1

I just finished this guide on (almost) full disk encryption. So now my root directory and /boot directory are both encrypted, and GRUB is password-protected. /boot/efi is still unencrypted. I haven't done section 4 of the guide yet (which will auto-complete password prompts 2 and 3 below once finished)

Times where I typed my password are marked with red. I enter my password here (this first prompt is the one I have a question about)

enter image description here

and then select Ubuntu in GRUB: GRUB

and then again later in the boot process I am prompted to unlock each partition. enter image description here

and after that Ubuntu boots and prints more output: (this is a representative sample but far from all of the output) enter image description here enter image description here

and then I get the login screen.

Prompts 1, 2, and 3 are set up to be the same password (I don't know if they're all checking against the same resource for the hash, but at the least, the same input unlocks each one). The GRUB password is different and it is only asked for if I attempt to change GRUB settings (so, it is not prompt 1). I'm pretty sure prompts 2 and 3 are the cryptoLUKS system to unlock each partition.

  • So what is prompt 1? When I enter my password, what program is handling it? Is that part of cryptoLUKS? GRUB? Something lower-level?
  • And what exactly am I unlocking? I have two encrypted partitions but three times I enter a password, so where does that odd prompt out go?

Thank you very much!

Improve this question
0

1 Answer 1

Reset to default
1

hd0 is Grub's syntax for hard disks. Prompt 1 is Grub asking for the passphrase to decrypt the encryption key for the encrypted partition containing /boot.

Prompts 2 and 3 are from Linux. The cryptsetup utility (at this point, the copy of it in the initramfs) is asking for the passphrase to decrypt the encryption key for the encrypted partition containing the root directory (prompt 2), then the same for /boot (prompt 3). The encryption at that point is managed inside the Linux kernel; cryptsetup is the utility that interacts with the user and relays the user's wishes to the kernel.

Passing information from Grub to the kernel without exposing it in plain text is not completely straightforward, which is why that guide has you do more work in section 4.

Improve this answer
9
  • But isn't grub itself in /boot/grub? In which case, wouldn't that need to be decrypted first before grub can even be launched? Or is that just where it ends up once Linux has been booted and the systems loaded? (or should I ask a new question and stop making a nuisance of myself?)
    – terdon ♦
    Commented Jun 28 at 16:00
  • @terdon The part of Grub that knows how to read /boot (including decryption if that's necessary) is on the EFI partition.
    – Gilles 'SO- stop being evil'
    Commented Jun 28 at 16:13
  • Ah! Gotcha, and /boot/grub just has the configuration stuff. Makes sense, thanks.
    – terdon ♦
    Commented Jun 28 at 16:20
  • @terdon you're not being a nuisance! In my understanding, GRUB isn't stored in /boot/grub, but after booting is finished, a bridge is constructed between the partition where GRUB is and the partition where the root filesystem is stored. On the root filesystem's side, this bridge touches down at /boot/grub. (and the process of building this metaphorical bridge is called mounting). So the root filesystem's /boot/grub has nothing in it, but then after boot there is a bridge to some files in a different place. What's the difference between actually having the files in that dir and (1/2)
    – SuperDialga
    Commented Jun 28 at 16:22
  • (2/2) having a bridge to files in some foreign location in that dir? To most programs, apparently none at all! They can't tell, the difference is abstracted away, the two look identical to mere common programs. I would appreciate it someone could double-check this for correctness though!
    – SuperDialga
    Commented Jun 28 at 16:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .