Cannot decrypt home directory with pam_exec

Unia · 2018-03-05 19:33:53

Hello,

I'm trying to decrypt my home directory automatically at login as described on the Wiki. However, when I try to log in (from getty, no DM yet), nothing gets decrypted and I log in into an empty home directory. When I check the logs, I find the following in my system journal:

mrt 05 20:22:43 envy login[394]: pam_exec(login:auth): /usr/bin/cryptsetup failed: exit code 1
mrt 05 20:22:43 envy login[394]: pam_unix(login:session): session opened for user jente by LOGIN(uid=0)

According to cryptsetup's man page, a return code of 1 means there is a wrong parameter somewhere. However, executing the same command manually as root results in a successful decrypt. I tried adding the debug and log parameters to the pam_exec line, but when I inspect the log it is empty:

 > cat /tmp/mount.log 
*** Mon Mar  5 20:22:41 2018

For reference, here are the excerpts of my fstab:

/dev/mapper/home-jente                     /home/jente  ext4  rw,noatime,noauto 0  0

and /etc/pam.d/system-login:

auth       optional   pam_exec.so expose_authtok log=/tmp/mount.log /usr/bin/cryptsetup open /dev/nvme0n1p3 home-jente

And yes, my log in password is the same as the one for decrypting

I'm not really sure how to continue debugging this, hence this topic. Any pointers are appreciated!

Last edited by Unia (2018-03-05 19:34:47)

x33a · 2018-03-06 04:02:53

Try the stdout or debug parameters for pam_exec, instead of log.

Unia · 2018-03-06 20:05:04

The stdout parameter showed nothing, the debug parameter simply showed that pam_exec is calling cryptsetup, followed by the entry saying cryptsetup failed with exit code 1.

x33a · 2018-03-07 08:07:13

Try using the --type parameter for cryptsetup. Or save all the cryptsetup options in a shell script and call the shell script instead.

Unia · 2018-04-03 20:40:27

Sorry for the long time it took between replies. I did not have time to mess around due to private life.

I have already been using the --type parameter, and have also already tried using a script. For good measure, I just tried again with the following script:

#!/usr/bin/env sh

USER="jente"
PART="/dev/nvme0n1p3"
MOUNT="home-"$USER
MAPPER="/dev/mapper/"$MOUNT

if [ "$PAM_USER" == "$USER" ] && [ ! -e $MAPPER ]; then
	/usr/bin/cryptsetup open --type luks $PART $MOUNT
fi

The line in my PAM config was as follows:

auth       optional   pam_exec.so expose_authtok stdout /usr/local/bin/pam_cryptsetup.sh

However, I am still met with this exit code 1. According to pam_exec's man page, the above line should be correct. Similarly, the cryptsetup command is correct (I am using it to decrypt manually). So, at this point, I think I will start looking into the source code to see where this return value is returned from; maybe that gives a clue.

seth · 2018-04-04 07:42:20

To rule out foolishness (you seem to have followed the wiki but still ;-): the pam_exec call is after the system-auth include?

Unia · 2018-04-04 08:46:05

seth wrote:

To rule out foolishness (you seem to have followed the wiki but still ;-): the pam_exec call is after the system-auth include?

Yes, this is the entire /etc/pam.d/system-login file:

#%PAM-1.0

auth       required   pam_tally.so         onerr=succeed file=/var/log/faillog
auth       required   pam_shells.so
auth       requisite  pam_nologin.so
auth       include    system-auth
auth       optional   pam_exec.so          expose_authtok stdout /usr/local/bin/pam_cryptsetup.sh

account    required   pam_access.so
account    required   pam_nologin.so
account    include    system-auth

password   include    system-auth

session    optional   pam_loginuid.so
session    optional   pam_keyinit.so       force revoke
session    include    system-auth
session    optional   pam_motd.so          motd=/etc/motd
session    optional   pam_mail.so          dir=/var/spool/mail standard quiet
-session   optional   pam_systemd.so
session    required   pam_env.so

Arch Linux

#1 2018-03-05 19:33:53

Cannot decrypt home directory with pam_exec

#2 2018-03-06 04:02:53

Re: Cannot decrypt home directory with pam_exec

#3 2018-03-06 20:05:04

Re: Cannot decrypt home directory with pam_exec

#4 2018-03-07 08:07:13

Re: Cannot decrypt home directory with pam_exec

#5 2018-04-03 20:40:27

Re: Cannot decrypt home directory with pam_exec

#6 2018-04-04 07:42:20

Re: Cannot decrypt home directory with pam_exec

#7 2018-04-04 08:46:05

Re: Cannot decrypt home directory with pam_exec

Board footer