1

I've tried to set up Dropbear and Busybox on my virtualization host running Debian Jessie, so I could unlock the encrypted filesystems from the initramfs, before the actual boot. I've followed this guide: Remote unlocking LUKS encrypted LVM using Dropbear SSH in Ubuntu Server 14.04.1 (with Static IP)

I've done a setup using this exact guide before, and it works like a charm to this day. However, this time I'm not actually encrypting the root filesystem, but only an extra partition that contains non-system-critial data, my VM images to be exact. I thought it would be a good idea to unlock that drive before boot time, because I didn't want to run into issues with KVM; I don't know what KVM does if it doesn't find its machines after starting up, and I'd rather not find out.

But now, long story short - something went wrong (early unlocking doesn't work as expected) and primarily I'm just concerned to get the system back to its earlier state so I can boot up normally without the data partition. I can work on the server by starting up a live distribution and chrooting in. I've manually reverted all the steps in the guide (except for Step 1) and rebuilt the initramfs, but still I'm dropped back to Busybox after rebooting and connecting via SSH. I'm slightly afraid of just removing Busybox and Dropbear as that could lock me out of the system entirely.

Does anybody know which settings might have been changed by the steps in that guide that I'm not seeing? All config files etc. that I touched are back to how they were before, but still Busybox starts instead of the actual OS... how do I change that?

Improve this question

1 Answer 1

Reset to default
0

I assume you want to remove dropbear from your system, and that you reverted all your changes in /etc/initramfs. Now chroot into your system and aptitude purge dropbear dropbear-initramfs && update-initramfs -u -k all. Reboot, and dropbear should be gone.

Configure your image partition via /etc/crypttab, systemd should unlock it before reaching the remote-fs target, which is ordered before all normal services.

Improve this answer
2
  • Thank you. I was a bit unsure about simply removing Dropbear but then I'll just give it a try. I can only reach the server via SSH. How can I unlock the partition before the boot is complete? If I put it in /etc/crypttab, I still need some way to enter the key.
    – morph
    Nov 15, 2016 at 9:16
  • Don't mount the image partition or start your KVM service automatically, simply log in, unlock the partition and start them manually. You can script this.
    – Ferenc Wágner
    Nov 15, 2016 at 9:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .