Arch Linux

ltsdw

Member

Registered: 2020-04-20

Posts: 76

[Solved] Can't type passphrase full disk encryption with LUKS

Basically I've configured luks on lvm, full disk encryption, following the arch wiki for reference and everything looks pretty good, except that when it's prompted to me to enter the password every single key that I press is a new "No key available with this passphrase".

In my mkinitcpio.conf I have atkbd at modules and keyboard, keymap, encrypt and lvm2 at hooks.

Also the keyboard works at grub command line.

edit:
Encrypted using type luks2
Running at a notebook Acer E5 573
Using grub-git from aur (for the luks2 support)

Last edited by ltsdw (2020-05-09 17:42:21)

fistrosan

Member

Registered: 2020-04-01

Posts: 172

Re: [Solved] Can't type passphrase full disk encryption with LUKS

I gather that if your passphrases are not accepted you cannot even get to the tty or login manager ? Was this a fresh arch install ? Something similar to what you describe happened to me a couple of months ago. It turns out I had forgotten to unmount all my partitions after exiting chroot and rebooting the system for the first time and that basically crashed the system. Had to reinstall everything again.

Basically I've configured luks on lvm, full disk encryption, following the arch wiki for reference and everything looks pretty good, except that when it's prompted to me to enter the password every single key that I press is a new "No key available with this passphrase".

In my mkinitcpio.conf I have atkbd at modules and keyboard, keymap, encrypt and lvm2 at hooks.

Also the keyboard works at grub command line.

ltsdw

Member

Registered: 2020-04-20

Posts: 76

Re: [Solved] Can't type passphrase full disk encryption with LUKS

I gather that if your passphrases are not accepted you cannot even get to the tty or login manager ? Was this a fresh arch install ? Something similar to what you describe happened to me a couple of months ago. It turns out I had forgotten to unmount all my partitions after exiting chroot and rebooting the system for the first time and that basically crashed the system. Had to reinstall everything again.

Yes, I can't get into tty.
Yes, a fresh arch install.
I don't think it's the case, I umounted all partition after exiting the chroot (also I can go back to the live disk and open the disk,type passphrase and get back into chroot).

I think I'm maybe missing something.

fistrosan

Member

Registered: 2020-04-01

Posts: 172

Re: [Solved] Can't type passphrase full disk encryption with LUKS

hmmm I see ... well if you can get your passphrase accepted then there are a few things you can try. For instance, you could try to add new passphrases or a new master key to see if that one is accepted.  See "Adding LUKS keys" here: https://wiki.archlinux.org/index.php/Dm … _LUKS_mode

How does your /boot/grug/grub.cfg look like ? Dou you have cryptdevice enable there ?

And what about your /etc/mkinitcpio.conf ? What hooks do you have enabled there ?

I gather that if your passphrases are not accepted you cannot even get to the tty or login manager ? Was this a fresh arch install ? Something similar to what you describe happened to me a couple of months ago. It turns out I had forgotten to unmount all my partitions after exiting chroot and rebooting the system for the first time and that basically crashed the system. Had to reinstall everything again.

Yes, I can't get into tty.
Yes, a fresh arch install.
I don't think it's the case, I umounted all partition after exiting the chroot (also I can go back to the live disk and open the disk,type passphrase and get back into chroot).

I think I'm maybe missing something.

tim3dman

Member

From: Melbourne, Australia

Registered: 2018-02-15

Posts: 21

Re: [Solved] Can't type passphrase full disk encryption with LUKS

I have lvm on LUKS with autologin(without grub, I use systemd-boot) and it has worked flawlessly for about a year now, unfortunately this means that I've forgotten a lot of the setup. I could cross-check some files if you give me more information?

mkinitcpio.conf HOOKS are -

 HOOKS=(base udev autodetect modconf block keyboard encrypt lvm2 filesystems fsck). 

Last edited by tim3dman (2020-06-12 18:36:26)

ltsdw

Member

Registered: 2020-04-20

Posts: 76

Re: [Solved] Can't type passphrase full disk encryption with LUKS

For instance, you could try to add new passphrases or a new master key to see if that one is accepted.  See "Adding LUKS keys" here: https://wiki.archlinux.org/index.php/Dm … _LUKS_mode

Tried adding a new passphrase, and the result still the same, every key from keyboard that I press prompt me "No key available with this passphrase"

How does your /boot/grug/grub.cfg look like ? Dou you have cryptdevice enable there ?

And what about your /etc/mkinitcpio.conf ? What hooks do you have enabled there ?

I could cross-check some files if you give me more information?

And sure, here /etc/default/grub:

GRUB_ENABLE_CRYPTODISK=y
GRUB_DEFAULT="0"
GRUB_TIMEOUT="5"
GRUB_DISTRIBUTOR="Arch"
GRUB_CMDLINE_LINUX=""
GRUB_PRELOAD_MODULES="part_gpt all_video gfxterm"
GRUB_TERMINAL_INPUT="console"
GRUB_TERMINAL_OUTPUT="gfxterm"
GRUB_GFXMODE="1366x768x32"
GRUB_GFXPAYLOAD_LINUX="keep"
GRUB_DISABLE_RECOVERY="true"
GRUB_CMDLINE_LINUX_DEFAULT="cryptdevice=UUID=<here is the id>:cryptlvm root=/dev/vg/root"

/etc/mkinitcpio.conf:

MODULES=(efivarfs atkbd)
BINARIES=()
FILES=()
HOOKS=(base udev autodetect modconf block keyboard encrypt lvm2 filesystems shutdown)

ltsdw

Member

Registered: 2020-04-20

Posts: 76

Re: [Solved] Can't type passphrase full disk encryption with LUKS

Sorry, looked at wrong place, wasn't at /etc/default/grub, I'll post the grub.cfg here ASAP.

fistrosan

Member

Registered: 2020-04-01

Posts: 172

Re: [Solved] Can't type passphrase full disk encryption with LUKS

Your /etc/mkinitcpio.conf looks ok to me. No idea why you have a hook for shutdown though ... according to the .conf file that should be there only if your /usr directory is in a different partition. At any rate I don't think that has anything to do with it.

The grub.cfg I would like to see is inside /boot/grub/

When you load the root partition it should read something like: "cryptdevice=/dev/whatever/:allow-discards quiet" right after "the loglevel=whatever"

For instance, you could try to add new passphrases or a new master key to see if that one is accepted.  See "Adding LUKS keys" here: https://wiki.archlinux.org/index.php/Dm … _LUKS_mode

Tried adding a new passphrase, and the result still the same, every key from keyboard that I press prompt me "No key available with this passphrase"

How does your /boot/grug/grub.cfg look like ? Dou you have cryptdevice enable there ?

And what about your /etc/mkinitcpio.conf ? What hooks do you have enabled there ?

I could cross-check some files if you give me more information?

And sure, here /etc/default/grub:

GRUB_ENABLE_CRYPTODISK=y
GRUB_DEFAULT="0"
GRUB_TIMEOUT="5"
GRUB_DISTRIBUTOR="Arch"
GRUB_CMDLINE_LINUX=""
GRUB_PRELOAD_MODULES="part_gpt all_video gfxterm"
GRUB_TERMINAL_INPUT="console"
GRUB_TERMINAL_OUTPUT="gfxterm"
GRUB_GFXMODE="1366x768x32"
GRUB_GFXPAYLOAD_LINUX="keep"
GRUB_DISABLE_RECOVERY="true"
GRUB_CMDLINE_LINUX_DEFAULT="cryptdevice=UUID=<here is the id>:cryptlvm root=/dev/vg/root"

/etc/mkinitcpio.conf:

MODULES=(efivarfs atkbd)
BINARIES=()
FILES=()
HOOKS=(base udev autodetect modconf block keyboard encrypt lvm2 filesystems shutdown)

tim3dman

Member

From: Melbourne, Australia

Registered: 2018-02-15

Posts: 21

Re: [Solved] Can't type passphrase full disk encryption with LUKS

What is the "atkbd" module? have you seen this on stack exchange https://unix.stackexchange.com/question … passphrase ?

tim3dman

Member

From: Melbourne, Australia

Registered: 2018-02-15

Posts: 21

Re: [Solved] Can't type passphrase full disk encryption with LUKS

Caps Lock?? or faulty media?

Last edited by tim3dman (2020-05-08 21:42:28)

tim3dman

Member

From: Melbourne, Australia

Registered: 2018-02-15

Posts: 21

Re: [Solved] Can't type passphrase full disk encryption with LUKS

So you have an AT keyboard?

ltsdw

Member

Registered: 2020-04-20

Posts: 76

Re: [Solved] Can't type passphrase full disk encryption with LUKS

The grub.cfg I would like to see is inside /boot/grub/

When you load the root partition it should read something like: "cryptdevice=/dev/whatever/:allow-discards quiet" right after "the loglevel=whatever"

Here, the grub.cfg:

#
# DO NOT EDIT THIS FILE
#
# It is automatically generated by grub-mkconfig using templates
# from /etc/grub.d and settings from /etc/default/grub
#

### BEGIN /etc/grub.d/00_header ###
insmod part_gpt
insmod all_video
insmod gfxterm
if [ -s $prefix/grubenv ]; then
  load_env
fi
if [ "${next_entry}" ] ; then
   set default="${next_entry}"
   set next_entry=
   save_env next_entry
   set boot_once=true
else
   set default="0"
fi

if [ x"${feature_menuentry_id}" = xy ]; then
  menuentry_id_option="--id"
else
  menuentry_id_option=""
fi

export menuentry_id_option

if [ "${prev_saved_entry}" ]; then
  set saved_entry="${prev_saved_entry}"
  save_env saved_entry
  set prev_saved_entry=
  save_env prev_saved_entry
  set boot_once=true
fi

function savedefault {
  if [ -z "${boot_once}" ]; then
    saved_entry="${chosen}"
    save_env saved_entry
  fi
}

function load_video {
  if [ x$feature_all_video_module = xy ]; then
    insmod all_video
  else
    insmod efi_gop
    insmod efi_uga
    insmod ieee1275_fb
    insmod vbe
    insmod vga
    insmod video_bochs
    insmod video_cirrus
  fi
}

if [ x$feature_default_font_path = xy ] ; then
   font=unicode
else
insmod lvm
insmod ext2
set root='lvmid/8yqKM5-yNsT-R8mk-LZE7-LHro-nlgN-eFcbFY/Nk78Ya-NoOj-4rsJ-LKEs-Ba3r-Exnv-6e0iRQ'
if [ x$feature_platform_search_hint = xy ]; then
  search --no-floppy --fs-uuid --set=root --hint='lvmid/8yqKM5-yNsT-R8mk-LZE7-LHro-nlgN-eFcbFY/Nk78Ya-NoOj-4rsJ-LKEs-Ba3r-Exnv-6e0iRQ'  77e4d21c-dd09-4e37-a704-8f7ef78caa6f
else
  search --no-floppy --fs-uuid --set=root 77e4d21c-dd09-4e37-a704-8f7ef78caa6f
fi
    font="/usr/share/grub/unicode.pf2"
fi

if loadfont $font ; then
  set gfxmode=1366x768x32
  load_video
  insmod gfxterm
  set locale_dir=$prefix/locale
  set lang=en_US
  insmod gettext
fi
terminal_input console
terminal_output gfxterm
if [ x$feature_timeout_style = xy ] ; then
  set timeout_style=menu
  set timeout=5
# Fallback normal timeout code in case the timeout_style feature is
# unavailable.
else
  set timeout=5
fi
### END /etc/grub.d/00_header ###

### BEGIN /etc/grub.d/10_linux ###
menuentry 'Arch Linux' --class arch --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-simple-77e4d21c-dd09-4e37-a704-8f7ef78caa6f' {
	load_video
	set gfxpayload=keep
	insmod gzio
	insmod part_gpt
	insmod ext2
	set root='hd0,gpt2'
	if [ x$feature_platform_search_hint = xy ]; then
	  search --no-floppy --fs-uuid --set=root --hint-ieee1275='ieee1275//disk@0,gpt2' --hint-bios=hd0,gpt2 --hint-efi=hd0,gpt2 --hint-baremetal=ahci0,gpt2  37e26727-5e80-4e7e-affb-544c27f7e2e7
	else
	  search --no-floppy --fs-uuid --set=root 37e26727-5e80-4e7e-affb-544c27f7e2e7
	fi
	echo	'Loading Linux linux ...'
	linux	/vmlinuz-linux root=/dev/mapper/vg-root rw  cryptdevice=UUID=35790948-11bf-49a3-9e31-3094f926f83c:cryptlvm root=/dev/vg/root
	echo	'Loading initial ramdisk ...'
	initrd	/intel-ucode.img /initramfs-linux.img
}
submenu 'Advanced options for Arch Linux' $menuentry_id_option 'gnulinux-advanced-77e4d21c-dd09-4e37-a704-8f7ef78caa6f' {
	menuentry 'Arch Linux, with Linux linux' --class arch --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-linux-advanced-77e4d21c-dd09-4e37-a704-8f7ef78caa6f' {
		load_video
		set gfxpayload=keep
		insmod gzio
		insmod part_gpt
		insmod ext2
		set root='hd0,gpt2'
		if [ x$feature_platform_search_hint = xy ]; then
		  search --no-floppy --fs-uuid --set=root --hint-ieee1275='ieee1275//disk@0,gpt2' --hint-bios=hd0,gpt2 --hint-efi=hd0,gpt2 --hint-baremetal=ahci0,gpt2  37e26727-5e80-4e7e-affb-544c27f7e2e7
		else
		  search --no-floppy --fs-uuid --set=root 37e26727-5e80-4e7e-affb-544c27f7e2e7
		fi
		echo	'Loading Linux linux ...'
		linux	/vmlinuz-linux root=/dev/mapper/vg-root rw  cryptdevice=UUID=35790948-11bf-49a3-9e31-3094f926f83c:cryptlvm root=/dev/vg/root
		echo	'Loading initial ramdisk ...'
		initrd	/intel-ucode.img /initramfs-linux.img
	}
	menuentry 'Arch Linux, with Linux linux (fallback initramfs)' --class arch --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-linux-fallback-77e4d21c-dd09-4e37-a704-8f7ef78caa6f' {
		load_video
		set gfxpayload=keep
		insmod gzio
		insmod part_gpt
		insmod ext2
		set root='hd0,gpt2'
		if [ x$feature_platform_search_hint = xy ]; then
		  search --no-floppy --fs-uuid --set=root --hint-ieee1275='ieee1275//disk@0,gpt2' --hint-bios=hd0,gpt2 --hint-efi=hd0,gpt2 --hint-baremetal=ahci0,gpt2  37e26727-5e80-4e7e-affb-544c27f7e2e7
		else
		  search --no-floppy --fs-uuid --set=root 37e26727-5e80-4e7e-affb-544c27f7e2e7
		fi
		echo	'Loading Linux linux ...'
		linux	/vmlinuz-linux root=/dev/mapper/vg-root rw  cryptdevice=UUID=35790948-11bf-49a3-9e31-3094f926f83c:cryptlvm root=/dev/vg/root
		echo	'Loading initial ramdisk ...'
		initrd	/initramfs-linux-fallback.img
	}
}

### END /etc/grub.d/10_linux ###

### BEGIN /etc/grub.d/20_linux_xen ###
### END /etc/grub.d/20_linux_xen ###

### BEGIN /etc/grub.d/30_os-prober ###
### END /etc/grub.d/30_os-prober ###

### BEGIN /etc/grub.d/30_uefi-firmware ###
menuentry 'UEFI Firmware Settings' $menuentry_id_option 'uefi-firmware' {
	fwsetup
}
### END /etc/grub.d/30_uefi-firmware ###

### BEGIN /etc/grub.d/40_custom ###
# This file provides an easy way to add custom menu entries.  Simply type the
# menu entries you want to add after this comment.  Be careful not to change
# the 'exec tail' line above.
### END /etc/grub.d/40_custom ###

### BEGIN /etc/grub.d/41_custom ###
if [ -f  ${config_directory}/custom.cfg ]; then
  source ${config_directory}/custom.cfg
elif [ -z "${config_directory}" -a -f  $prefix/custom.cfg ]; then
  source $prefix/custom.cfg;
fi
### END /etc/grub.d/41_custom ###

ltsdw

Member

Registered: 2020-04-20

Posts: 76

Re: [Solved] Can't type passphrase full disk encryption with LUKS

What is the "atkbd" module? have you seen this on stack exchange https://unix.stackexchange.com/question … passphrase ?

Second the atkbd(4):

DESCRIPTION
     The atkbd driver, together    with the atkbdc    driver,    provides access    to the
     AT    84 keyboard or the AT enhanced keyboard    which is connected to the AT
     keyboard controller.

     This driver is required for the console driver syscons(4) or vt(4).

     There can be only one atkbd device    defined    in the kernel configuration
     file.  This device    also requires the atkbdc keyboard controller to    be
     present.  The irq number must always be 1;    there is no provision of
     changing the number.

Caps Lock?? or faulty media?
So you have an AT keyboard?

So, not really, I was thinking 'well... If my keyboard stops when I run rmmod atkbd, then I should put it at modules because I can't click on nothing without seeing the thing telling me that my passphrase is wrong' xD, but the result is the same with or without it.

ltsdw

Member

Registered: 2020-04-20

Posts: 76

Re: [Solved] Can't type passphrase full disk encryption with LUKS

...because I can't click on nothing without seeing the thing telling me that my passphrase is wrong...

Well, I wouldn't say nothing though, because I can click on shift, alt, caps and super, everything else will tell me that my passphrase is wrong.

tim3dman

Member

From: Melbourne, Australia

Registered: 2018-02-15

Posts: 21

Re: [Solved] Can't type passphrase full disk encryption with LUKS

Hmmm interesting problem. I would say just dive in and learn about the problem. It's probably something small but obviously not insignificant. This is how I've learnt while using arch by solving the problems that crop up. Keep googling too because I bet that you're not the first person to have had this issue and somebody has probably solved it before.

loqs

Member

Registered: 2014-03-06

Posts: 19,076

Re: [Solved] Can't type passphrase full disk encryption with LUKS

Regression in grub-git?  If you replace grub-git with grub and change the encryption format to luks1 without changing anything else can grub then open the container?
Edit:
If it is grub that is failing to open the container rather than the initrd then changes to the kernel / initrd / userspace will not have any effect as they are not loaded until grub has unlocked the container.
Are you following https://wiki.archlinux.org/index.php/Dm … ion_(GRUB) if not which other method are you following?

Last edited by loqs (2020-05-08 22:47:56)

ltsdw

Member

Registered: 2020-04-20

Posts: 76

Re: [Solved] Can't type passphrase full disk encryption with LUKS

As I mounted the disk with arch live usb to run a instance of X to get firefox working inside chroot, to post the content of grub.cfg here and respond you guys, after exiting chroot again, umounting the partitions and rebooting normally I was able to type my passphrase... I just can't explain why though.

I'll let this issue open to test things and see if I can break it again. It has to be a explanation.

ltsdw

Member

Registered: 2020-04-20

Posts: 76

Re: [Solved] Can't type passphrase full disk encryption with LUKS

Regression in grub-git?  If you replace grub-git with grub and change the encryption format to luks1 without changing anything else can grub then open the container?
Edit:
If it is grub that is failing to open the container rather than the initrd then changes to the kernel / initrd / userspace will not have any effect as they are not loaded until grub has unlocked the container.
Are you following https://wiki.archlinux.org/index.php/Dm … ion_(GRUB) if not which other method are you following?

I don't think it's grub, and yes almost exactly like that, except that my sda1 is mounted as /efi and sda2 as /boot.

loqs

Member

Registered: 2014-03-06

Posts: 19,076

Re: [Solved] Can't type passphrase full disk encryption with LUKS

Regression in grub-git?  If you replace grub-git with grub and change the encryption format to luks1 without changing anything else can grub then open the container?
Edit:
If it is grub that is failing to open the container rather than the initrd then changes to the kernel / initrd / userspace will not have any effect as they are not loaded until grub has unlocked the container.
Are you following https://wiki.archlinux.org/index.php/Dm … ion_(GRUB) if not which other method are you following?

I don't think it's grub, and yes almost exactly like that, except that my sda1 is mounted as /efi and sda2 as /boot.

Please provide specifics of the exact layout either a diagram as used in the wiki or the commands you used to create the partitions,  containers,  filesystems and setup the mounts.
If you did not base your setup on the wiki section I linked to what was it based on?

If sda2 is mounted to /boot then /boot is not encrypted so why the need for grub-git?
Edit:
If you do not believe it is grub that is the cause does that mean the boot progressed beyond grub?

Last edited by loqs (2020-05-08 23:10:53)

ltsdw

Member

Registered: 2020-04-20

Posts: 76

Re: [Solved] Can't type passphrase full disk encryption with LUKS

If sda2 is mounted to /boot then /boot is not encrypted so why the need for grub-git?
Edit:
If you do not believe it is grub that is the cause does that mean the boot progressed beyond grub?

Sure, here the lsblk:

NAME          MOUNTPOINT
sda                   
|-sda1          /efi
|-sda2          /boot
\-sda3
   \-cryptlvm
       |-vg-swap
       |-vg-root      /
       \-vg-home      /home

So, yeah you was right about the /boot not being encrypted, I got myself confused I was thinking that if the boot was being mounted inside an encrypted partition (/ in case) the grub needed cryptodisk enabled, but no I don't need that in this case.
And yeah, what was happening I don't think that was grub, because after chrooting again, getting out of it and rebooting I was able to type my passphrase (I just can't explain how though because I tried that before, I even changed the passphrase and didn't worked)

ltsdw

Member

Registered: 2020-04-20

Posts: 76

Re: [Solved] Can't type passphrase full disk encryption with LUKS

So that is it guys, I wasn't able to reproduce it again, I even reinstalled all again, and nothing, everything worked as it supposed. Marking as solved! Thank you all