Arch Linux

cookiecaper

Member

Registered: 2007-09-22

Posts: 199

/etc/crypttab: home fails to unlock due to "unknown action"

Hi. I have a crypttab that looks like this:

home   /dev/disk/by-uuid/608686c3-59fb-4d60-ad05-415e3a100a13  password

This works and unlocks my home directory. However, I want to allow-discards on it, so I do:

home   /dev/disk/by-uuid/608686c3-59fb-4d60-ad05-415e3a100a13  password luks,allow-discards

but if I do this, home fails to unlock, I'm dropped to the root maintenance shell, and cryptsetup's usage help is displayed before a message that reads "cryptsetup: unknown action".

I have tried several permutations of the above and none of them have worked. This format seems in conformity with the content of the crypttab manpage and the information I find online. Neither /dev/sdxy or UUID=xxx device specifications make a difference.

I also get a warning that my crypttab format is deprecated and I should check the man page, although my crypttab seems to conform to the manpage fine.

All help appreciated.

falconindy

Developer

From: New York, USA

Registered: 2009-10-22

Posts: 4,111

Website

Re: /etc/crypttab: home fails to unlock due to "unknown action"

Perhaps you should reference the crypttab manpage that's installed on your box. It'll give you an accurate description of the supported fields. I have no idea where you got the "luks" option from.

Last edited by falconindy (2012-10-18 12:03:15)

---

blog | ±github

Strike0

Member

From: Germany

Registered: 2011-09-05

Posts: 1,491

Re: /etc/crypttab: home fails to unlock due to "unknown action"

Actually "luks" is a supported option, but "password" is not anymore. Try replacing "password" with "none" and just use "allow-discards" as an option.

cookiecaper

Member

Registered: 2007-09-22

Posts: 199

Re: /etc/crypttab: home fails to unlock due to "unknown action"

Perhaps you should reference the crypttab manpage that's installed on your box. It'll give you an accurate description of the supported fields. I have no idea where you got the "luks" option from.

Thanks for the reply, but as I've already noted, I *did* reference the manpage on my box. I added luks after I found it in some setups online that said they were successful; I didn't have it in there originally, but it seems not to make a difference either way.

Actually "luks" is a supported option, but "password" is not anymore. Try replacing "password" with "none" and just use "allow-discards" as an option.

OK, I will try this on next boot. It is pretty inconvenient; my /home and root are on separate partitions, encrypted with the same passphrase. Since I unlock root manually, I don't really want to have to type the passphrase again to unlock and mount home. Is there a way to continue to get automatic unlocking without resorting to keyfiles?

Just FYI, here are the relevant sections from the manpage on my machine. The manpage mentions luks and also says the third column can be used for the passphrase. All packages installed are fully up to date with stable rit mirror, including cryptsetup (1.5.0-2) and man-pages (3.43-1).

       The fourth field, if present, is a comma-delimited list of options. The following options are recognized:
       [...]
       allow-discards
           Allow discard requests to be passed through the encrypted block device. This improves performance on SSD storage but has security
           implications.

       luks
           Force LUKS mode.

and for the password column

       The third field specifies the encryption password. If the field is not present or the password is set to none, the password has to be
       manually entered during system boot. Otherwise the field is interpreted as a path to a file containing the encryption password. For
       swap encryption /dev/urandom or the hardware device /dev/hw_random can be used as the password file; using /dev/random may prevent
       boot completion if the system does not have enough entropy to generate a truly random encryption key.

Strike0

Member

From: Germany

Registered: 2011-09-05

Posts: 1,491

Re: /etc/crypttab: home fails to unlock due to "unknown action"

Is there a way to continue to get automatic unlocking without resorting to keyfiles?

Yes, put your partitions into LVM.