[SOLVED] Encrypted External Drive (LVM on LUKS) Not Mounting

claudici · 2020-08-04 23:20:09

So, here is my setup:

Encrypted SSD (LVM on LUKS) that contains root filesystem, home, swap
External HDD also encrypted using LVM on LUKS used for backup of OS

When I boot my computer, I have to manually enter the password to decrypt my SSD. This is what I want. No issues booting into Arch.

Now, I want my external HDD to be unlocked automatically using a key file. I followed the Arch Wiki and this is what my /etc/fstab and /etc/crypttab look like:

fstab

# SSD
# /dev/mapper/arch-root
UUID=0b7d65a0-8d3e-4e2c-98c4-6321948ebdec       /               ext4            rw,relatime  0 1

# /dev/mapper/arch-home
UUID=e1a68521-1081-4269-bb8a-700a61090dcb       /home           ext4            rw,relatime  0 2

# /dev/sda1 -- boot partition UNENCRYPTED
UUID=443D-26C7          /boot           vfat            rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro     0 2

# /dev/mapper/arch-swap
UUID=6a6cedef-e107-4a4c-beb4-6b40aee0e773       none            swap            defaults     0 0

# HDD
# /dev/mapper/backup-data
/dev/mapper/backup-data /mnt/backup ext4 defaults 0 2

crypttab

backup-data UUID=236dcce6-bb1a-4da4-8c17-336e40dc4dc2 /etc/backup.key

But this is not working as intended.

This is what my setup should look like (done manually unencrypting + mounting external drive):

NAME              MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINT
sda                 8:0    0 476.9G  0 disk
├─sda1              8:1    0   500M  0 part  /boot
└─sda2              8:2    0 476.5G  0 part
  └─cryptlvm      254:0    0 476.4G  0 crypt
    ├─arch-swap   254:1    0     2G  0 lvm   [SWAP]
    ├─arch-root   254:2    0    20G  0 lvm   /
    └─arch-home   254:3    0 454.4G  0 lvm   /home
sdb                 8:16   0 465.8G  0 disk
└─sdb1              8:17   0 465.8G  0 part
  └─backup        254:4    0 465.7G  0 crypt
    └─backup-data 254:5    0 465.7G  0 lvm   /mnt/backup

where /dev/sda is the SSD and /dev/sdb is the HDD.

This is what my setup instead looks like with the above fstab and crypttab:

NAME            MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINT
sda               8:0    0 476.9G  0 disk
├─sda1            8:1    0   500M  0 part  /boot
└─sda2            8:2    0 476.5G  0 part
  └─cryptlvm    254:0    0 476.4G  0 crypt
    ├─arch-swap 254:1    0     2G  0 lvm   [SWAP]
    ├─arch-root 254:2    0    20G  0 lvm   /
    └─arch-home 254:3    0 454.4G  0 lvm   /home
sdb               8:32   0 465.8G  0 disk
└─sdb1            8:33   0 465.8G  0 part
  └─backup-data 254:4    0 465.7G  0 crypt

As you can see from above, /dev/sda2 is properly unencrypted and mounted at boot BUT /dev/sdb1 is not.

For whatever reason, the logical volume (/dev/mapper/backup-data) is treated instead as a LUKS encrypted container and there are no logical volumes.

Not sure what I am doing wrong here. Here is what I found using journalctl -xb:

Aug 04 19:12:03 arch systemd[1]: Starting Cryptography Setup for backup-data...
-- Subject: A start job for unit systemd-cryptsetup@backup\x2ddata.service has begun execution
-- A start job for unit systemd-cryptsetup@backup\x2ddata.service has begun execution.
Aug 04 19:12:06 arch systemd[1]: Found device /dev/mapper/backup-data.
-- Subject: A start job for unit dev-mapper-backup\x2ddata.device has finished successfully
-- A start job for unit dev-mapper-backup\x2ddata.device has finished successfully.
Aug 04 19:12:06 arch systemd[1]: Starting File System Check on /dev/mapper/backup-data...
-- Subject: A start job for unit systemd-fsck@dev-mapper-backup\x2ddata.service has begun execution
-- A start job for unit systemd-fsck@dev-mapper-backup\x2ddata.service has begun execution.
Aug 04 19:12:06 arch systemd[1]: Finished Cryptography Setup for backup-data.
-- Subject: A start job for unit systemd-cryptsetup@backup\x2ddata.service has finished successfully
-- A start job for unit systemd-cryptsetup@backup\x2ddata.service has finished successfully.
Aug 04 19:12:06 arch audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=systemd-cryptsetup@backup\x2ddata comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Aug 04 19:12:06 arch systemd[1]: Reached target Block Device Preparation for /dev/mapper/backup-data.
-- Subject: A start job for unit blockdev@dev-mapper-backup\x2ddata.target has finished successfully
-- A start job for unit blockdev@dev-mapper-backup\x2ddata.target has finished successfully.
Aug 04 19:12:06 arch systemd[1]: Finished File System Check on /dev/mapper/backup-data.
-- Subject: A start job for unit systemd-fsck@dev-mapper-backup\x2ddata.service has finished successfully
-- A start job for unit systemd-fsck@dev-mapper-backup\x2ddata.service has finished successfully.
Aug 04 19:12:06 arch audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=systemd-fsck@dev-mapper-backup\x2ddata comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Aug 04 19:12:06 arch systemd[1]: Mounting /mnt/backup...
-- Subject: A start job for unit mnt-backup.mount has begun execution
-- A start job for unit mnt-backup.mount has begun execution.
Aug 04 19:12:06 arch mount[601]: mount: /mnt/backup: wrong fs type, bad option, bad superblock on /dev/mapper/backup-data, missing codepage or helper program, or other error.
Aug 04 19:12:06 arch systemd[1]: mnt-backup.mount: Mount process exited, code=exited, status=32/n/a
-- An n/a= process belonging to unit mnt-backup.mount has exited.
Aug 04 19:12:06 arch systemd[1]: mnt-backup.mount: Failed with result 'exit-code'.
-- The unit mnt-backup.mount has entered the 'failed' state with result 'exit-code'.
Aug 04 19:12:06 arch systemd[1]: Failed to mount /mnt/backup.
-- Subject: A start job for unit mnt-backup.mount has failed
-- A start job for unit mnt-backup.mount has finished with a failure.
Aug 04 19:12:06 arch lvm[598]:   pvscan[598] VG backup run autoactivation.
Aug 04 19:12:06 arch lvm[598]:   device-mapper: create ioctl on backup-data LVM-2egytjtmcaBb9i5Cf5kOFzHJY5p8rDzyY9PQ7U5gnR1pmSY6sb5I9dEm0hNW9nZC failed: Device or resource busy
Aug 04 19:12:06 arch lvm[598]:   0 logical volume(s) in volume group "backup" now active
Aug 04 19:12:06 arch lvm[598]:   backup: autoactivation failed.

So what is happening I think is that the drive is being unencrypted using the key file, but for whatever reason there are no logical volumes. Hence the Failed to mount /mnt/backup..

Any help would be much appreciated.

Thanks!

EDIT: Sorry, forgot to include my UUIDs (command ran after MANUALLY unencrypting and mounting the HDD, NOT done automatically during boot):

/dev/sda1: UUID="443D-26C7" BLOCK_SIZE="512" TYPE="vfat" PARTUUID="5bf5efa0-39ca-2b46-9a12-b4e04f73258e"
/dev/sda2: UUID="312b492b-9550-4b92-ac9a-548732262371" TYPE="crypto_LUKS" PARTUUID="7d77290b-75d8-7e4b-99e3-700aa5af5f48"
/dev/sdb1: UUID="236dcce6-bb1a-4da4-8c17-336e40dc4dc2" TYPE="crypto_LUKS" PARTUUID="3e4168df-65d6-4041-9cd5-0a7ce8ad0d1b"
/dev/mapper/cryptlvm: UUID="2sx577-xP5H-PJZF-eqOB-bp1r-Eg8G-JQklxv" TYPE="LVM2_member"
/dev/mapper/arch-swap: UUID="6a6cedef-e107-4a4c-beb4-6b40aee0e773" TYPE="swap"
/dev/mapper/arch-root: UUID="0b7d65a0-8d3e-4e2c-98c4-6321948ebdec" BLOCK_SIZE="4096" TYPE="ext4"
/dev/mapper/arch-home: UUID="e1a68521-1081-4269-bb8a-700a61090dcb" BLOCK_SIZE="4096" TYPE="ext4"
/dev/mapper/backup: UUID="W2Wdtl-0Sh0-Mkx4-6aAt-JY9U-ZOfU-U2F01c" TYPE="LVM2_member"
/dev/mapper/backup-data: UUID="e3b3774b-70a0-41ee-b32a-f68380c5ca50" BLOCK_SIZE="4096" TYPE="ext4"

Last edited by claudici (2020-08-04 23:38:57)

loqs · 2020-08-04 23:26:23

I think the crypttab entry will create /dev/mapper/backup-data, try changing it to backup.

claudici · 2020-08-04 23:37:03

loqs wrote:

I think the crypttab entry will create /dev/mapper/backup-data, try changing it to backup.

Alright, it works. Not sure why the Arch Wiki says to use the same for both fstab and crypttab, unless I am misreading it somehow.

Thanks for the help.

Last edited by claudici (2020-08-04 23:37:34)

loqs · 2020-08-04 23:40:04

You would use the same if the layering was just filesystem on LUKS. You have filesystem on LVM2 on LUKS so you need distinct names for the LVM2 and crypt device mappers.

Arch Linux

#1 2020-08-04 23:20:09