Arch Linux

gabe.benson

Member

Registered: 2011-08-16

Posts: 38

LUKS Keyfile on SD Card

Hey guys,

I've got a media server I'm running with an 8tb encrypted volume spread over two 4tb drives with lvm.  I mount this volume at /mnt/data in FSTAB, but am unable to get it to unlock automatically at boot using a keyfile I have stored on an SD card.

The sd card is formatted with btrfs, and crypttab reads as follows:

cryptDisk    /dev/lvmblock/disk    /dev/disk/by-uuid/[UUID]:btrfs:/keyfile    luks

When I boot, it hangs for a minute and a half with systemd saying there's a pending job, after this fails, it drops to a recovery terminal due to fstab not finding the volume to mount.  I'm pulling my hair out and haven't been able to find any resources relevant to arch (most are for debian/ubuntu and use extra keyfile scripts that I don't think are present in Arch).  Any ideas?

frostschutz

Member

Registered: 2013-11-15

Posts: 1,658

Re: LUKS Keyfile on SD Card

btrfs is sometimes a bit of a special case, does it not work with a more traditional filesystem either?

Also, how is the SD cardreader connected to the system? I'm not sure if e.g. mmcblock or usb storage modules are loaded by this point if you do not put them explicitely into your configuration.

In the shell does the UUID show up in /dev/disk/by-uuid at all?And for that matter, is /dev/lvmblock/disk present? Is btrfs listed in /proc/filesystems?

Last edited by frostschutz (2015-02-14 21:46:48)

gabe.benson

Member

Registered: 2011-08-16

Posts: 38

Re: LUKS Keyfile on SD Card

The card reader is built into my case, so I don't think it's usb, but I honestly have no clue.  I'll look into this, but if you (or anyone) has any insight, I'd definitely appreciate it!

The UUID, lvmblock/disk, and btrfs are all present.  The only reason it drops to the shell is because I have the unlocked volume listed in fstab.  If I comment it out, after timing out trying to find the keyfile, it continues to boot normally and I have no issues.

EDIT: I haven't tried it with a filesystem other than btrfs, but in the past when I've had similar setups I had no issues with it.

Last edited by gabe.benson (2015-02-15 02:58:53)

nstgc

Member

Registered: 2014-03-17

Posts: 393

Re: LUKS Keyfile on SD Card

I can confirm that this should work. I've unlocked my system with a key file stored on a btrfs partition on both a USB and an SD card.

gabe.benson

Member

Registered: 2011-08-16

Posts: 38

Re: LUKS Keyfile on SD Card

Did you have your entire system encrypted, or just an extra partition that would be unlocked following the initial boot sequence?

In the past I had my entire system encrypted and would unlock it using a keyfile on a usb drive, but now I've just got the extra volume I want to unlock following the boot of the system.

nstgc

Member

Registered: 2014-03-17

Posts: 393

Re: LUKS Keyfile on SD Card

I have two drives in my laptop. The first is a HDD which is completely encrypted. I then have an SSD with the root partition encrypted. GRUB unlocks the root partition.

It works the exact same was as with a USB.

https://bbs.archlinux.org/viewtopic.php?id=192858