Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm working on booting a headless server (Fedora 16), entering the passphrase to decrypt the root disk (LUKS) over SSH using dropbear. I've got dropbear all working: I can SSH to the server while it's sitting and waiting for the password. But I can't figure out how to actually pass the password to use.

The crypt script that asks for the password and decrypts the volume uses the plymouth ask-for-password command; is there a way to pass the password into this command from the command line? I've tried writing to the process's stdin, but that didn't work. Is there some other way I can do it?

share|improve this question
    
I don't know plymouth (or even dropbear) but programs which prompts for a password typically do not read stdin. The program "expect" can "supply" a password to password prompts. Additionally I've noticed a tendency lately for more and more programs that prompt for a password supply an option to make them read from the command-line, or a file, or a password specified with the command arguments. –  Johan Mar 8 '13 at 12:36
    
I thought plymouth was something for graphical boot only. So for SSH that'd be barking up the wrong tree. Not sure. cryptsetup itself is happy to receive passwords in any number of ways (pipe, file, prompt) –  frostschutz Mar 8 '13 at 21:26
    
Yes, plymouth is used for graphical boot, but it's also used by the dracut crypto module to ask for your password when decrypting the root filesystem at boot. I'm working on setting up a headless server that I can unlock remotely over SSH, so I'm looking for a way to give the password to the plymouth from the SSH CLI. –  sh1ftst0rm Mar 8 '13 at 21:57
    
Am I understanding this correctly: / is encrypted; however, you can log in through SSH? Now, what you're wanting is a way to unlock / from SSH? –  SailorCire Oct 11 '13 at 18:43
    
@SailorCire: That's right. I have dropbear running from the initramfs (i.e., /boot), so it's able to run before / is unlocked. –  sh1ftst0rm Oct 11 '13 at 19:25

2 Answers 2

up vote 0 down vote accepted

I ended up creating a kind of hacky work around, but it is working for me, and I've been using it for several months now. It basically just replaces the cryptroot-ask shell script with a custom one that waits for you to SSH in, unlock the disk yourself, and then delete a file to indicate that it's gone. Replacement of the cryptroot-ask script is done based on a option passed to the kernel, so you can easily disable it from your GRUB, or your bootloader of choice.

It's all available from: https://bitbucket.org/bmearns/dracut-crypt-wait

share|improve this answer

You would need to rewrite or replace the script in /usr/share/initramfs-tools/scripts/local-top/cryptroot

share|improve this answer
1  
Could you elaborate on that a bit? What would have to be replaced? –  Mat Jul 28 '13 at 5:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.