why is ssh breaking when I encrypt partition?

Question

I am trying to create an encrypted partition for sensitive user data, on my Ubuntu server.

Soft raid is set up on the server and I assume this is what is causing the problem.

After the operating system installation, I checked the partition that I wanted to encrypt, and the only thing within it was a lost and found folder. I deleted that and continued, successfully encrypting the partition.

Everything was good until I tried to SSH in two the installation (I had to do the encryption in rescue mode so that the discs were not in use).

I just kept getting a connection refused error.

I decided to reconnect in rescue mode and attempt to reinstall open SSH.

Systemctl preset command kept failing and the service would not start.

No matter how many times I purged and reinstalled open SSH, it would not work correctly.

Before I encrypted is the volume that only contained the lost and found folder, SSH was working correctly. I really don’t understand what is going on.

Please, somebody tell me how to set up my disk with a large encrypted partition, where I can store all of my data.

(My server is unmanaged, so unfortunately, asking ovh to set this up during installation of the operating system is not really an option)

—————- Update —————-

I retried with a different approach. Unfortunately, the same result. Luks on lvm on raid. I chose this, so I could keep the raid array running whilst setting up the encryption. Before encryption was added, the only contents of the raid volume was something called “lost+found”, I decided it was safe to proceed and go ahead with the encryption. Everything seemed perfect until I rebooted the system. host simply refuses connection on 22.

————— Steps taken to produce the problem —————

1.  Set up Ubuntu 22.04 server with two volumes, both using software raid
2.  Create a Physical Volume with LVM on the RAID: then turn RAID array into a physical volume (PV) that LVM can use:

sudo pvcreate /dev/md3

3.  Create a Volume Group (VG) on the PV: Next, create a volume group:

sudo vgcreate myvg /dev/md3

4.  Create a Logical Volume (LV) on the VG: can then create a logical volume on the VG:

sudo lvcreate -l 100%FREE -n mylv myvg

5.  Encrypt the LV with LUKS: can now encrypt the logical volume:

sudo cryptsetup luksFormat /dev/myvg/mylv

6.  Open the LUKS device: After setting up the encrypted LV, open it:

sudo cryptsetup open --type luks /dev/myvg/mylv cryptlv

7.  Create a filesystem: Finally, create a filesystem on the mapped LUKS device:

sudo mkfs.ext4 /dev/mapper/cryptlv

8.  Reboot server and attempt SSH connection.

Answer 1

I needed to acknowledge raid one and work with it appropriately.

To install correctly, it was necessary to install on a 40 GB foil system with raid 1, which mirrors across three drives.

I then had to set up two new partitions on separate disks, using me entirety of the remaining space.

Somebody else me find instructions, useful, so I will write them here:

Sure, if you want to create a new RAID 1 partition on the remaining space of your Ubuntu machine, you can follow these steps. Please replace the device names (/dev/sdx, /dev/sdy) with the actual device names in your setup:

1. Identify the available space: Use the lsblk or fdisk -l command to identify the free space on your drives.

2. Partition the drives: Use fdisk or gdisk to create partitions on the drives in the remaining space.

   sudo fdisk /dev/sdx
   

   In the fdisk interface:

   • Press n for a new partition.
   • Press p for a primary partition.
   • Accept the defaults for partition number and start sector.
   • Specify the end sector to use the remaining space.
   • Press w to write the changes and exit.

   Repeat these steps for the second drive (/dev/sdy).

3. Install mdadm: If you haven't already, install mdadm, a tool for managing MD (software RAID) devices in Linux.

   sudo apt-get update
   sudo apt-get install mdadm
   

4. Create the RAID 1 array: Substitute X and Y with the partition numbers you've created in step 2.

   sudo mdadm --create --verbose /dev/md0 --level=1 --raid-devices=2 /dev/sdxX /dev/sdyY
   

Encryption of the RAID array can be done using Linux Unified Key Setup-on-disk-format (LUKS). LUKS is a disk encryption specification which can help you achieve this.

First, you need to make sure you have the cryptsetup utility installed. If it is not, you can install it by running:

sudo apt-get update
sudo apt-get install cryptsetup

The next step is to format the RAID array using LUKS. Use the cryptsetup luksFormat command for this. Please note that this will erase all data on the RAID array:

sudo cryptsetup luksFormat /dev/md1

You will be prompted to enter a passphrase. Be sure to remember this passphrase, as you will need it to access the data on the RAID array.

After formatting the RAID array, you need to open the LUKS partition:

sudo cryptsetup luksOpen /dev/md1 md1_crypt

You will be asked to enter the passphrase you set during the luksFormat step.

Once you have opened the LUKS partition, you can format it with a filesystem of your choice, such as ext4:

sudo mkfs.ext4 /dev/mapper/md1_crypt

Now you can mount the filesystem:

mkdir /mnt/secure_raid
mount /dev/mapper/md1_crypt /mnt/secure_raid

Now, all data written to /mnt/secure_raid will be stored on the encrypted RAID array.

Please note that upon system reboot, the LUKS partition will not be automatically opened or mounted. You need to manually open the LUKS partition with cryptsetup luksOpen and then mount it. If you want the LUKS partition to be automatically opened and mounted at boot, you need to add it to the /etc/crypttab and /etc/fstab files.