You are not logged in.
...then it times out after 90 seconds and I'm into an emergency rescue commandline.
I installed ArchLinux without lvm-on-luks and had no problems. Then I turned on lvm-on-luks and I can't get past the above error message.
btw: I've installed multiple linux systems for friends and self for >10 years but never had this much trouble. The last week has been fruitless.
I've adjusted HOOKS= many ways. I've directly edited grub.cfg (grub2) many times. I've rebuilt with mkinitcpio, grub-install, grub-mkconfig many times. I've googled/read ~30 pages. I can show every command I've tried because everything is scripted. I always use UUID since the /dev/sdx is unpredictable. The only way I can get grub to ask for a passphrase is if I force cryptomount -u into unconditional execution somewhere. See grub.cfg below.
Not using EFI (my machine is a little bit too old). Gave up on systemd sd-encrypt sd-lvm2 reasoning that encrypt lvm is simpler (after many sd tries...but I'll be overjoyed with ANYTHING that WORKS!!).
Any help would be appreciated. Should I paste up grub.cfg first? Or maybe the script I used to build ArchLinux?
Or maybe hardware versions list? I'll guess grub.cfg first.
If no one responds here I'm gonna give up on encrypting Arch Linux.
#
# DO NOT EDIT THIS FILE
#
# It is automatically generated by grub-mkconfig using templates
# from /etc/grub.d and settings from /etc/default/grub
#
debug=1
pager=1
### BEGIN /etc/grub.d/00_header ###
insmod part_gpt
insmod part_msdos
if [ -s $prefix/grubenv ]; then
load_env
fi
if [ "${next_entry}" ] ; then
set default="${next_entry}"
set next_entry=
save_env next_entry
set boot_once=true
else
set default="0"
fi
echo "feature_menuentry_id == $feature_menuentry_id"
if [ x"${feature_menuentry_id}" = xy ]; then
menuentry_id_option="--id"
else
menuentry_id_option=""
fi
export menuentry_id_option
echo "prev_saved_entry == $prev_saved_entry"
if [ "${prev_saved_entry}" ]; then
set saved_entry="${prev_saved_entry}"
save_env saved_entry
set prev_saved_entry=
save_env prev_saved_entry
set boot_once=true
fi
function savedefault {
echo "boot_once == $boot_once"
if [ -z "${boot_once}" ]; then
saved_entry="${chosen}"
save_env saved_entry
fi
}
function load_video {
echo "feature_all_video_module == $feature_all_video_module"
if [ x${feature_all_video_module} = xy ]; then
insmod all_video
else
insmod efi_gop
insmod efi_uga
insmod ieee1275_fb
insmod vbe
insmod vga
insmod video_bochs
insmod video_cirrus
fi
}
insmod part_msdos
insmod cryptodisk
insmod luks
insmod gcry_rijndael
insmod gcry_rijndael
insmod gcry_sha256
insmod lvm
insmod ext2
cryptomount -u 1f543b596e7e4393be7e95edc84d838e
set root='lvmid/vLOohp-9pMb-Bun0-vF4X-EU1s-Wz3p-IlBZTo/dl2uXV-8p90-0NQ2-spV7-E1Id-8HqF-gS7bAO'
echo "feature_platform_search_hint == $feature_platform_search_hint"
#if [ x${feature_platform_search_hint} = xy ]; then
search --no-floppy --fs-uuid --set=root --hint='lvmid/vLOohp-9pMb-Bun0-vF4X-EU1s-Wz3p-IlBZTo/dl2uXV-8p90-0NQ2-spV7-E1Id-8HqF-gS7bAO' 9d0f162f-2ee3-46b0-a073-093b3987eaae
#else
# search --no-floppy --fs-uuid --set=root 9d0f162f-2ee3-46b0-a073-093b3987eaae
#fi
echo "feature_default_font_path == $feature_default_font_path"
if [ x${feature_default_font_path} = xy ] ; then
font=unicode
else
echo "root == $root"
font="/usr/share/grub/unicode.pf2"
fi
if loadfont $font ; then
set gfxmode=auto
load_video
insmod gfxterm
set locale_dir=$prefix/locale
set lang=en_US
insmod gettext
fi
terminal_input console
terminal_output gfxterm
echo "feature_timeout_style == $feature_timeout_style"
if [ x${feature_timeout_style} = xy ] ; then
set timeout_style=menu
set timeout=5
# Fallback normal timeout code in case the timeout_style feature is
# unavailable.
else
set timeout=5
fi
### END /etc/grub.d/00_header ###
### BEGIN /etc/grub.d/10_linux ###
menuentry 'Arch Linux' --class arch --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-simple-9d0f162f-2ee3-46b0-a073-093b3987eaae' {
load_video
set gfxpayload=keep
insmod gzio
insmod part_msdos
insmod ext2
set root='hd3,msdos1'
echo "feature_platform_search_hint == $feature_platform_search_hint"
if [ x${feature_platform_search_hint} = xy ]; then
search --no-floppy --fs-uuid --set=root --hint-bios=hd3,msdos1 --hint-efi=hd3,msdos1 --hint-baremetal=ahci3,msdos1 11dd06df-262b-4679-9dd8-9730bcaf6197
else
search --no-floppy --fs-uuid --set=root 11dd06df-262b-4679-9dd8-9730bcaf6197
fi
echo 'Loading Linux linux ...'
linux /vmlinuz-linux rw cryptdevice=UUID=1f543b59-6e7e-4393-be7e-95edc84d838e:clvm splash root=/dev/mapper/cvg-root
echo 'Loading initial ramdisk ...'
initrd /initramfs-linux.img
}
submenu 'Advanced options for Arch Linux' $menuentry_id_option 'gnulinux-advanced-9d0f162f-2ee3-46b0-a073-093b3987eaae' {
menuentry 'Arch Linux, with Linux linux' --class arch --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-linux-advanced-9d0f162f-2ee3-46b0-a073-093b3987eaae' {
load_video
set gfxpayload=keep
insmod gzio
insmod part_msdos
insmod ext2
set root='hd3,msdos1'
if [ x$feature_platform_search_hint = xy ]; then
search --no-floppy --fs-uuid --set=root --hint-bios=hd3,msdos1 --hint-efi=hd3,msdos1 --hint-baremetal=ahci3,msdos1 11dd06df-262b-4679-9dd8-9730bcaf6197
else
search --no-floppy --fs-uuid --set=root 11dd06df-262b-4679-9dd8-9730bcaf6197
fi
echo 'Loading Linux linux ...'
linux /vmlinuz-linux rw cryptdevice=UUID=1f543b59-6e7e-4393-be7e-95edc84d838e:clvm splash # root=/dev/mapper/cvg-root
echo 'Loading initial ramdisk ...'
initrd /initramfs-linux.img
}
menuentry 'Arch Linux, with Linux linux (fallback initramfs)' --class arch --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-linux-fallback-9d0f162f-2ee3-46b0-a073-093b3987eaae' {
load_video
set gfxpayload=keep
insmod gzio
insmod part_msdos
insmod ext2
set root='hd3,msdos1'
if [ x$feature_platform_search_hint = xy ]; then
search --no-floppy --fs-uuid --set=root --hint-bios=hd3,msdos1 --hint-efi=hd3,msdos1 --hint-baremetal=ahci3,msdos1 11dd06df-262b-4679-9dd8-9730bcaf6197
else
search --no-floppy --fs-uuid --set=root 11dd06df-262b-4679-9dd8-9730bcaf6197
fi
echo 'Loading Linux linux ...'
linux /vmlinuz-linux root=/dev/mapper/cvg-root rw cryptdevice=UUID=1f543b59-6e7e-4393-be7e-95edc84d838e:clvm splash
echo 'Loading initial ramdisk ...'
initrd /initramfs-linux-fallback.img
}
}
### END /etc/grub.d/10_linux ###
### BEGIN /etc/grub.d/20_linux_xen ###
### END /etc/grub.d/20_linux_xen ###
### BEGIN /etc/grub.d/30_os-prober ###
### END /etc/grub.d/30_os-prober ###
### BEGIN /etc/grub.d/40_custom ###
# This file provides an easy way to add custom menu entries. Simply type the
# menu entries you want to add after this comment. Be careful not to change
# the 'exec tail' line above.
### END /etc/grub.d/40_custom ###
### BEGIN /etc/grub.d/41_custom ###
if [ -f ${config_directory}/custom.cfg ]; then
source ${config_directory}/custom.cfg
elif [ -z "${config_directory}" -a -f $prefix/custom.cfg ]; then
source $prefix/custom.cfg;
fi
### END /etc/grub.d/41_custom ###
Last edited by linExperiment (2016-12-01 19:55:58)
Offline
According to your grub cryptdevice entry you're mounting your decrypted LVM as /dev/mapper/clvm but then have your root device specified as /dev/mapper/cvg-root (instead of /dev/mapper/clvm-root).
Last edited by Slithery (2016-11-30 21:34:46)
Offline
Yes, these were built by mkconfig from the following partition structure creation commands.
I'm building an unecrypted boot partition, then an encrypted lvm partition containing root, home, and swap.
Unless I did something truly stupid here, this is meant to be a generalization of the script provided by Pavel Kogan at http://www.pavelkogan.com/2014/05/23/lu … ncryption/.
I'm assuming here that $CryptSyllable need not (should not?) be the same as $VGname
...unless I'm being stupid.
export DevRoot=${1:-"/dev/sda"}
export CryptDevice=${DevRoot}2 # device for encrypted container
export CryptSyllable=clvm
export CryptDevUUID=`uuidgen`
export clvmRoot=/dev/mapper/${CryptSyllable} # encrypted container
export VGname=cvg # vg
export BootDevice=${DevRoot}1 # unencrypted plain volume
# <snip>
parted -s ${DevRoot} mklabel msdos
parted -s ${DevRoot} -a optimal mkpart primary 2M 200M # sdx1 partition
parted -s ${DevRoot} -a optimal mkpart primary 200M 100% # sdx2 partition
tune2fs -f -L ARCH-LINUX-BOOT ${BootDevice} # are these working?
tune2fs -f -L ARCH-LINUX-MAIN ${CryptDevice}
parted -s ${DevRoot} print
# initialize the encryption for the new partition(s)
cryptsetup luksFormat --uuid=${CryptDevUUID} ${CryptDevice}
cryptsetup luksOpen ${CryptDevice} ${CryptSyllable} # encrypted container
# set up the volume group
pvcreate ${clvmRoot} # prep the physical volume to be a member of a VolGrp
vgcreate ${VGname} ${clvmRoot} # add the crypted pv member to a new VolGrp
# create all the new logical volumes (lvcreate INSERTS VGname- before each name
lvcreate -L 4G ${VGname} -n swap
lvcreate -L 15G ${VGname} -n root
lvcreate -l +100%FREE ${VGname} -n home
#lvdisplay
# format and mount all the new logical volumes
mkswap -L swap /dev/mapper/${VGname}-swap
mkfs.ext4 /dev/mapper/${VGname}-root
mkfs.ext4 /dev/mapper/${VGname}-home
mount /dev/mapper/${VGname}-root /mnt
Offline
Sorry, my mistake.
Make sure you're using the UUID of /dev/sda2 in your grub config - not the UUID of the unlocked luks device.
Can you boot from the install media,unlock your partition and then post the output of...
lsblk -f
Also post your mkinitcpio.conf.
Last edited by Slithery (2016-12-01 00:25:48)
Offline
lsblk -f
NAME FSTYPE LABEL UUID MOUNTPOINT
sda
├─sda2 crypto_LUKS 1f543b59-6e7e-4393-be7e-95edc84d838e
│ └─clvm LVM2_member DOwA8P-yGBZ-VN7p-wbvE-Errc-OU2l-tVFTww
│ ├─cvg-swap swap swap d16ad15c-e265-49f1-811f-16ebe47ae01c [SWAP]
│ ├─cvg-root ext4 9d0f162f-2ee3-46b0-a073-093b3987eaae /mnt
│ └─cvg-home ext4 108f484b-7803-4c81-803d-a0bfb4880c36 /mnt/home
└─sda1 ext4 11dd06df-262b-4679-9dd8-9730bcaf6197 /mnt/boot
Note that I did this OUTSIDE the chroot using the command:
lsblk -f /dev/sda > {myThumbDrive}
I don't know if its significant but INSIDE the chroot this command shows NO uuid's ?!? I have no idea why.
Also, in answer to your uuid question the uuid in the cryptdevice= setting on the linux command begins with 1f5, exactly as in /dev/sda2 in the lsblk -f above.
and here's the mkinitcpio.conf
# vim:set ft=sh
# MODULES
# The following modules are loaded before any boot hooks are
# run. Advanced users may wish to specify all system modules
# in this array. For instance:
# MODULES="piix ide_disk reiserfs"
MODULES=""
# BINARIES
# This setting includes any additional binaries a given user may
# wish into the CPIO image. This is run last, so it may be used to
# override the actual binaries included by a given hook
# BINARIES are dependency parsed, so you may safely ignore libraries
BINARIES=""
# FILES
# This setting is similar to BINARIES above, however, files are added
# as-is and are not parsed in any way. This is useful for config files.
FILES=""
# HOOKS
# This is the most important setting in this file. The HOOKS control the
# modules and scripts added to the image, and what happens at boot time.
# Order is important, and it is recommended that you do not change the
# order in which HOOKS are added. Run 'mkinitcpio -H <hook name>' for
# help on a given hook.
# 'base' is _required_ unless you know precisely what you are doing.
# 'udev' is _required_ in order to automatically load modules
# 'filesystems' is _required_ unless you specify your fs modules in MODULES
# Examples:
## This setup specifies all modules in the MODULES setting above.
## No raid, lvm2, or encrypted root is needed.
# HOOKS="base"
#
## This setup will autodetect all modules for your system and should
## work as a sane default
# HOOKS="base udev autodetect block filesystems"
#
## This setup will generate a 'full' image which supports most systems.
## No autodetection is done.
# HOOKS="base udev block filesystems"
#
## This setup assembles a pata mdadm array with an encrypted root FS.
## Note: See 'mkinitcpio -H mdadm' for more information on raid devices.
# HOOKS="base udev block mdadm encrypt filesystems"
#
## This setup loads an lvm2 volume group on a usb device.
# HOOKS="base udev block lvm2 filesystems"
#
## NOTE: If you have /usr on a separate partition, you MUST include the
# usr, fsck and shutdown hooks.
HOOKS="base udev keymap autodetect modconf block systemd encrypt lvm2 filesystems keyboard fsck"
# COMPRESSION
# Use this to compress the initramfs image. By default, gzip compression
# is used. Use 'cat' to create an uncompressed image.
#COMPRESSION="gzip"
#COMPRESSION="bzip2"
#COMPRESSION="lzma"
#COMPRESSION="xz"
#COMPRESSION="lzop"
#COMPRESSION="lz4"
# COMPRESSION_OPTIONS
# Additional options for the compressor
#COMPRESSION_OPTIONS=""
Oooops, forgot to remove the systemd on last boot. The result was still the same but I'll rerun/recheck if you think that's important.
Offline
Yep, you do need to remove the systemd hook if your using encrypt and lvm,
If you use the systemd hook then you have to use sd-encrypt and sd-lvm.
Offline
I guess I had to have everything right --- all at the Same Time
...computers are funny like that.
Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You!
Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You!
Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You!
Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You!
Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You!
Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You!
Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You! Thank You!
To Infinity and Beyond! (ok, now where's the dang "Solved" button ...for us newbs)?
Offline
You can mark your thread as [Solved] by editing your first post and prepending it to the title.
Offline
Kool. Thanx.
BTW: while I've still got you on the phone...
that case where lsblk doesn't show the UUID's when inside chroot should possibly be reported as a bug. Also, lsblk (or one of its lib calls) seems to be used by several other utilities so they have the same problem. I've never
chased through the bug reporting process. Could you point me to a webpage tutorial/walkthru where I could do that?
ALSO: I just switched back to "scystemd sd-encrypt sd-lvm2" and got the same failure as the title....I changed nothing else. Should the systemd hook be ordered sooner in the HOOK list? ...or something? Or remove udev? or?
Offline