3

Basic setup:
- Operating System: CentOS 7 (64 bit)
- Grub 2
- separate boot partition with ext4
- luks encryption (aes-xts-plain64:sha512) on two disc partitions which both need to be unlocked by password at boot time
- after being unlocked both partitions are mounted on / as raid1 btrfs filesystem

Right now I am looking for a clean strategy to get remote access during boot time to unlock both partitions.
On a Raspberry Pi 2 I am already using Dropbear to do this and most of the threads I found seem to favourite this option for bigger systems too. Even though on bigger systems nobody cares about the bootloader resources needed.

Question:
From my understanding on a CentOS 7 Grub2 (clean installation) I already have an OpenSSH service running by default. Why do I need to install dropbear then if openSSH and dropbear do the same job?
Shouldn't I be able to configure openSSH for grub and just paste the command:
/lib/cryptsetup/askpass "passphrase: " > /lib/cryptsetup/passfifo
diretly over openSSH?

Improve this question
3
  • openssh needs linux to run. You can't run openssh from bootloader. You might be able to boot system and then connect and decrypt some other partition, but not the system one.
    – Jakuje
    Mar 23, 2016 at 18:19
  • But why is it possible to use dropbear on grub then? Is it just the library dependencies that would get to big for the openssh service (like a whole mirror of the operating system)?
    – Jonathan Herrmann
    Mar 23, 2016 at 18:29
  • Dropbear is constructed as very lightweight so it might run from bootloader (but I never used that). OpenSSH does not have such ambitions.
    – Jakuje
    Mar 23, 2016 at 18:33

2 Answers 2

Reset to default
2

To complete this topic. Here is my dropbear installation on CentOS.

I used the following scripts and description: https://github.com/dracut-crypt-ssh/dracut-crypt-ssh

Following Installation way 2.1.

All commands are executed as root.

  1. sudo su
  2. yum update
  3. yum install epel-release
  4. yum install vim
  5. yum install wget
  6. wget -O /etc/yum.repos.d/rbu-dracut-crypt-ssh-epel-7.repo https://copr.fedorainfracloud.org/coprs/rbu/dracut-crypt-ssh/repo/epel-7/rbu-dracut-crypt-ssh-epel-7.repo
  7. yum install dracut-crypt-ssh

  8. vim /etc/default/grub -> Changing line "GRUB_CMDLINE_LINUX" (by pressing i in the editor. Text can be changed)
    Old line:
    GRUB_CMDLINE_LINUX="crashkernel=auto rd.luks.uuid=luks-e0e5a45d-9773-428f-b0b4-79e85395f1e7 rd.luks.uuid=luks-c4d735fb-ce26-43ec-b9fe-2c48acded15c vconsole.font=latarcyrheb-sun16 vconsole.keymap=de rhgb quiet"
    New line:
    GRUB_CMDLINE_LINUX="crashkernel=auto rd.neednet=1 ip=dhcp rd.luks.uuid=luks-e0e5a45d-9773-428f-b0b4-79e85395f1e7 rd.luks.uuid=luks-c4d735fb-ce26-43ec-b9fe-2c48acded15c vconsole.font=latarcyrheb-sun16 vconsole.keymap=de rhgb quiet"
    Always saving the changes by command "ESC -> :wq!" in editor.

  9. vim /etc/dracut.conf.d/crypt-ssh.conf -> Changing port and reference to authorized_keys (press i again)
    a. Uncommend port line and change from default port 222 to port 22:
    "# dropbear_port="222"" to "dropbear_port="22""
    b. Uncomment authorized_keys line and change the path:
    "# dropbear_acl="/root/.ssh/authorized_keys"" to "dropbear_acl="/keys/dropbear/authorized_keys""

  10. mkdir /keys

  11. mkdir /keys/dropbear

  12. vim /keys/dropbear/authorized_keys -> Adding public key
    In my case I generated a key pair by running PuTTYgen and copied the public key over ssh to the editor.

  13. grub2-mkconfig --output /etc/grub2.cfg

  14. dracut --force
  15. reboot
  1. Logging into the boot shell on a windows pc with program "PuTTY".
    Settings:
    a. IP address: server ip address
    b. Port: 22
    c. Connection->Data->Auto-login username: root
    d. Connection->SSH->Auth->Private key file for authentication->Dropbear.ppk -> Hit Open Button

Should show somethin like:

Using username "root". Authenticating with public key "rsa-key-20160322" -sh-4.2#

  1. console_peek (for some reason this command is always needed before console_auth in order to have a successfull passwort forwarding).
  2. console_auth -> Passphrase: -> Type in password of encrypted device and hit enter

Unlock is not usefull in my case because crypttab contains a lot of partitions that can not be unlocked at boot time.

Improve this answer
0

So is dropbear really like the right and only choice for remote access during boot time?

I did some additional research on dracut which is used to build the initramfs image on CentOS and it shows the option "--sshkey " which needs to be combined with the module load option "ssh-client" in /etc/dracut.conf.

It looks to me again as if there already is a ssh-client at place and I do not need to install dropbear additionally. Has anyone tried this option before? Does anyone know a good tutorial for this?

Improve this answer
1
  • I tried the option dracut --sshkey "~/.ssh/authorized_keys" --force with "ssh-client" set and on /etc/default/grub the options "rd.neednet=1 ip=dhcp" without any success. It looks like there is no ssh-server in background activated. Anyway I did not find any information on which port this ssh-server would listen too. So I will use dropbear for CentOS now.
    – Jonathan Herrmann
    Mar 26, 2016 at 16:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .