usb stick unlocking scheme for root encrypted partition in current
In slackware{,64}-current, the mkinitrd script now has a -K switch that should allow to unlock a LUKS encrypted root filesystem with a keyfile on a removable usb stick. I have been trying to use it on my LVM + LUKS setup without any success so far. I was just wondering if someone has successfully tested that new option. Thanks!
|
Yep, I've had it working. It took a bit of trial and error to get the modules right. Here's my initrd building script if it's any use to you:
Code:
root@nix:~/changes# cat 001_mkinitrd.sh I prefer to do it this way rather than use mkinitrd.conf. The above should give you a pointer in the right direction. Obviously, you'll need to create a keyfile and add it to a slot using cryptsetup before this'll work. |
Thanks GazL! The -K switch now takes care of putting the right modules in load_kernel_modules and it also puts the usb stick label in lukskey with the right path. So, it does exactly what your script is doing. For instance, this is what I have in my load_kernel modules after adding -K LABEL=ESCSTICK:/keys/escfree in the mkinitrd command:
Code:
insmod -v /lib/modules/$(uname -r)/kernel/drivers/hid/hid.ko Code:
LABEL=ESCSTICK:/keys/escfree Code:
5 |
Ahh ok, It's been a while since I played with it, so it may be a little friendlier now. :)
I'm fairly sure my usb stick need the generic scsi "sg" module too, but that may just be due to the type of device it is. (I notice it's not in your list). Did you add your new file based key to a slot with "cryptsetup luksAddKey"? I kept my passphrase in slot0 (just in case I lose the keyfile somehow) and added the keyfile to slot1. |
Quote:
|
Quote:
Other than trying adding that 'sg' module, I can't think of much else. I guess you need to look for clues in the boot messages you get before it prompts you for the passphrase to try and figure out why it can't see your stick. If it's any consolation, when I first started playing with this it took a little while to get it right for me too. |
Quote:
|
All times are GMT -5. The time now is 05:58 PM. |