Arch Linux

ziomarco

Member

From: italy

Registered: 2018-09-09

Posts: 31

Dm-crypt and autologin

Hello everybody!
This is not really a problem, but just a whim, so be patient....

Last week i bought a refurbished Dell Latitude 5580 laptop.
I plain to use it with Arch, so i configure dual boot Arch and W10 using syslinux.
The partition scheme is the following:

   Device        Boot            Start       End         Sectors    Size    Id   Type
    /dev/sda1     *              2048  104447     102400    50M     7 HPFS/NTFS/exFAT
    /dev/sda2                  104448  290116535  290012088  138,3G  7 HPFS/NTFS/exFAT
    /dev/sda3               499048448  500113407   1064960    520M   27 Hidden NTFS WinRE
    /dev/sda4               290117632  499048447  208930816   99,6G     5 Extended
    ├─/dev/sda5             290119680  374005759  83886080   40G  83 Linux
    ├─/dev/sda6             374007808  415950847  41943040   20G  83 Linux
    └─/dev/sda7             415952896  499048447  8309555   39,6G  83 Linux

sda5 is the root partition, sda7 is a data-storge partition and sda6 is a LUKS encripted partition (not /home).
I configured that encripted partition to be unlocked automatically at login following the wiki: https://wiki.archlinux.org/title/Dm-cry … g_at_login

Everything works smoothly  when I authenticate both in text mode and with Lxde...so I'm happy anyway!

Later I tried (as final touch...) the autologin function expecting a normal session with only the decrypt failed. Unfortunately the system remains blocked for several minutes with a black screen, then finally lxde starts quite normal.
Obviously I agree that the decrypt fails because the password has not been entered, >it's an essential security measure, but I would like Lxde to start with no delay.

> with 'autologin off' the user should be able to use both the computer and the encryped data only if he knows the pass,
> with 'autologin on' instead he can still use the computer, but not the encrypted data if he  doesn't know the pass 

Do you think it is absurd to get such behavior?

The alternative solution would be to deactivate both autologin and unlocking at login,
but in this case we have to enter password twice (one time at login and one time to unlock...)

I expect a bright idea from someone, in the meantime thanks for your attention!

jonno2002

Member

Registered: 2016-11-21

Posts: 888

Re: Dm-crypt and autologin

add

nofail,noauto,x-systemd.device-timeout=10 

to your fstab for the encrypted partition?

EDIT:

also try adding this to your "/etc/pam_cryptsetup.sh":

if [ "$PAM_USER" = "$CRYPT_USER" ] && [ ! -e "/dev/mapper/$NAME" ] && grep "#autologin" /etc/lxdm/lxdm.conf > /dev/null; then
    /usr/bin/cryptsetup open "$PARTITION" "$NAME"
fi

change the "#autologin" to "# autologin" if you have a leading space in your config file.

Last edited by jonno2002 (2022-05-08 23:03:15)

ziomarco

Member

From: italy

Registered: 2018-09-09

Posts: 31

Re: Dm-crypt and autologin

Thanks jonno2002!
Your first solution  can't work: the encrypted partition is not referenced in fstab...
The second one is VERY good!
I can't try it just now, but I will very soon

ziomarco

Member

From: italy

Registered: 2018-09-09

Posts: 31

Re: Dm-crypt and autologin

I'm back, after doing some tests...
The solution I liked so much unfortunately didn't work.
I found that the starting delay is due by the systemd unit who try to mount the file even when the decrypt is not performed.

So I disabled the myfile.mount unit and execute an expicit  mount after the decrypt in /etc/pam_cryptsetup.sh

  if [ "$PAM_USER" = "$CRYPT_USER" ] && [ "grep #autologin /etc/lxdm/lxdm.conf " ] && [! -e "/dev/mapper/$NAME" ] ; then
   /usr/bin/cryptsetup open "$PARTITION" "$NAME"
   mount -t ext4 /dev/mapper/"$NAME"   /"$NAME"
fi
  

Probably someone who knows systemd better than me would find a more elegant solution... my workaround is quite dirty...

Last edited by ziomarco (2022-05-12 09:13:37)