1

I've tried to set up Dropbear and Busybox on my virtualization host running Debian Jessie, so I could unlock the encrypted filesystems from the initramfs, before the actual boot. I've followed this guide: https://stinkyparkia.wordpress.com/2014/10/14/remote-unlocking-luks-encrypted-lvm-using-dropbear-ssh-in-ubuntu-server-14-04-1-with-static-ipst/

I've done a setup using this exact guide before, and it works like a charm to this day. However, this time I'm not actually encrypting the root filesystem, but only an extra partition that contains non-system-critial data, my VM images to be exact. I thought it would be a good idea to unlock that drive before boot time, because I didn't want to run into issues with KVM; I don't know what KVM does if it doesn't find its machines after starting up, and I'd rather not find out.

But now, long story short - something went wrong (early unlocking doesn't work as expected) and primarily I'm just concerned to get the system back to its earlier state so I can boot up normally without the data partition. I can work on the server by starting up a live distribution and chrooting in. I've manually reverted all the steps in the guide (except for Step 1) and rebuilt the initramfs, but still I'm dropped back to Busybox after rebooting and connecting via SSH. I'm slightly afraid of just removing Busybox and Dropbear as that could lock me out of the system entirely.

Does anybody know which settings might have been changed by the steps in that guide that I'm not seeing? All config files etc. that I touched are back to how they were before, but still Busybox starts instead of the actual OS... how do I change that?

Many thanks in advance

0

I assume you want to remove dropbear from your system, and that you reverted all your changes in /etc/initramfs. Now chroot into your system and aptitude purge dropbear dropbear-initramfs && update-initramfs -u -k all. Reboot, and dropbear should be gone.

Configure your image partition via /etc/crypttab, systemd should unlock it before reaching the remote-fs target, which is ordered before all normal services.

  • Thank you. I was a bit unsure about simply removing Dropbear but then I'll just give it a try. I can only reach the server via SSH. How can I unlock the partition before the boot is complete? If I put it in /etc/crypttab, I still need some way to enter the key. – morph Nov 15 '16 at 9:16
  • Don't mount the image partition or start your KVM service automatically, simply log in, unlock the partition and start them manually. You can script this. – Ferenc Wágner Nov 15 '16 at 9:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.