LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 12-16-2014, 09:10 AM   #1
muxman
Member
 
Registered: Apr 2004
Distribution: Debian
Posts: 203

Rep: Reputation: 32
debian luks root drive with usb keyfile help needed


I'm trying to install a system with an encrypted root system drive and use a keyfile on a usb drive to unlock via luks. I have vfat, nfat, nnls_cp437, and nnls_iso8859_1 modules set to load in the initramfs. I have luks setup with a keyscript that does run during boot time and the initramfs with these added modules is the one being used.

The problem is the keyscript is being run before the system has a chance to recognize the usb drive. Using the sleep command doesn't seem to work to delay the script. I've even tried using "busybox sleep 60" and it doesn't work either. I've tried long delays like 60 seconds so I could be sure they are runnig or not. The script seems to immediately execute so I'm sure there's not 60 second delay. Then when it fails to find the usb drive it fails over to a prompt for the password. While sitting at the prompt I can then see the usb drive being recognized by the system. I see the dmesg style info come up on the screen recognizing the drive. If the script would delay for even 10 seconds it would be able to execute after the system found the usb drive, mount the usb drive and get the key.

What am I missing that will allow the sleep command to work to delay the script from trying to mount a usb drive it hasn't found yet? Or can I delay the execution of the script itself by having the system try to mount the encrypted root fs later after the usb has been found? Is there a way to specify the order these things happen in the initramfs similar to how you can number init scripts on the system itself to execute in a certain order?

Let me know any other info you need to help with this. I'd appreciate any insight anyone may have to this.
 
Old 12-16-2014, 09:52 AM   #2
smallpond
Senior Member
 
Registered: Feb 2011
Location: Massachusetts, USA
Distribution: Fedora
Posts: 4,140

Rep: Reputation: 1263Reputation: 1263Reputation: 1263Reputation: 1263Reputation: 1263Reputation: 1263Reputation: 1263Reputation: 1263Reputation: 1263
Make sure your usb_storage module is either builtin or loaded by initramfs.

Another thing you could try is to set the computer to boot from USB. Put grub on the USB drive but set up the menu to get the kernel and root filesystem from HDD.
 
Old 12-16-2014, 11:40 AM   #3
muxman
Member
 
Registered: Apr 2004
Distribution: Debian
Posts: 203

Original Poster
Rep: Reputation: 32
Quote:
Originally Posted by smallpond View Post
Make sure your usb_storage module is either builtin or loaded by initramfs.

Another thing you could try is to set the computer to boot from USB. Put grub on the USB drive but set up the menu to get the kernel and root filesystem from HDD.
I've set the modules to be in the initramfs by adding them to the /etc/initramfs-tools/modules file. Then the script I use checks for them and modprobes them if they're not loaded.

The problem is that the script runs and doesn't respect the sleep command and doesn't slow it's execution to wait for the usb drive to be recognized by the system. I get the script failing to load the usb drive and falling back on it's password prompt on that failure, then I see the dmesg output of the usb drive being recognized far too late. Well after the script has tried to load it. That's why I need the script to sleep for a few seconds so the system can find the drive, then try to mount it.

My final option will be to put grub on the usb drive and boot from it. Any good tutorials on that? I've never done it before.
 
Old 12-17-2014, 02:51 AM   #4
veerain
Senior Member
 
Registered: Mar 2005
Location: Earth bound to Helios
Distribution: Custom
Posts: 2,524

Rep: Reputation: 319Reputation: 319Reputation: 319Reputation: 319
Try loading the modules you need with script itself like:

modprobe ehci ohci uhci usb-storage and other needed modules

you can see modules dependency using modinfo command
 
Old 12-17-2014, 09:15 AM   #5
muxman
Member
 
Registered: Apr 2004
Distribution: Debian
Posts: 203

Original Poster
Rep: Reputation: 32
Quote:
Originally Posted by veerain View Post
Try loading the modules you need with script itself like:

modprobe ehci ohci uhci usb-storage and other needed modules

you can see modules dependency using modinfo command
That's what my script already does, it modprobes the modules that are needed. First it checks for them and then modprobes them. Then I commented the check out and it just modprobes them.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Unlocking LUKS with keyfile on USB slaka Linux - Software 1 05-16-2014 03:04 PM
[SOLVED] Can't unlock LUKS volume with a keyfile during boot natharran Slackware 3 02-27-2013 02:00 PM
[SOLVED] How to unlock (Luks) encrypted root, during boot, when key-file is on USB?? pizzar0 Slackware 2 10-22-2011 07:14 AM
LXer: How to set up an auto-mounted keyfile based luks partition for your home direct LXer Syndicated Linux News 0 02-13-2009 06:50 AM
LXer: Automatically Unlock LUKS Encrypted Drives With A Keyfile LXer Syndicated Linux News 0 07-09-2008 03:40 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 05:29 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration