Arch Linux

Baddy Stacks

Member

Registered: 2018-11-12

Posts: 3

Arch + Luks (two-factor)

Hello.

I installed the Arch system on the hard disk and encrypted full-disk using LUKS. However, too long a password is inconvenient to enter each time, and using a short one is not safe. I found an internet solution that combines the key and password. However, this solution was originally written for Debian systems.

https://www.masarlabs.com/article/two-f … ecription/

It seemed to me a very good solution. The key is stored in the first sector on the USB flash drive. The passphrase is added to the key each time. Consequently, even if the flash drive falls into the wrong hands, the attacker will not be able to decrypt the data on the hard disk.

I have completed all the instructions of the author

1. Add keyscript.sh to /etc/security/
2. I filled the disk with zeros and generated the access key in the first sector using dd:
    dd if=/dev/zero    of=/dev/sdb bs=512 seek=1 count=61
    dd if=/dev/urandom of=/dev/sdb bs=512 seek=1 count=61

3. Added a key from the first sector / dev / sdb as an access key for cryptsetup:
   { printf '%s' 'my_pin' ; dd if=/dev/sdb bs=512 skip=1 count=1 ;} > keyfile
    cryptsetup --verbose luksAddKey /dev/sda1 keyfile
    cryptsetup --verbose luksDump /dev/sda1

4. Changed entry in / etc / crypttab

sda1_crypt UUID=crypto disk /dev/sdb:1 luks,keyscript=/etc/security/keyscript.sh

5. mkinitcpio -p linux414.preset
But after restarting the computer, nothing happens !!!
What am I doing wrong?
I would be very grateful for the help!!!

eschwartz

Fellow

Registered: 2014-08-08

Posts: 4,097

Re: Arch + Luks (two-factor)

keyscript is a debian package and not supported by systemd or native crypttab.

You can write a custom mkinitcpio hook to do this for you, however -- see the mkinitcpio(8) manpage for guidance on writing mkinitcpio hooks.

---

Managing AUR repos The Right Way -- aurpublish (now a standalone tool)

Everette88

Member

Registered: 2018-02-17

Posts: 41

Re: Arch + Luks (two-factor)

If you can invest in YubiKey then there are solutions ready for use: https://wiki.archlinux.org/index.php/Yu … ition/disk

Baddy Stacks

Member

Registered: 2018-11-12

Posts: 3

Re: Arch + Luks (two-factor)

keyscript is a debian package and not supported by systemd or native crypttab.

You can write a custom mkinitcpio hook to do this for you, however -- see the mkinitcpio(8) manpage for guidance on writing mkinitcpio hooks.

Thank you, this is exactly the answer I need.
I recently switched at Arch and haven't really figured out the system functions yet.

Baddy Stacks

Member

Registered: 2018-11-12

Posts: 3

Re: Arch + Luks (two-factor)

If you can invest in YubiKey then there are solutions ready for use: https://wiki.archlinux.org/index.php/Yu … ition/disk

I know about YubiKey, but at this time I need my own decision