I have a CentOS 6 VM on which I used the following shell script for installing and configuring MongoDB to use a secondary LUKS (dm-crypt) encrypted disk for its database files:
#!/bin/bash -e # Set up the official mongodb repository # sudo cat >/etc/yum.repos.d/mongodb.repo <<EOL [mongodb] name=MongoDB Repository baseurl=http://downloads-distro.mongodb.org/repo/redhat/os/x86_64/ gpgcheck=0 enabled=1 EOL # create a keyfile that will be used for the device encryption # key should be read-only by root only sudo dd if=/dev/urandom of=/root/mongo-efs-key bs=1024 count=4 sudo chown root:root /root/mongo-efs-key sudo chmod 400 /root/mongo-efs-key # create partition on /dev/xvdc sudo parted /dev/xvdc mklabel msdos sudo parted /dev/xvdc mkpart primary 0% 100% # create encrypted container in new device sudo cryptsetup luksFormat -d /root/mongo-efs-key --batch-mode /dev/xvdc1 sudo cryptsetup luksOpen -d /root/mongo-efs-key /dev/xvdc1 mongoefs # format and mount our encrypted volume sudo mkfs.ext4 /dev/mapper/mongoefs sudo mkdir -p /var/lib/mongo sudo mount /dev/mapper/mongoefs /var/lib/mongo # update the crypttab and fstab files with new partitions echo "mongoefs /dev/sdb1 /root/mongo-efs-key luks" | sudo tee --append /etc/crypttab > /dev/null sudo cp -p /boot/initramfs-$(uname -r).img /boot/initramfs-$(uname -r).img.bak sudo dracut -f echo "/dev/mapper/mongoefs /var/lib/mongo ext4 defaults 0 2" | sudo tee -- append /etc/fstab > /dev/null # Install mongoDB sudo yum -y install mongodb-org # set permissions for mongo on our encrypted and mapped device sudo chown mongod:mongod /var/lib/mongo
The script does what it's supposed to, but I've run into an issue where I can't reboot the server without a command prompt asking me for the password for /dev/xvdc1. I'm not sure what to do here since I did not specify a password for it. I was under the impression that it would auto-unlock and mount as per this guide: https://www.howtoforge.com/automatically-unlock-luks-encrypted-drives-with-a-keyfile but that's not the case.
How do I change the configuration so that I am able to reboot the server (with the encrypted drive mounted) without needed a passphrase?