2

Problem description

I am trying to achieve dualboot of Windows 10 (pre-installed) and Ubuntu 18.04 on a new laptop. This is not very difficult, however it appears to get much more complex if you also want LUKS full-disk encryption, which asks the passphrase during boot to decrypt and use hardware acceleration for both encryption and decryption. If you want to use LUKS, you can do so easily using the Ubuntu installer, but only if no other operating system resides on that disk. If it does, all you can do is to manually setup things according to some tutorials found on the web.

So, I tried to do this installation manually. First, I completed the installation of the pre-installed Windows 10. Then, I used this guide to setup Ubuntu with LUKS.

Steps to reproduce

  1. boot from Ubuntu 18.04 USB-stick
  2. create unencrypted partition for /boot (type ext2 or ext3)
  3. create partition for luks encryption (type unformatted)
  4. create LUKS container on the partition we just created:
    • sudo cryptsetup luksFormat /dev/nvme0n1p5
    • sudo cryptsetup luksOpen /dev/nvme0n1p5 cryptedpartition
  5. create LVM volumes inside LUKS container for both swap and root (/)
    • sudo pvcreate /dev/mapper/cryptedpartition
    • sudo vgcreate vgcrypted /dev/mapper/cryptedpartition
    • sudo lvcreate -n swap -L 20g vgcrypted
    • sudo lvcreate -n root -l 100%FREE vgcrypted
  6. start Ubuntu installation, when asked where to install Ubuntu, choose Something else. The partition editor pops up. Here, we do several things:
    • we mount/format the unencrypted partition we created as /boot (ext2 or ext3)
    • we mount/format the encrypted data partition as / (ext4)
    • we mount the existing EFI partition as /boot/efi
    • we select Windows Boot Manager in the drop-down box at the bottom, as the place to install the bootloader (GRUB).
  7. after installation finished, choose Continue testing and open a terminal.
  8. determine the unique identifier (UUID) of the LUKS partition we created in step 3:
    • sudo blkid /dev/nvme0n1p5
  9. chroot into the new installation:

    • sudo mount /dev/mapper/vgcrypted-root /mnt
    • sudo mount /dev/nvme0n1p4 /mnt/boot
    • sudo mount --bind /dev /mnt/dev
    • sudo chroot /mnt
    • note: now we are root within the chrooted /mnt; no need for sudo
    • mount -t proc proc /proc
    • mount -t sysfs sys /sys
    • mount -t devpts devpts /dev/pts
  10. create a new file: nano /etc/crypttab and put the following in there, replacing the UUID with the one you got in step 8. Also replace lvm= with the name of your LVM volume group ('vgcrypted' in this example).

.

# <target name> <source device> <key file> <options>
cryptedpartition UUID=8b80b3a7-6a33-4db3-87ce-7f126545c74af none luks,retry=1,lvm=vgcrypted
  1. Finish by:
    • typing exit to escape the chroot environment
    • unmounting all the filesystems (not sure if it is necessary)
    • reboot
    • you should now be asked for your password to unlock the LUKS encrypted container during the boot phase, if you choose to boot from ubuntu which is the default selection.

.

This is where the guide linked to above ends, but what now?

The good news is that the dualboot seems to work: i can boot to Windows by selecting Windows boot manager from the boot menu, while the default is ubuntu. Hurray!

But booting Ubuntu fails: it drops to Busybox without any meaningful error message. I cannot find much help on finding the problem; without an actual error message, it is hard to diagnose since I don't know where to start.

Fortunately, I got a little bit further eventually, by following this route:

Additional instructions

  1. boot from Ubuntu USB-stick again
  2. open LUKS container:
    • sudo cryptsetup luksOpen /dev/nvme0n1p5 cryptedpartition
  3. mount up everything, get in chroot as in step 9.
  4. configure the next initrd build to force CRYPTSETUP=y:
    • nano /etc/cryptsetup-initramfs/conf-hook
    • uncomment the line which says CRYPTSETUP=y
  5. generate the initrd (initial ramdisk) which is used during the boot phase to setup things like LUKS:
    • update-initramfs -c -k 4.15.0-29-generic
    • note: if applicable, replace the 4.15.x version with the version of your kernel/initrd, as found in /boot. You can also try uname -a.
  6. unmount, reboot

.

Almost there, but not quite yet...

Now upon boot, I get asked for the LUKS password, and it also appears to detect the name of my LUKS container (cryptedpartition). Sounds good right?

My problem is now: the password is not accepted; everytime I type the password, I get the message that the password is probably incorrect. But when booting with USB-stick, the command sudo cryptsetup luksOpen will also ask for the password, and it is accepted as such.

The one thing I wanted to try is disable the password obfuscation, so that I can see the password I am typing during boot phase. Perhaps it detects my keyboard wrong and indeed a wrong password is typed. I simply do not know what could be the problem. The filesystems were clean (tested with fsck -f). I also tested with an external USB keyboard instead of the laptop default one.

Now I am really stuck; can somebody help me get this dualboot Ubuntu+LUKS with Windows 10 working? Your time and effort is appreciated!

  • Additionally, can someone point out to me how to properly format my question? If i remove the dots (.) before the blockquote, it breaks the blockquote and no automatic line break is inserted. My first time here, I tried the best I could :) – Steiner Sep 21 '18 at 13:49
  • Looks pretty well formatted to me. Maybe some tweaks (inline code uses backticks but blocks are indented by four spaces), but nothing serious. – roaima Sep 21 '18 at 21:12
  • 1
    If you have some non en-us keyboard layout, initramfs might not have set it when password is prompted and therefore you end up providing a wrong password as keys are mapped differently (just a guess). If so, you could try changing the password (use en-us keymap or pick a password you know is typed the same way on both layouts) using your ubuntu usb stick and see if it works. – sebasth Sep 22 '18 at 4:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.