11

I recently installed Fedora 20. I don't recall what exact options I chose for encrypting the disk/LVM during installation. It installed fine and I can log in etc. Here is the situation I have:

I booted up with LiveCD and tried the following: (I have installed Fedora20 to /dev/sda3' partition).

  1. If I run cryptsetup open /dev/sda3 fedo I get an error saying it is not a LUKS device.
  2. I I run cryptsetup luksDump /dev/sda3 I get an error saying it is not a LUKS device
  3. If I run cryptsetup open --type plain /dev/sda3 fedo, it prompts for password and it opens the device fine.

So, obviously, that is a plain-text encrypted (without LUKS header) partition.

Now, when I try to run mount /dev/mapper/fedo /mnt/fedora, it says unknown crypto_LUKS filesystem.

I do have LVM on top of it, so, I can run pvdisplay, vgdisplay, lvdisplay and it shows information. I have a VG called fedora and two LVs, viz 00 for swap partition and 01 for / partition.

Now, if I do a cryptsetup luksDump /dev/fedora/01 I can see LUKS headers etc. And, I can mount by running mount /dev/fedora/00 /mnt/fedora, no password prompt.

So, do I have a LUKS-over-LVM-over-(plain-text)-encrypted partition?

Here is my output of lsblk:

# lsblk
NAME                                            MAJ:MIN RM  SIZE RO TYPE  MOUNTPOINT
sda                                               8:0    0 37.3G  0 disk
|-sda3                                            8:3    0 17.4G  0 part
  |-fedora-00                                   253:0    0  2.5G  0 lvm
  | |-luks-XXXXX                                253:3    0  2.5G  0 crypt [SWAP]
  |-fedora-01                                   253:1    0   15G  0 lvm
    |-luks-XXXXX                                253:2    0   15G  0 crypt /

So, the question is, how to figure out whether I have LVM-over-LUKS or LUKS-over-LVM, or some other combination thereof (LUKS over LVM over LUKS etc)? To make my question clear, I know I have LVM and LUKS, I want to figure out the order of them.

10

cryptsetup luksDump /dev/fedora/01 shows the LVM logical volume to be a LUKS encrypted volume. The output of pvs or pvdisplay would show the partition /dev/sda3 to be a physical volume. Thus you have LUKS over LVM. At a lower level, you have LVM over PC partition.

The output of lsblk confirms this: sda is a disk, sda3 is a partition (which contains an LVM physical volume), fedora-00 and fedora-01 are logical volumes, and each logical volume contains a LUKS encrypted volume.

  • Perfect answer and confirms my tests. I can't vote for your answer though as I am a newbie here and don't have high enough reputation :-( – NotSuperMan Oct 9 '14 at 0:35
8

It's very odd to have a LUKS inside a plain crypt. Why encrypt twice?

Once your filesystems are mounted, lsblk will show you what's what.

NAME                         MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINT
sda                            8:0    0  59.6G  0 disk  
└─sda1                         8:1    0  59.6G  0 part  
  └─md0                        9:0    0  59.6G  0 raid1 
    └─luksSSD1               253:9    0  59.6G  0 crypt 
      ├─SSD-home             253:0    0    36G  0 lvm   /home
      └─SSD-root             253:10   0    16G  0 lvm   /

This is LVM (/home and / with type lvm) on LUKS (type crypt, luksSSD1) on RAID1 (md0, type raid1) on a regular partition (sda1) on the disk sda.

  • Yes, it is weird. I added output of 'lsblk' to my question. – NotSuperMan Oct 8 '14 at 19:16
  • @NotSuperMan: well, that looks fine. disk, partition, lvm, and each LV is encrypted. It's a common setup. Your description sounded different somehow. I think your mistake was using cryptsetup --plain on sda3; sda3 is an LVM device, not crypt. – frostschutz Oct 8 '14 at 22:27
  • Thanks for your help. But, without cryptsetup --type plain, I could not even mount the partition. So, it was not clear to me. May be instead of mounting partition first, I should mount the LV using the LUKS-UUID directly? (I will give that a shot) When I ran fdisk -l /dev/sda it says /dev/sda3 is Id is 8e and Type is Linux LVM. – NotSuperMan Oct 8 '14 at 23:14
  • OK. Instead of trying to 'cryptsetup open' the partition first, I just used the cryptsetup open /dev/disk/by-uuid/UUID-of-LV SomeName command to open the the LV directly and it asked for passowrd etc., and subsequently, I was able to mount the mapped device fine. This explains a lot to me. I think the key is the order of 'crypt and 'lvm' TYPEs in the output of lsblk command. So, I think my setup is a LUKS-over-LVM. And, from the output you showed, I conclude yours is a LVM-over-LUKS setup. So, I conclude that I should not 'cryptsetup open' a 'Linux LVM' partition. – NotSuperMan Oct 8 '14 at 23:48
  • Your comments helped me clear my understandings. Unfortunately, I am unable to vote for your answer as I am a newbie here and don't have high enough "reputation" :-( and so the stackexchange doesn't let me vote for your answer. – NotSuperMan Oct 9 '14 at 0:37
3

You can see what you have like so:

$ sudo blkid | grep crypto_LUKS
/dev/mapper/fedora-home: UUID="XXXXXXXXXXXXXXXXX" TYPE="crypto_LUKS" 

That's a LVM logical volume with crypto LUKS on it. When I mount that volume it's mounted like this under Fedora 20:

$ mount | grep home
/dev/mapper/luks-XXXXX on /home type ext4 (rw,relatime,seclabel,data=ordered)

If you did a standard installation you'll have the same thing.

Manually decrypting

I believe you can do the following if you want to do things manually. First to see if something is LUKS or not:

$ sudo cryptsetup isLuks /dev/mapper/fedora-home
$ echo $?
0

$ sudo cryptsetup isLuks /dev/mapper/fedora-root 
$ echo $?
1

NOTE: A zero denotes that it is LUKS, a 1 means it's not.

So then to decrypt it:

$ sudo cryptsetup luksOpen /dev/mapper/fedora-home crypthome

NOTE: You have to enter the passphrase to decrypt the partition. Feel free to change the mapping name crypthome to whatever you want. The mapped partition is now available in /dev/mapper/crypthome but it isn’t mounted. The last step is create a mount point and to mount the mapped partition:

Manually mounting

$ sudo -Es
$ mkdir /mnt/crypthome && mount /dev/mapper/crypthome /mnt/crypthome

What crypted partitions do I have?

You can check in the file /etc/crypttab to see what LUKS you have setup too.

$ more /etc/crypttab  
luks-XXXXXXXX UUID=XXXXXXXX none 

Dumping the device

You can also use luksDump like so:

$ sudo cryptsetup luksDump /dev/mapper/fedora-home
LUKS header information for /dev/mapper/fedora-home

Version:        1
Cipher name:    aes
Cipher mode:    xts-plain64
Hash spec:      sha1
Payload offset: 4096
MK bits:        512
MK digest:      XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX 
MK salt:        XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX 
                XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX 
MK iterations:  50625
UUID:           XXXXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXX

Key Slot 0: ENABLED
    Iterations:             202852
    Salt:                   XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX 
                            XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX 
    Key material offset:    8
    AF stripes:             4000
Key Slot 1: DISABLED
Key Slot 2: DISABLED
Key Slot 3: DISABLED
Key Slot 4: DISABLED
Key Slot 5: DISABLED
Key Slot 6: DISABLED
Key Slot 7: DISABLED

If it's not a LUKS device then it'll get reported like so:

$ sudo cryptsetup luksDump /dev/mapper/fedora-root 
Device /dev/mapper/fedora-root is not a valid LUKS device.

References

1

I think the key to find out whether it is a LVM-over-LUKS, or the other way around, is the order of crypt and lvm TYPEs in the output of lsblk command. Based on that reasoning, I conclude my setup is a LUKS-over-LVM. For the lsblk output for a LVM-over-LUKS type of setup, look at output showed by @frostschultz below.

In my case, since /dev/sda3 is a "Linux LVM" system partition (partition Id 8e), I think instead of trying to cryptsetup open --type plain /dev/sda3 SomeName first, I should have mapped the LVM directly by running the command cryptsetup open /dev/disk/by-uuid/UUID-of-LV SomeName command to open the the LV directly. I tried this and it works as I expected.

Thanks to all the folks who contributed to help me understand this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.