed with updating the initramfs:

    update-initramfs -u
    
  8. That's it, you can now reboot:

    reboot
    

To remove it again (as I wanted to):

  1. First confirm that there are only two keys on the system (the original one and the new keyfile):

    cryptsetup luksDump /dev/sda3 | grep BLED
    

    This will generate an output similar to this:

    Key Slot 0: ENABLED
    Key Slot 1: ENABLED
    Key Slot 2: DISABLED
    Key Slot 3: DISABLED
    Key Slot 4: DISABLED
    Key Slot 5: DISABLED
    Key Slot 6: DISABLED
    Key Slot 7: DISABLED
    
  2. To delete the key in key slot 1 (the keyfile) run:

    cryptsetup luksKillSlot /dev/sda3 1
    
  3. You're then prompted to type the encryption password (the original one, not the one in the keyfile).

  4. Then delete the actual keyfile:

    rm /boot/keyfile
    
  5. Update initramfs again:

    update-initramfs -u
    
  6. Now when you reboot you will be prompted for a password again. You're done.

4
  • 2
    Wouldn't it be enough to disable the key slot so I can leave the keyfile and everything else in place for when I'll need it again? Then I'd just re-enable the key slot for 1 reboot and disable afterwards.
    – finefoot
    Oct 6, 2019 at 1:32
  • 2
    When I run lsblk /dev/sda I see that I have a /boot partition and a /boot/efi partition. Which one should I be using if I am following this method?
    – ITA
    Dec 11, 2019 at 21:30
  • @finefoot as far as I can tell there is no way to "disable" a key slot; all it means for a key slot to be "enabled" is for there to be a key in it. Also if you just remove the key but you don't remove the changes from /etc/crypttab then your system will fail to boot because it's configured to read the key from a file but that file no longer contains a valid key. Oct 28, 2022 at 16:59
  • In recent Ubuntu releases, /lib is a link to /usr/lib. You may need to update /lib/cryptsetup/scripts/passdev to the absolute path /usr/lib/cryptsetup/scripts/passdev. Thank you for the solution! Sep 30, 2023 at 8:42
3

Tobias's answer is great, but I wanted something easier to use. I didn't want to have to do all the configuration stuff by hand, and furthermore I wanted a way to easily configure my system for just the next reboot to happen without a passphrase being entered and then to automatically revert to requiring a passphrase.

I wrote keyless-entry to accomplish both of these goals. Enjoy!

1
  • Can you also add the installation instructions and the basic usage of your program to your answer so that it's more complete? Thanks! Sep 30, 2023 at 10:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .