0

I have a Raspberry Pi with attached, via USB, HDD drive inside Orico chassis with a separate power source. I encrypted this drive with the command:

cryptsetup luksFormat /dev/sda

Then, I created key file with command:

dd if=/dev/random bs=32 count=1 of=/home/ubuntu/luks/luks.key

added this file as second key with command:

cryptsetup luksAddKey /dev/sda /home/ubuntu/luks/luks.key

and added this line to /etc/crypttab:

vault /dev/sda none

I think that I did everything to make this drive auto decrypt during system boot, but that doesn't happen. I have to do it manually after every reboot. The other thing that bothers me is output from cryptsetup luksDump /dev/sda.  I would expect two slots being on status "enabled", but I don't see it in the output:

ubuntu@ubuntu:~$ sudo cryptsetup luksDump /dev/sda
sudo: unable to resolve host ubuntu: Temporary failure in name resolution
LUKS header information
Version:        2
Epoch:          4
Metadata area:  16384 [bytes]
Keyslots area:  16744448 [bytes]
UUID:           ab24c6e5-9286-4e6d-a874-29755338afa1
Label:          (no label)
Subsystem:      (no subsystem)
Flags:          (no flags)

Data segments:
  0: crypt
    offset: 16777216 [bytes]
    length: (whole device)
    cipher: aes-xts-plain64
    sector: 512 [bytes]

Keyslots:
  0: luks2
    Key:        512 bits
    Priority:   normal
    Cipher:     aes-xts-plain64
    Cipher key: 512 bits
    PBKDF:      argon2i
    Time cost:  4
    Memory:     270573
    Threads:    4
    Salt:       b8 50 50 6c b2 54 45 ea 36 45 66 1d 61 d1 e9 94 
                87 7c 67 d3 a8 f3 3b 54 04 b6 46 7b 25 0d d2 89 
    AF stripes: 4000
    AF hash:    sha256
    Area offset:32768 [bytes]
    Area length:258048 [bytes]
    Digest ID:  0
  1: luks2
    Key:        512 bits
    Priority:   normal
    Cipher:     aes-xts-plain64
    Cipher key: 512 bits
    PBKDF:      argon2i
    Time cost:  4
    Memory:     268825
    Threads:    4
    Salt:       55 e6 be a8 55 45 61 3c 1b 6e 6d 7a b3 70 40 32 
                fc 4f 95 71 f0 13 52 c7 a1 69 cb 73 66 0b a9 6f 
    AF stripes: 4000
    AF hash:    sha256
    Area offset:290816 [bytes]
    Area length:258048 [bytes]
    Digest ID:  0
Tokens:
Digests:
  0: pbkdf2
    Hash:       sha256
    Iterations: 39527
    Salt:       62 9b 83 b6 04 f3 b0 aa 36 21 bc bf 28 aa 1d 3c 
                ad 89 8a 5c 0d 7a d2 f4 0f 6e d4 09 b2 33 0b d4 
    Digest:     45 42 fc 30 22 95 12 26 3f 78 8c 56 d7 b0 c3 d9 
                10 4e 32 99 93 3c 10 48 a3 df ab 89 77 89 14 1f 

Do you think that this problem might be related to the fact that the HDD is connected as a USB drive?  As mentioned previously, opening this LUKS volume manually works fine.  Please help me debug this problem.

1 Answer 1

1

You need to specify the key file in /etc/crypttab, if you put none there, it will be interpreted as "ask for passphrase".

From man crypttab:

The third field specifies the encryption password. If the field is not present or the password is set to "none" or "-", the password has to be manually entered during system boot. Otherwise, the field is interpreted as an absolute path to a file containing the encryption password.

Note that luksAddKey doesn't mean you are adding a new passwordless key slot to the LUKS device, you are adding a new keyslot protected with a new password or in your case a passphrase read from a file /home/ubuntu/luks/luks.key -- this is not the key used by LUKS/dm-crypt, it's just a "binary password", you still need to provide it when unlocking/opening the LUKS device.

Changing your crypttab entry to

vault /dev/sda /home/ubuntu/luks/luks.key

should do the trick.

The luksDump output is ok, it changed with LUKS version 2 and it no longer prints the Key Slot X: ENABLED/DISABLED line (for LUKS 2, it still prints it for LUKS 1).

2
  • thank you so much :) everything works fine now. I just have one more question - Is it possible to define drive by label name? I have noticed, that when I plug drive to another usb port, than it gets name /dev/sdb instead of /dev/sda as defined in /etc/crypttab Dec 26, 2020 at 0:02
  • 2
    The label is a weak identifier. You should get the UUID of the partition (blkid /dev/sdX) and instead of /dev/sda in the crypttab file, use UUID=2505567a-9e27-4efe-a4d5-15ad146c258b, using the UUID you found with blkid.
    – Zip
    Dec 26, 2020 at 1:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.