1

I have a CentOS 6 VM on which I used the following shell script for installing and configuring MongoDB to use a secondary LUKS (dm-crypt) encrypted disk for its database files:

#!/bin/bash -e
# Set up the official mongodb repository
#
sudo cat >/etc/yum.repos.d/mongodb.repo <<EOL
[mongodb]
name=MongoDB Repository
baseurl=http://downloads-distro.mongodb.org/repo/redhat/os/x86_64/
gpgcheck=0
enabled=1
EOL

# create a keyfile that will be used for the device encryption
# key should be read-only by root only
sudo dd if=/dev/urandom of=/root/mongo-efs-key bs=1024 count=4
sudo chown root:root /root/mongo-efs-key
sudo chmod 400 /root/mongo-efs-key

# create partition on /dev/xvdc
sudo parted /dev/xvdc mklabel msdos
sudo parted /dev/xvdc mkpart primary 0% 100%

# create encrypted container in new device
sudo cryptsetup luksFormat -d /root/mongo-efs-key --batch-mode /dev/xvdc1
sudo cryptsetup luksOpen -d /root/mongo-efs-key /dev/xvdc1 mongoefs

# format and mount our encrypted volume
sudo mkfs.ext4 /dev/mapper/mongoefs
sudo mkdir -p /var/lib/mongo
sudo mount /dev/mapper/mongoefs /var/lib/mongo

# update the crypttab and fstab files with new partitions
echo "mongoefs /dev/sdb1 /root/mongo-efs-key luks" | sudo tee --append       /etc/crypttab > /dev/null
sudo cp -p /boot/initramfs-$(uname -r).img /boot/initramfs-$(uname -r).img.bak
sudo dracut -f
echo "/dev/mapper/mongoefs /var/lib/mongo ext4 defaults 0 2" | sudo tee --   append /etc/fstab > /dev/null

# Install mongoDB
sudo yum -y install mongodb-org

# set permissions for mongo on our encrypted and mapped device
sudo chown mongod:mongod /var/lib/mongo

The script does what it's supposed to, but I've run into an issue where I can't reboot the server without a command prompt asking me for the password for /dev/xvdc1. I'm not sure what to do here since I did not specify a password for it. I was under the impression that it would auto-unlock and mount as per this guide: https://www.howtoforge.com/automatically-unlock-luks-encrypted-drives-with-a-keyfile but that's not the case.

How do I change the configuration so that I am able to reboot the server (with the encrypted drive mounted) without needed a passphrase?

  • What output are you getting wtih 'cryptsetup luksClose /dev/xvdc1'? – likewhoa Jun 10 '16 at 18:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.