SSH to decrypt encrypted LVM during headless server boot?

Question

When I installed Ubuntu 10.04 and, now, 10.10, I was offered the option of enabling "encrypted LVM" for my hard drive. After choosing that option, I am prompted for my password during boot to decrypt the LVM.

Now, I am thinking about setting up a headless server that runs Linux (not necessarily Ubuntu), but I am worried that since the server is headless I won't be able to decrypt it during startup. Would I be able to SSH in during boot to enter my password for the encrypted LVM? If so how do I set it up? Or is there another solution? Again this question is NOT specific to Ubuntu. Thanks.

Answer 1

A guide to do such a setup with BusyBox and Dropbear is shown in this blog post. early-ssh didn't work for me and is apparently not needed anymore.

I have summarized what you need to do in the following. For more details, have a look at the post above:

1. Install BusyBox and Dropbear on your server

   sudo apt-get install dropbear busybox
   

2. Update your initramfs on the server

   sudo update-initramfs -u
   

3. Copy the private key generated by dropbear to your client machine. You may have to copy this to a new dir and change ownership to do this. On your server do the following:

   sudo cp /etc/initramfs-tools/root/.ssh/id_rsa ~/.
   sudo chown user:user ~/id_rsa
   

   Remember to replace user with your username. Password logins don't seem to work.

4. Now you may transfer the private key with scp by calling the following on your client:

   scp user@remote.server:~/id_rsa ~/.ssh/id_rsa_dropbear
   

5. Set up your client's ~/.ssh/config file for easy login. Open it up with a text editor and add the following:

   Host myremoteserver
       HostName my.remote.server
       User root
       UserKnownHostsFile ~/.ssh/known_hosts.initramfs
       IdentityFile ~/.ssh/id_rsa_dropbear
   

   Change the Host to whatever you like and HostName to the name of your server. Let the user be root. It appears to be the only accepted user in Dropbear. Save and close the file.

6. Restart your server and wait for the passphrase prompt. Give Dropbear a few seconds to detect and set up its internet connection. Connect to your server with the following command on your client:

   ssh myremoteserver # or any name you chose
   

7. When logged in, issue the following command on your server. See the blog post for details:

   pid=`ps | grep "/scripts/local-top/cryptroot" | cut -d " " -f 3`; kill -9 $pid; sleep 35; /scripts/local-top/cryptroot; pid=`ps | grep "/bin/sh" | cut -d " " -f 3`; kill -9 $pid;
   

   It will take some time (30 seconds) before you get to type your passphrase. Type it in when prompted.

8. Close the connection by typing

   exit
   

9. Your server should now have unlocked its encrypted hard drive and boot as normal.

(A huge thanks to the original author of the blog post!)

Answer 2

I think early-ssh provides what you're searching for:

Early-ssh is a simple initramfs hook, which installs Dropbear SSH server into  
your initramfs, and starts it at boottime, so you will be able to do a lot of  
things remotely over SSH, before your root partition gets mounted, for example:

* unlocking LUKS encrypted crypto devices - 
  even your root can be an encrypted filesystem
* assembling/altering RAID arrays (mdadm)
* checking the root filesystem in read-write mode, 
  taking action in case of errors
* and so on...

There is already a .deb package available, so you're probably fine with Ubuntu.

Answer 3

If you want to be able to boot unattended as well as remotely, you should also look at Mandos (which I and others have written):

Mandos is a system for allowing servers with encrypted root file systems to reboot unattended and/or remotely. See the latest README file for more information, including an FAQ list.

In short, the booting server gets the password over the network, in a secure fashion. See the README for details.

Answer 4

Headless server? If it has a serial port, use it.

GRUB can be configured to work over the serial port. Your kernel can also be configured use the serial port for outputting the initial boot messages, inputting the password to unlock your drives, and logging in. (If your server supports serial BIOS, enable that as well. Then you'll never have to connect a monitor to the machine at all).

Always a good idea to have a "non-network" way of getting in a headless server.