Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a dm-raid1 with a LUKS encrypted partition md0 on it and I would like it to be mounted automatically when I login, using pam_mount.

So far I have configured the pam_mount.conf.xml as follows:

<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">
<pam_mount>
  <debug enable="1" />
  <mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other" />
  <mntoptions require="nosuid,nodev" />
  <logout wait="0" hup="0" term="0" kill="0" />
  <volume
    user="me"
    path="/dev/mapper/data"
    mountpoint="/mnt/data"
    fstype="crypt"
    cipher="aes-cbc-essiv:sha256"
    fskeypath="/home/data.key"
    fskeycipher="aes-256-cbc"
    fskeyhash="md5" />
  <mkmountpoint enable="1" remove="true" />
</pam_mount>

Further I added @include common-pammount to /etc/pam.d/login and /etc/pam.d/gdm.

The problem though, is that /dev/mapper/data is not in place when it is about to be mounted. However, the mounting works if I do

cryptsetup luksOpen /dev/md0 data
share|improve this question

1 Answer 1

You could try using PAM script to run the cryptsetup command at session start.

PAM script runs one of three handler scripts onsessionopen, onsessionclose or onauth (depending on the event that it is called to handle); each script is passed the user name and the invoking service name. If you require pam_script in your session before pam_mount, you can have onsessionopen do the cryptsetup invocation.

Details and examples can be found at: http://linux.bononline.nl/linux/pamscript/01/build.html

share|improve this answer
    
As cryptsetup is asking me for the encryption passphrase, is there a way to make it not to and let pam_mount handle this? –  rausch May 15 '11 at 11:26
    
According to the HOWTO, adding expose=1 to the pam_script invocation will make the password available to event scripts in the environment variable PAM_AUTHTOK. So you should be able to run echo $PAM_AUTHTOK | cryptsetup ... to avoid being asked the password again. –  Riccardo Murri May 15 '11 at 13:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.