LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Slackware
User Name
Password
Slackware This Forum is for the discussion of Slackware Linux.

Notices

Reply
 
Search this Thread
Old 02-27-2013, 04:53 AM   #1
natharran
Member
 
Registered: Jul 2012
Location: Czech Republic
Distribution: Slackware64 14.1
Posts: 34

Rep: Reputation: Disabled
Question Can't unlock LUKS volume with a keyfile during boot


Guys, please, help.

I have a LUKS device with LVM on it. I unlock that with a passphrase every time I boot but since it's quite uncomfortable I decided to start using a keyfile. However, nothing I do works.

I created a keyfile with
Code:
dd if=/dev/urandom of=/boot/key.luks bs=4096 count=1
as Alien Bob suggested here and stored it to my /boot partition on /dev/sda2 with ext4 (not that it makes any sense, after testing, I'll move it to a usb stick, or similar). Then I added this keyfile to a LUKS header by
Code:
cryptsetup -v --key-slot 1 luksAddKey /dev/sda3 /boot/key.luks
and got a confirmation.

Next I ran mkinitrd. I read it's man and assigned my /dev/sda2 a BOOT label by e2label. So now it is
Code:
mkinitrd -c -k 3.4.33 -m ext4 -f ext4 -r /dev/encrypted/root -h /dev/encrypted/swap -C /dev/sda3 -K LABEL=BOOT:/key.luks -L
The -K option is the only new parameter compared to what I used before.

But it simply doesn't work. During boot I'm still being asked for a password. I googled the web, searched this forum, but found nothing except that what I do should work.

What am I missing?
 
Old 02-27-2013, 06:45 AM   #2
Alien Bob
Slackware Contributor
 
Registered: Sep 2005
Location: Eindhoven, The Netherlands
Distribution: Slackware
Posts: 5,334

Rep: Reputation: Disabled
Are you the same person as "yenn" in that other thread or is it co´ncidence that you're both Czech?

Looking at your explanation, I wonder if you configured /etc/lilo.conf for the use of your initrd.gz and also, it is not clear if you ever ran "lilo" after creating the initrd.

Eric
 
Old 02-27-2013, 12:30 PM   #3
yenn
Member
 
Registered: Jan 2011
Location: Czech Republic
Distribution: Slackware, Gentoo, FreeBSD
Posts: 160

Rep: Reputation: 21
We are different people, it's just coincidence. Weird one indeed...

My guess is you saved key on ext4 partition and acording to this post (https://www.linuxquestions.org/quest...3/#post4505106) ext (whatever version) can't be used for that. Mknitrd can only use VFAT partition.

Important line is:
Quote:
First of all: the use of a LUKS keyfile on a USB stick for booting a fully encrypted Slackware system only works if the USB key has a (V)FAT filesystem. If the USB stick has your LUKS keyfile on an ext partition then it will not work.
I'm not sure where does this came from as it definitely isn't present in README.mkinitrd, but maybe we should include it in that readme and manpage of mkinitrd (see https://www.linuxquestions.org/quest...3/#post4505130) to avoid confusion.

And maybe I could write article about this on SlackDocs

Last edited by yenn; 02-27-2013 at 12:31 PM. Reason: minor correction
 
Old 02-27-2013, 03:00 PM   #4
natharran
Member
 
Registered: Jul 2012
Location: Czech Republic
Distribution: Slackware64 14.1
Posts: 34

Original Poster
Rep: Reputation: Disabled
We are, indeed, two people from CZ .
Quote:
Originally Posted by Alien Bob View Post
...Looking at your explanation, I wonder if you configured /etc/lilo.conf for the use of your initrd.gz and also, it is not clear if you ever ran "lilo" after creating the initrd.

Eric
I've been using this LVM / LUKS solution for some time now and I don't know of any other way to do this than by using initram disk (but perhaps I'm just uninformed). So yes, I configured /etc/lilo.conf to load /boot/initrd.gz a ran lilo after every change .

Quote:
My guess is you saved key on ext4 partition and acording to this post (https://www.linuxquestions.org/quest...3/#post4505106) ext (whatever version) can't be used for that. Mknitrd can only use VFAT partition.
Yeah, my /boot is on ext4 partition. Thanks, I didn't know I can only use VFAT. It also explains why it didn't work with my NTFS external hdd.

Thank you both guys and sorry for lame question, I should have googled more, obviously. However, it would be nice if mkinitrd man page contained this information. Right now the FAT filesystem is only mentioned as an example, not as a necessity.

My regards to USA and back to CZ .

-natharran
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Unlock LUKS encrypted partition with USB drive yenn Slackware 4 02-26-2013 05:39 PM
[SOLVED] can't unlock luks home when booting gorillus Slackware 4 01-16-2012 06:39 PM
[SOLVED] How to unlock (Luks) encrypted root, during boot, when key-file is on USB?? pizzar0 Slackware 2 10-22-2011 08:14 AM
LXer: How to set up an auto-mounted keyfile based luks partition for your home direct LXer Syndicated Linux News 0 02-13-2009 07:50 AM
LXer: Automatically Unlock LUKS Encrypted Drives With A Keyfile LXer Syndicated Linux News 0 07-09-2008 04:40 PM


All times are GMT -5. The time now is 06:01 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration