2

Running RHEL 7.9, my root partition is LUKS encrypted so during system boot I am prompted at the console for the passphrase to continue booting; that part is fine.

Once system is booted, in /etc/fstab I have a mount /dev/sdc1 /data where that block device is LUKS encrypted.

I can use the GNOME DISKS utility to unlock it and mount it but that becomes a second process, and a manual one I have to remember every time the system reboots... I also have to log in at the console and run the gnome-disks utility to mount my /data folder... which is terabytes and my OS disk root partition is only 600gb so the problem that quickly arises is the root partition filling up if /data doesn't get mounted.

How, under RHEL 7.9, can the automatic unlocking and mounting of a LUKS encrypted disk be made to happen during boot time? So it then mounts like any other [unencrypted] disk specified in /etc/fstab?

2 Answers 2

4

If you are comfortable with storing your encryption key on the (encrypted) root partition, this is doable. Create the file /etc/crypttab.keyfile containing your key. I have then used something like

# blkid /dev/sdc1
/dev/sda1: UUID="1249cb86-92a3-4e3b-8299-828a119fb3d1" TYPE="crypto_LUKS" 
PARTLABEL="primary" PARTUUID="75cf0a0e-0f4d-43c8-b8f5-fa26ab197ddc"
# echo "luks-1249cb86-92a3-4e3b-8299-828a119fb3d1 UUID=1249cb86-92a3-4e3b-8299- 
828a119fb3d1 /etc/crypttab.keyfile luks,discard" >> /etc/crypttab
# cryptsetup -v luksOpen /dev/sdc1 luks-1249cb86-92a3-4e3b-8299-828a119fb3d1 \
--key-file=/etc/crypttab.keyfile

Your device will be decrypted automagically at boot time and can be mounted through fstab.

Always keep a copy of your encryption key stored safely on another media. Lose it and your disk is gone.

2
  • Ok, that is waaay better than my approach ...
    – AdminBee
    Commented May 11, 2022 at 14:16
  • your instructions got me part way to my goal, of which I am entering as the answer. Thanks for your help.
    – ron
    Commented May 11, 2022 at 17:25
4

here's how I got it to work

dd   if=/dev/urandom  of=/root/crypttab.key  bs=1024   count=4
chmod  400  /root/crypttab.key
cryptsetup    luksAddkey   UUID=###   /root/crypttab.key
cryptsetup   -v luksOpen   UUID=###   /root/crypttab.key
# edit /etc/cryptab manually, each line having:
    <volume-name>   <encrypted-device>   <key-file>   <options>
  • UUID=### is of the luks locked partition as shown in gnome disks or lsblk
  • don't use /dev/sda1 or the by-name convention because as disks come and go or move in the system your luks encrypted volume could become sdb or sdc and it'll fail; using UUID is reliable
  • the <volume name> I believe can be anything
  • I suspect all the conventions allowed in /etc/fstab column 1 for mounting can be used here such as uuid, label, scsi-id... refer to contents under /dev/disk/
  • for the manual editing of /etc/crypttab
    • will be a blank file nothing crypttab [or luks] related has been done yet
    • this file cannot be renamed nor moved to something else
    • should have permissions root.root and -rw-------
    • each line for unlocking a given luks locked device has 4 columns
    • an example could be
      • scratch UUID=abc123 /root/crypttab.key luks
      • the 4th column for would be luks
  • the cryptsetup -v adds the key file to LUKS, which is independent of the original passphrase used to LUKS encrypt the volume
  • the cryptsetup -v will prompt for the existing passphrase, so the key I believe is based off the passphrase
  • if the /root/crypttab.key is compromised, don't know if the original passphrase is safe, I suspect it probably is.
  • if the /root/crypttab.key is compromised or lost, just need to delete the corresponding entry in /etc/crypttab and revert to using the passphrase or redo cryptsetup with new key
  • the /root/crypttab.key file can be deleted, as long as you know the original (or current) passphrase used to LUKS encrypt you can unlock and get your data
  • once this is setup, simply clicking the unlock button in gnome disks utility will unlock the volume without prompting for the passphrase, which is really what needs to happen
  • the entry in /etc/fstab of mounting the [encrypted] device is actually independent of crypt; nothing LUKS related happens in /etc/fstab
  • the /root/crypttab.key file can be named anything and located anywhere
  • the UUID to be used is that of the locked LUKS partition, before it has been unlocked.
  • with entries in /etc/crypttab present the GNOME disks utility will recognize that and the gnome disks will allow you to change the existing passphrase and it is good enough to indicate it will also update or respect the existing key files.
1
  • 1
    Got this working. Some typos to mind of: ....... "luksAddKey (not luksAddkey)" ....... "cryptsetup -v luksOpen UUID=### <mount label, not full path>"
    – And Wan
    Commented Mar 3 at 17:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .