Device name to use in luks commands for LVM LUKS

Question

Can somebody with more LUKS LVM experience than me tell me what the correct device name is to use in this context.

I'm trying to follow some instructions about using clevis and tang in CentOS. The instructions are pretty simple, yet after installing the tang server, I run into problems right away on the clevis portion.

> clevis bind luks -d /dev/mapper/luks-cee2a805-188f-44b6-b577-879243c0eb6c tang {"url":"http://official.server.company.com"}

Device /dev/mapper/luks-cee2a805-188f-44b6-b577-879243c0eb6c is not a valid LUKS device.

This is a whole-volume LUKS volume on the main LVM partition and I would have thought the above name is right. Here's the output of lsblk

> lsblk -p

NAME                                                        MAJ:MIN RM  SIZE RO TYPE  MOUNTPOINT
/dev/sda                                                      8:0    0   50G  0 disk  
├─/dev/sda1                                                   8:1    0    1G  0 part  /boot
├─/dev/sda2                                                   8:2    0    2G  0 part  [SWAP]
└─/dev/sda3                                                   8:3    0   47G  0 part  
  └─/dev/mapper/vg_root-lv_root                             253:0    0   47G  0 lvm   
    └─/dev/mapper/luks-cee2a805-188f-44b6-b577-879243c0eb6c 253:1    0   47G  0 crypt /
/dev/sr0                                                     11:0    1 1024M  0 rom   

But I can't seem to find the right device to pass to clevis bind or any other LUKS command:

> luksmeta show -d /dev/mapper/luks-cee2a805-188f-44b6-b577-879243c0eb6c
Unable to read LUKSv1 header (/dev/mapper/luks-cee2a805-188f-44b6-b577-879243c0eb6c): Invalid argument

> cryptsetup luksDump /dev/mapper/luks-cee2a805-188f-44b6-b577-879243c0eb6c
Device /dev/mapper/luks-cee2a805-188f-44b6-b577-879243c0eb6c is not a valid LUKS device.

I've also tried, for completeness not necessarily because I thought it made any sense /dev/sda, /dev/sda3.

I'm stuck, any tips greatly appreciated.

---

• p.s. I know my reputation is a mere 101 on Unix&Linux but I'm a 2000+ on StackOverflow, so I do generall know what I'm doing.
• https://rhelblog.redhat.com/2018/04/13/an-easier-way-to-manage-disk-decryption-at-boot-with-red-hat-enterprise-linux-7-5-using-nbde/
• https://blog.delouw.ch/2017/10/01/leveraging-network-bound-disk-encryption-at-enterprise-scale/

Answer 1

From RedHat blog link you posted, it appears clevis wants the encrypted block device (not the decrypted one). In your lsblk output, that is /dev/mapper/vg_root-lv_root. This sort of makes sense; the decrypted one doesn't exist until after the keys are supplied.

You can confirm that's indeed the right device a few ways:

• cryptsetup luksDump /dev/mapper/vg_root-lv_root ought to work
• dmsetup table luks-cee2a805-188f-44b6-b577-879243c0eb6c will show the device-mapper mapping table. The second-to-last field should be the major and minor numbers separated by a colon (e.g., yours will probably show 253:0). You can use stat or even ls -l to see the major/minor numbers of devices to see what matches.