Arch Linux

hweom

Member

Registered: 2017-09-25

Posts: 19

Can't setup dm-crypt at login

I've done everything as written here: https://wiki.archlinux.org/index.php/Dm … g_at_login, but my encrypted drive is not mounted on login.

I've tried manually running

cryptsetup open /dev/<my_device> home-<my_home>

and it works fine.

So I've tried to debug it and ended up with the following /etc/pam.d/system-login:

...
auth   optional   pam_exec.so debug log=/tmp/pamlog.txt /tmp/run.sh

with /tmp/run.sh is like this:

echo "!!!!" &> /tmp/result.txt
0

When I try to login, I get this:

login: <my_login>
Password: *****
/tmp/run.sh failed: exit code 8

and no /tmp/result.txt is created. /tmp/pamlog.txt contains just a single timestamp.

So my understanding is that pam_exec is not working. Is there anything I can do about it?

My PAM version is 1.3.0-1

hweom

Member

Registered: 2017-09-25

Posts: 19

Re: Can't setup dm-crypt at login

OK, i figured out the problem in my initial post -- it was bad permissions for the script. Silly me.

Anyway, I was able to successfully do pam_exec to unlock the device. I've tried to use automount to then mount the volume, but faced the same problem as here: https://bbs.archlinux.org/viewtopic.php?id=229588 (GDM freezing).

So I decided to go with pam_mount way instead. Unfortunately, it seems that mount.crypt is not able to mount LUKS2 volumes.

# cryptsetup luksDump /dev/nvme0n1p6

LUKS header information
Version: 2
Epoch:   3
....
Keyslots:
  0: luks2
           Key:     256 bits
           Cipher: aes-xts-plain64
           ...
Tokens:
Digests:
  0: pbkdf2
           Hash: sha256
           ...

Then I try to run mount.crypt manually:

# mount.crypt -v -o cipher=aes-xts-plain64,hash=sha256,fstype=ext4 /dev/nvme0n1p6 /home/<my_username>

(mtcrypt.c:527): keysize=0 trunc_keysize=32
(crypto-dmc.c:167): Using _dev_nvme0n1p6 as dmdevice name
command: 'mount' '-t' '-o' 'helper=crypt' '/dev/mapper/_dev_nvme0n1p6' '/home/<my_username>'
[ 3292.3969] EXT4-fs (dm-0): VFS: Can't find ext4 filesystem
mount: /home/<my_username>: wrong fs type, bad option, bad superblock on /dev/mapper/_dev_nvme0n1p6, missing codepage or helper program, or other error.
mount failed with run_sync status 32

I can mount the volume just fine by manually running cryptsetup and then mount.

NoSuck

Member

Registered: 2015-03-04

Posts: 157

Website

Re: Can't setup dm-crypt at login

Any reason you're not using crypttab?

---

Pure ALSA Loopback

hweom

Member

Registered: 2017-09-25

Posts: 19

Re: Can't setup dm-crypt at login

My understanding is that crypttab will ask for a password during boot. What I want is the password that I enter during login to be used to unlock and mount the home partition.

NoSuck

Member

Registered: 2015-03-04

Posts: 157

Website

Re: Can't setup dm-crypt at login

Interesting.  I had not considered such a usage case.  Thanks for explaining.

Given that you trust login credentials enough to unlock this drive, you may be able to store the LUKS passphrase in a keyfile and set the appropriate file permissions.

Last edited by NoSuck (2018-02-25 06:25:09)

---

Pure ALSA Loopback

hweom

Member

Registered: 2017-09-25

Posts: 19

Re: Can't setup dm-crypt at login

Given that you trust login credentials enough to unlock this drive, you may be able to store the LUKS passphrase in a keyfile and set the appropriate file permissions.

Hmm, how is the login password less secure than the password entered during the boot time?

Two main use-cases that I want to cover are:
1) stolen laptop and
2) repair shops (i.e. having a possibility to send a laptop for a repair without fearing for my data).

Keyfile can be recovered by anyone with a physical access to the hard drive (both use-cases above).

I'd like the protection to be least intrusive, as I'm too lazy to type in 2 passwords Using the login password to unlock the partition is one possibility, having a boot-time decryption password with an autologin is another. The latter is less convenient for repairs though, as repair shops may need to be able to boot into OS as a part of their job.

This is the first time I'm trying encryption on Arch, and just looking at the Wiki, I got the impression that auto-mounting encrypted home partition is a well-developed and stable thing. Imagine my surprise when I found out that out of 2 alternative Wiki articles none actually works!

frostschutz

Member

Registered: 2013-11-15

Posts: 1,658

Re: Can't setup dm-crypt at login

If you have a LUKS header on there, you should open it with LUKS, not with plain. LUKS always uses a random key unrelated to your passphrase. Also there is a data offset for the LUKS header.

dr4Ke

Member

Registered: 2015-10-27

Posts: 1

Re: Can't setup dm-crypt at login

Replying to this relatively old thread as I faced the same issue here.

The cause seems to be that LUKS v2 is not supported by mount.crypt from pam_mount: https://sourceforge.net/p/pam-mount/bugs/127/

I ended up with a bash script to support this new LUKS format: https://framagit.org/dr4Ke/mount.crypt_luks2

Last edited by dr4Ke (2019-08-29 15:22:07)