LUKS encrypted container disappears completely after reboot

arifer612 · 2020-11-25 07:43:49

Hi there, I've been trying to increase my security by moving all my sensitive information away from hard disks to a USB drive that I always have on my body. I successfully managed to create a LUKS encrypted file container (largely following the steps in the wiki page here) and initialised it without a problem. I worked on it throughout the night and made sure to close the session and dismount properly, i.e. umount /media/encrypted; cryptsetup close secrets; umount /dev/sdx.

However, I found that although I am able to mount the container again the next morning, the entire directory was empty. I have checked this on my other machine (running elementaryOS) and it reflected the same issue. I should highlight that my other machine could read and view the encrypted container last night and I was careful in my mount/dismount. I spent the whole of this morning and the early half of the afternoon to debug what the issue might be. I found out that this seems to also be a problem for encrypted Samsung SSDs, but I find it hard to relate to since my drive is a normal flash drive (I successfully ran Tails on it for half a year with no corruption or failures) and is not Samsung branded. Nevertheless, I tried debugging it the way one other victim of this issue did, in this post.

A few preliminaries regarding my setup:
- Linux 5.9.9-arch1-1
- USB partitions: 2. 1 will hold the encrypted file container, and the other is just plain data.

sde              8:64   1  57.7G  0 disk
├─sde1           8:65   1     1G  0 part  /media/usbkey  <--- ext4, with a 100M encrypted file container (/media/usbkey/disk.img), mapped to the crypt labelled `usbkey`
└─sde2           8:66   1  56.7G  0 part <--ext4, used as a normal flash drive

- loop partition:

loop0            7:0    0   100M  0 loop
└─usbkey       254:1    0    84M  0 crypt /media/encrypted

On to the debugs. The first thing I did was to check if the headers were fine. I ran cryptsetup --debug isLuks /dev/mapper/usbkey and the results are:

# cryptsetup 2.3.4 processing "cryptsetup --debug isLuks /dev/mapper/usbkey"
# Running command isLuks.
# Installing SIGINT/SIGTERM handler.
# Unblocking interruption on signal.
# Allocating context for crypt device /dev/mapper/usbkey.
# Trying to open and read device /dev/mapper/usbkey with direct-io.
# Initialising device-mapper backend library.
# Trying to load any crypt type from device /dev/mapper/usbkey.
# Crypto backend (OpenSSL 1.1.1h  22 Sep 2020) initialized in cryptsetup library version 2.3.4.
# Detected kernel Linux 5.9.9-arch1-1 x86_64.
# Loading LUKS2 header (repair disabled).
# Acquiring read lock for device /dev/mapper/usbkey.
# Opening lock resource file /run/cryptsetup/L_254:1
# Verifying lock handle for /dev/mapper/usbkey.
# Device /dev/mapper/usbkey READ lock taken.
# Trying to read primary LUKS2 header at offset 0x0.
# Opening locked device /dev/mapper/usbkey
# Veryfing locked device handle (bdev)
# Trying to read secondary LUKS2 header at offset 0x4000.
# Reusing open ro fd on device /dev/mapper/usbkey
# Trying to read secondary LUKS2 header at offset 0x8000.
# Reusing open ro fd on device /dev/mapper/usbkey
# Trying to read secondary LUKS2 header at offset 0x10000.
# Reusing open ro fd on device /dev/mapper/usbkey
# Trying to read secondary LUKS2 header at offset 0x20000.
# Reusing open ro fd on device /dev/mapper/usbkey
# Trying to read secondary LUKS2 header at offset 0x40000.
# Reusing open ro fd on device /dev/mapper/usbkey
# Trying to read secondary LUKS2 header at offset 0x80000.
# Reusing open ro fd on device /dev/mapper/usbkey
# Trying to read secondary LUKS2 header at offset 0x100000.
# Reusing open ro fd on device /dev/mapper/usbkey
# Trying to read secondary LUKS2 header at offset 0x200000.
# Reusing open ro fd on device /dev/mapper/usbkey
# Trying to read secondary LUKS2 header at offset 0x400000.
# Reusing open ro fd on device /dev/mapper/usbkey
# LUKS2 header read failed (-22).
# Device /dev/mapper/usbkey READ lock released.
# Releasing crypt device /dev/mapper/usbkey context.
# Releasing device-mapper backend.
# Closing read only fd for /dev/mapper/usbkey.
Command failed with code -1 (wrong or missing parameters).

The important bit is near the bottom, where clearly it failed to read the header.

I then tried to check if the same happens to the disk image with cryptsetup /media/usbkey/disk.img and I got:

# cryptsetup 2.3.4 processing "cryptsetup --debug isLuks /media/usbkey/disk.img"
# Running command isLuks.
# Installing SIGINT/SIGTERM handler.
# Unblocking interruption on signal.
# Allocating context for crypt device /media/usbkey/disk.img.
# Trying to open and read device /media/usbkey/disk.img with direct-io.
# Initialising device-mapper backend library.
# Trying to load any crypt type from device /media/usbkey/disk.img.
# Crypto backend (OpenSSL 1.1.1h  22 Sep 2020) initialized in cryptsetup library version 2.3.4.
# Detected kernel Linux 5.9.9-arch1-1 x86_64.
# Loading LUKS2 header (repair disabled).
# Acquiring read lock for device /media/usbkey/disk.img.
# Verifying lock handle for /media/usbkey/disk.img.
# Device /media/usbkey/disk.img READ lock taken.
# Trying to read primary LUKS2 header at offset 0x0.
# Opening locked device /media/usbkey/disk.img
# Veryfing locked device handle (regular file)
# LUKS2 header version 2 of size 16384 bytes, checksum sha256.
# Checksum:ce9174d9b2e0d23ec84a63538a4f4c720200be05af3ae1f4a62a073b246ba79a (on-disk)
# Checksum:ce9174d9b2e0d23ec84a63538a4f4c720200be05af3ae1f4a62a073b246ba79a (in-memory)
# Trying to read secondary LUKS2 header at offset 0x4000.
# Reusing open ro fd on device /media/usbkey/disk.img
# LUKS2 header version 2 of size 16384 bytes, checksum sha256.
# Checksum:1885bb5d1d2a877e69b9bb8167680e009788746a35f5155a2c527809079ac0e7 (on-disk)
# Checksum:1885bb5d1d2a877e69b9bb8167680e009788746a35f5155a2c527809079ac0e7 (in-memory)
# Device size 104857600, offset 16777216.
# Device /media/usbkey/disk.img READ lock released.
# PBKDF argon2i, time_ms 2000 (iterations 0), max_memory_kb 1048576, parallel_threads 4.
# Releasing crypt device /media/usbkey/disk.img context.
# Releasing device-mapper backend.
# Closing read only fd for /media/usbkey/disk.img.
Command successful.

The exact same results as the forum post I referenced from.

Following the advice of other posters in that forum post, I tried to check the hexdumps

dd if=/dev/mapper/usbkey count=20 | hexdump -C
00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000400  38 54 00 00 00 50 01 00  cc 10 00 00 54 2f 01 00  |8T...P......T/..|
20+0 records in
20+0 records out
00000410  2e 54 00 00 01 00 00 00  00 00 00 00 00 00 00 00  |.T..............|
10240 bytes (10 kB, 10 KiB) copied, 0.000265594 s, 38.6 MB/s00000420  00 20 00 00 00 20 00 00  a8 07 00 00 c5 06 be 5f  |. ... ........._|

00000430  c5 06 be 5f 0b 00 ff ff  53 ef 01 00 01 00 00 00  |..._....S.......|
00000440  4e 1d bd 5f 00 00 00 00  00 00 00 00 01 00 00 00  |N.._............|
00000450  00 00 00 00 0b 00 00 00  80 00 00 00 3c 00 00 00  |............<...|
00000460  c6 02 00 00 6b 04 00 00  26 9f 50 5f f5 66 45 a6  |....k...&.P_.fE.|
00000470  87 12 6a b5 ea 0e e2 86  75 73 62 6b 65 79 2e 73  |..j.....usbkey.s|
00000480  65 63 72 65 74 73 00 00  2f 6d 65 64 69 61 2f 65  |ecrets../media/e|
00000490  6e 63 72 79 70 74 65 64  00 00 00 00 00 00 00 00  |ncrypted........|
000004a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000004c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 01  |................|
000004d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000004e0  08 00 00 00 00 00 00 00  00 00 00 00 2c 73 0b 31  |............,s.1|
000004f0  7b 85 4c 8c ac 77 04 1f  af c3 f3 cb 01 01 40 00  |{.L..w........@.|
00000500  0c 00 00 00 00 00 00 00  4e 1d bd 5f 0a f3 01 00  |........N.._....|
00000510  04 00 00 00 00 00 00 00  00 00 00 00 00 10 00 00  |................|
00000520  01 80 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000530  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000540  00 00 00 00 00 00 00 00  00 00 00 00 00 00 40 00  |..............@.|
00000550  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000560  01 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000570  00 00 00 00 04 01 00 00  09 62 01 00 00 00 00 00  |.........b......|
00000580  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000007f0  00 00 00 00 00 00 00 00  00 00 00 00 4a a0 16 d0  |............J...|
00000800  03 01 00 00 0e 01 00 00  19 01 00 00 5f 14 9e 07  |............_...|
00000810  01 00 04 00 00 00 00 00  77 32 01 fb 3b 07 83 ff  |........w2..;...|
00000820  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000830  00 00 00 00 00 00 00 00  bb e4 5f 9c 00 00 00 00  |.........._.....|
00000840  04 01 00 00 0f 01 00 00  0e 02 00 00 fe 1e a8 07  |................|
00000850  00 00 04 00 00 00 00 00  66 6b 2e 96 a6 07 36 f6  |........fk....6.|
00000860  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000870  00 00 00 00 00 00 00 00  bb 6b 0d 02 00 00 00 00  |.........k......|
00000880  05 01 00 00 10 01 00 00  03 03 00 00 00 20 a8 07  |............. ..|
00000890  00 00 07 00 00 00 00 00  00 00 00 00 a8 07 43 de  |..............C.|
000008a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000008c0  06 01 00 00 11 01 00 00  f8 03 00 00 fe 1e a8 07  |................|
000008d0  00 00 07 00 00 00 00 00  00 00 00 00 a8 07 c4 90  |................|
000008e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000900  07 01 00 00 12 01 00 00  ed 04 00 00 00 10 a8 07  |................|
00000910  00 00 05 00 00 00 00 00  03 cd 00 00 a8 07 ca 1b  |................|
00000920  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000930  00 00 00 00 00 00 00 00  50 2f 00 00 00 00 00 00  |........P/......|
00000940  08 01 00 00 13 01 00 00  e2 05 00 00 fe 1e a8 07  |................|
00000950  00 00 07 00 00 00 00 00  00 00 00 00 a8 07 c0 f5  |................|
00000960  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000980  09 01 00 00 14 01 00 00  d7 06 00 00 00 20 a8 07  |............. ..|
00000990  00 00 07 00 00 00 00 00  00 00 00 00 a8 07 95 32  |...............2|
000009a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000009c0  0a 01 00 00 15 01 00 00  cc 07 00 00 fe 1e a8 07  |................|
000009d0  00 00 07 00 00 00 00 00  00 00 00 00 a8 07 d4 95  |................|
000009e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000a00  0b 01 00 00 16 01 00 00  c1 08 00 00 00 20 a8 07  |............. ..|
00000a10  00 00 07 00 00 00 00 00  00 00 00 00 a8 07 73 d9  |..............s.|
00000a20  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000a40  0c 01 00 00 17 01 00 00  b6 09 00 00 fe 1e a8 07  |................|
00000a50  00 00 07 00 00 00 00 00  00 00 00 00 a8 07 39 b1  |..............9.|
00000a60  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000a80  0d 01 00 00 18 01 00 00  ab 0a 00 00 ff 0f a8 07  |................|
00000a90  00 00 05 00 00 00 00 00  67 1e 00 00 a8 07 15 01  |........g.......|
00000aa0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000ab0  00 00 00 00 00 00 00 00  ac d8 00 00 00 00 00 00  |................|
00000ac0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000c00  03 20 00 00 03 60 00 00  03 a0 00 00 03 e0 00 00  |. ...`..........|
00000c10  03 20 01 00 00 00 00 00  00 00 00 00 00 00 00 00  |. ..............|
00000c20  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00001000  04 20 00 00 04 60 00 00  04 a0 00 00 04 e0 00 00  |. ...`..........|
00001010  04 20 01 00 00 00 00 00  00 00 00 00 00 00 00 00  |. ..............|
00001020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00001400  05 20 00 00 05 60 00 00  05 a0 00 00 05 e0 00 00  |. ...`..........|
00001410  05 20 01 00 00 00 00 00  00 00 00 00 00 00 00 00  |. ..............|
00001420  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00001800  06 20 00 00 06 60 00 00  06 a0 00 00 06 e0 00 00  |. ...`..........|
00001810  06 20 01 00 00 00 00 00  00 00 00 00 00 00 00 00  |. ..............|
00001820  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00001c00  07 20 00 00 07 60 00 00  07 a0 00 00 07 e0 00 00  |. ...`..........|
00001c10  07 20 01 00 00 00 00 00  00 00 00 00 00 00 00 00  |. ..............|
00001c20  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00002000  08 20 00 00 08 60 00 00  08 a0 00 00 08 e0 00 00  |. ...`..........|
00002010  08 20 01 00 00 00 00 00  00 00 00 00 00 00 00 00  |. ..............|
00002020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00002400  09 20 00 00 09 60 00 00  09 a0 00 00 09 e0 00 00  |. ...`..........|
00002410  09 20 01 00 00 00 00 00  00 00 00 00 00 00 00 00  |. ..............|
00002420  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00002800

Doing the same on the disk image,

dd if=/media/usbkey/disk.img count=20 | hexdump -C
20+0 records in
20+0 records out
10240 bytes (10 kB, 10 KiB) copied, 5.5787e-05 s, 184 MB/s
00000000  4c 55 4b 53 ba be 00 02  00 00 00 00 00 00 40 00  |LUKS..........@.|
00000010  00 00 00 00 00 00 00 03  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000040  00 00 00 00 00 00 00 00  73 68 61 32 35 36 00 00  |........sha256..|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  a7 e1 a9 12 ce 7d 61 b3  |.............}a.|
00000070  d9 86 d2 81 ee 07 a4 58  b3 c1 79 a1 5f 1d 88 8c  |.......X..y._...|
00000080  e0 3c e5 e3 24 26 f1 b9  48 18 b3 66 f0 da e2 e9  |.<..$&..H..f....|
00000090  ce 1f 22 98 78 0a 1a d2  de 9e 00 30 b1 df a5 4b  |..".x......0...K|
000000a0  4e c8 bc 86 74 16 be ee  64 33 66 61 35 31 66 62  |N...t...d3fa51fb|
000000b0  2d 33 33 61 37 2d 34 66  61 30 2d 39 39 61 31 2d  |-33a7-4fa0-99a1-|
000000c0  63 37 64 66 62 36 35 34  31 64 39 64 00 00 00 00  |c7dfb6541d9d....|
000000d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001c0  ce 91 74 d9 b2 e0 d2 3e  c8 4a 63 53 8a 4f 4c 72  |..t....>.JcS.OLr|
000001d0  02 00 be 05 af 3a e1 f4  a6 2a 07 3b 24 6b a7 9a  |.....:...*.;$k..|
000001e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00001000  7b 22 6b 65 79 73 6c 6f  74 73 22 3a 7b 22 30 22  |{"keyslots":{"0"|
00001010  3a 7b 22 74 79 70 65 22  3a 22 6c 75 6b 73 32 22  |:{"type":"luks2"|
00001020  2c 22 6b 65 79 5f 73 69  7a 65 22 3a 36 34 2c 22  |,"key_size":64,"|
00001030  61 66 22 3a 7b 22 74 79  70 65 22 3a 22 6c 75 6b  |af":{"type":"luk|
00001040  73 31 22 2c 22 73 74 72  69 70 65 73 22 3a 34 30  |s1","stripes":40|
00001050  30 30 2c 22 68 61 73 68  22 3a 22 73 68 61 32 35  |00,"hash":"sha25|
00001060  36 22 7d 2c 22 61 72 65  61 22 3a 7b 22 74 79 70  |6"},"area":{"typ|
00001070  65 22 3a 22 72 61 77 22  2c 22 6f 66 66 73 65 74  |e":"raw","offset|
00001080  22 3a 22 33 32 37 36 38  22 2c 22 73 69 7a 65 22  |":"32768","size"|
00001090  3a 22 32 35 38 30 34 38  22 2c 22 65 6e 63 72 79  |:"258048","encry|
000010a0  70 74 69 6f 6e 22 3a 22  61 65 73 2d 78 74 73 2d  |ption":"aes-xts-|
000010b0  70 6c 61 69 6e 36 34 22  2c 22 6b 65 79 5f 73 69  |plain64","key_si|
000010c0  7a 65 22 3a 36 34 7d 2c  22 6b 64 66 22 3a 7b 22  |ze":64},"kdf":{"|
000010d0  74 79 70 65 22 3a 22 61  72 67 6f 6e 32 69 22 2c  |type":"argon2i",|
000010e0  22 74 69 6d 65 22 3a 35  2c 22 6d 65 6d 6f 72 79  |"time":5,"memory|
000010f0  22 3a 31 30 34 38 35 37  36 2c 22 63 70 75 73 22  |":1048576,"cpus"|
00001100  3a 34 2c 22 73 61 6c 74  22 3a 22 70 49 66 34 69  |:4,"salt":"pIf4i|
00001110  63 6d 6e 6d 65 62 67 59  64 68 68 6a 77 6f 6d 6d  |cmnmebgYdhhjwomm|
00001120  71 58 57 61 67 75 72 4b  52 76 36 70 41 73 46 53  |qXWagurKRv6pAsFS|
00001130  53 6d 2f 72 4f 55 3d 22  7d 7d 7d 2c 22 74 6f 6b  |Sm/rOU="}}},"tok|
00001140  65 6e 73 22 3a 7b 7d 2c  22 73 65 67 6d 65 6e 74  |ens":{},"segment|
00001150  73 22 3a 7b 22 30 22 3a  7b 22 74 79 70 65 22 3a  |s":{"0":{"type":|
00001160  22 63 72 79 70 74 22 2c  22 6f 66 66 73 65 74 22  |"crypt","offset"|
00001170  3a 22 31 36 37 37 37 32  31 36 22 2c 22 73 69 7a  |:"16777216","siz|
00001180  65 22 3a 22 64 79 6e 61  6d 69 63 22 2c 22 69 76  |e":"dynamic","iv|
00001190  5f 74 77 65 61 6b 22 3a  22 30 22 2c 22 65 6e 63  |_tweak":"0","enc|
000011a0  72 79 70 74 69 6f 6e 22  3a 22 61 65 73 2d 78 74  |ryption":"aes-xt|
000011b0  73 2d 70 6c 61 69 6e 36  34 22 2c 22 73 65 63 74  |s-plain64","sect|
000011c0  6f 72 5f 73 69 7a 65 22  3a 35 31 32 7d 7d 2c 22  |or_size":512}},"|
000011d0  64 69 67 65 73 74 73 22  3a 7b 22 30 22 3a 7b 22  |digests":{"0":{"|
000011e0  74 79 70 65 22 3a 22 70  62 6b 64 66 32 22 2c 22  |type":"pbkdf2","|
000011f0  6b 65 79 73 6c 6f 74 73  22 3a 5b 22 30 22 5d 2c  |keyslots":["0"],|
00001200  22 73 65 67 6d 65 6e 74  73 22 3a 5b 22 30 22 5d  |"segments":["0"]|
00001210  2c 22 68 61 73 68 22 3a  22 73 68 61 32 35 36 22  |,"hash":"sha256"|
00001220  2c 22 69 74 65 72 61 74  69 6f 6e 73 22 3a 31 33  |,"iterations":13|
00001230  38 39 39 34 2c 22 73 61  6c 74 22 3a 22 59 53 34  |8994,"salt":"YS4|
00001240  53 72 44 74 77 76 32 6c  59 72 61 56 55 73 71 6e  |SrDtwv2lYraVUsqn|
00001250  68 70 64 48 76 49 72 54  30 4c 51 36 5a 72 4b 4b  |hpdHvIrT0LQ6ZrKK|
00001260  53 76 67 2f 50 2b 36 38  3d 22 2c 22 64 69 67 65  |Svg/P+68=","dige|
00001270  73 74 22 3a 22 34 6c 4e  68 62 68 35 32 49 65 6e  |st":"4lNhbh52Ien|
00001280  31 48 6b 6e 66 62 57 6a  31 55 72 48 33 35 68 4d  |1HknfbWj1UrH35hM|
00001290  73 55 79 74 6f 7a 59 4e  4a 5a 55 4a 6d 52 44 49  |sUytozYNJZUJmRDI|
000012a0  3d 22 7d 7d 2c 22 63 6f  6e 66 69 67 22 3a 7b 22  |="}},"config":{"|
000012b0  6a 73 6f 6e 5f 73 69 7a  65 22 3a 22 31 32 32 38  |json_size":"1228|
000012c0  38 22 2c 22 6b 65 79 73  6c 6f 74 73 5f 73 69 7a  |8","keyslots_siz|
000012d0  65 22 3a 22 31 36 37 34  34 34 34 38 22 7d 7d 00  |e":"16744448"}}.|
000012e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00002800

What I learnt from this is that for some reason, the headers for my disk image is intact -- it's a LUKS2 header (with the 4c 55 4b 53 ba be hex digits). However, my mapped image is not.

May I ask that someone shed some light into what I should do from here? I have seen all over that it is common to use a LUKS encrypted file container to store secrets for beginners, but I do not understand why it is failing on me.

mpan · 2020-11-25 11:07:19

After unmounting:

eject /dev/sdx

Wait for it to return before removing the USB stick. Do you see any change?

arifer612 · 2020-11-25 14:15:59

Hi there, I did as you suggested. It returned an error code of 0, so that's good. After ejecting it, I mounted the device back (no problem) and attempted to mount the encrypted file container. The result was the same -- completely empty.

frostschutz · 2020-11-25 14:22:22

Not sure if I follow you correctly, but there is not supposed to be a LUKS header on the /dev/mapper/crypt device. You'll find the header in the image file and/or the loop device, but the crypt mapping only has the contents (decrypted) of the LUKS device. That's where you'd put a filesystem or LVM or something else, if there was a LUKS header there it would be overwritten when you mkfs, or end up as a LUKS inside LUKS kind of thing.

Last edited by frostschutz (2020-11-25 14:24:57)

ua4000 · 2020-11-25 14:26:51

you are using:
sde1 --> ext4 --> disk.img (encrypted file container) -> Loop --> Luks --> Filesystem

why not:
sde1 --> Luks --> Filesystem

since you alread have space for other things:
sde2 --> used as a normal flash drive

arifer612 · 2020-11-25 15:27:17

frostschutz wrote:

You'll find the header in the image file and/or the loop device, but the crypt mapping only has the contents (decrypted) of the LUKS device.

Ah I see, then that means that my headers are still valid. But why would the directory be completely blank then?

@ua400 Yep, I know that there is that option. But I wanted to have an encrypted file container instead because (I think) it is transferrable and that might save a lot of trouble when I have to switch USB sticks if I feel my current one is lacking or something. (I wanted to test that out but I couldn't even get it to work properly on the primary disk )

frostschutz · 2020-11-25 15:34:51

arifer612 wrote:

But why would the directory be completely blank then?

That's a mystery, I can only guess it was not mounted / unmounted / ejected properly?

If you have syslogs you can check for any error messages.

arifer612 · 2020-11-26 14:29:26

@frostschutz

I've been looking through the journals but can't seem to find any abnormalities. The following is the journal entry of my last dismount command when the container was still working fine

Nov 24 23:55:08 archie dbus-daemon[334]: [system] Activating via systemd: service name='org.freedesktop.home1' unit='dbus-org.freedesktop.home1.service' requested by ':1.1299' (uid=0 pid=15107 comm="sudo umount /media/encrypted ")
Nov 24 23:55:08 archie dbus-daemon[334]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.home1.service': Unit dbus-org.freedesktop.home1.service not found.
Nov 24 23:55:08 archie sudo[15107]: pam_systemd_home(sudo:account): systemd-homed is not available: Unit dbus-org.freedesktop.home1.service not found.
Nov 24 23:55:08 archie kernel: audit: type=1101 audit(1606233308.804:804): pid=15107 uid=1000 auid=1000 ses=2 msg='op=PAM:accounting grantors=pam_permit,pam_time acct="arif" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 23:55:08 archie kernel: audit: type=1110 audit(1606233308.808:805): pid=15107 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 23:55:08 archie kernel: audit: type=1105 audit(1606233308.808:806): pid=15107 uid=0 auid=1000 ses=2 msg='op=PAM:session_open grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 23:55:08 archie audit[15107]: USER_ACCT pid=15107 uid=1000 auid=1000 ses=2 msg='op=PAM:accounting grantors=pam_permit,pam_time acct="arif" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 23:55:08 archie audit[15107]: CRED_REFR pid=15107 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 23:55:08 archie audit[15107]: USER_START pid=15107 uid=0 auid=1000 ses=2 msg='op=PAM:session_open grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 23:55:08 archie sudo[15107]:     arif : TTY=pts/1 ; PWD=/home/arif/.secrets ; USER=root ; COMMAND=/usr/bin/umount /media/encrypted
Nov 24 23:55:08 archie sudo[15107]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
Nov 24 23:55:08 archie systemd[1]: media-encrypted.mount: Succeeded.
Nov 24 23:55:08 archie systemd[514]: media-encrypted.mount: Succeeded.
Nov 24 23:55:08 archie sudo[15107]: pam_unix(sudo:session): session closed for user root
Nov 24 23:55:08 archie audit[15107]: USER_END pid=15107 uid=0 auid=1000 ses=2 msg='op=PAM:session_close grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 23:55:08 archie audit[15107]: CRED_DISP pid=15107 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 23:55:08 archie kernel: audit: type=1106 audit(1606233308.841:807): pid=15107 uid=0 auid=1000 ses=2 msg='op=PAM:session_close grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 23:55:08 archie kernel: audit: type=1104 audit(1606233308.841:808): pid=15107 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 23:55:08 archie dbus-daemon[334]: [system] Activating via systemd: service name='org.freedesktop.home1' unit='dbus-org.freedesktop.home1.service' requested by ':1.1300' (uid=0 pid=15109 comm="sudo cryptsetup close usbkey ")
Nov 24 23:55:08 archie dbus-daemon[334]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.home1.service': Unit dbus-org.freedesktop.home1.service not found.
Nov 24 23:55:08 archie sudo[15109]: pam_systemd_home(sudo:account): systemd-homed is not available: Unit dbus-org.freedesktop.home1.service not found.
Nov 24 23:55:08 archie audit[15109]: USER_ACCT pid=15109 uid=1000 auid=1000 ses=2 msg='op=PAM:accounting grantors=pam_permit,pam_time acct="arif" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 23:55:08 archie audit[15109]: CRED_REFR pid=15109 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 23:55:08 archie audit[15109]: USER_START pid=15109 uid=0 auid=1000 ses=2 msg='op=PAM:session_open grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 23:55:08 archie sudo[15109]:     arif : TTY=pts/1 ; PWD=/home/arif/.secrets ; USER=root ; COMMAND=/usr/bin/cryptsetup close usbkey
Nov 24 23:55:08 archie sudo[15109]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
Nov 24 23:55:08 archie sudo[15109]: pam_unix(sudo:session): session closed for user root
Nov 24 23:55:08 archie audit[15109]: USER_END pid=15109 uid=0 auid=1000 ses=2 msg='op=PAM:session_close grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 23:55:08 archie audit[15109]: CRED_DISP pid=15109 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 23:55:08 archie dbus-daemon[334]: [system] Activating via systemd: service name='org.freedesktop.home1' unit='dbus-org.freedesktop.home1.service' requested by ':1.1301' (uid=0 pid=15114 comm="sudo rm -r /media/encrypted ")
Nov 24 23:55:08 archie dbus-daemon[334]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.home1.service': Unit dbus-org.freedesktop.home1.service not found.
Nov 24 23:55:08 archie sudo[15114]: pam_systemd_home(sudo:account): systemd-homed is not available: Unit dbus-org.freedesktop.home1.service not found.
Nov 24 23:55:08 archie audit[15114]: USER_ACCT pid=15114 uid=1000 auid=1000 ses=2 msg='op=PAM:accounting grantors=pam_permit,pam_time acct="arif" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 23:55:08 archie audit[15114]: CRED_REFR pid=15114 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 23:55:08 archie audit[15114]: USER_START pid=15114 uid=0 auid=1000 ses=2 msg='op=PAM:session_open grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 23:55:08 archie sudo[15114]:     arif : TTY=pts/1 ; PWD=/home/arif/.secrets ; USER=root ; COMMAND=/usr/bin/rm -r /media/encrypted
Nov 24 23:55:08 archie sudo[15114]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
Nov 24 23:55:08 archie sudo[15114]: pam_unix(sudo:session): session closed for user root
Nov 24 23:55:08 archie audit[15114]: USER_END pid=15114 uid=0 auid=1000 ses=2 msg='op=PAM:session_close grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 23:55:08 archie audit[15114]: CRED_DISP pid=15114 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'

The following are the logs of the next day when I found out that my encrypted drive is completely empty

Nov 25 12:44:30 archie dbus-daemon[343]: [system] Activating via systemd: service name='org.freedesktop.home1' unit='dbus-org.freedesktop.home1.service' requested by ':1.727' (uid=0 pid=8106 comm="sudo -p Password:  mkdir -p /media/encrypted ")
Nov 25 12:44:30 archie dbus-daemon[343]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.home1.service': Unit dbus-org.freedesktop.home1.service not found.
Nov 25 12:44:30 archie sudo[8106]: pam_systemd_home(sudo:account): systemd-homed is not available: Unit dbus-org.freedesktop.home1.service not found.
Nov 25 12:44:30 archie kernel: audit: type=1101 audit(1606279470.805:156): pid=8106 uid=1000 auid=1000 ses=2 msg='op=PAM:accounting grantors=pam_permit,pam_time acct="arif" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
Nov 25 12:44:30 archie kernel: audit: type=1110 audit(1606279470.808:157): pid=8106 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
Nov 25 12:44:30 archie audit[8106]: USER_ACCT pid=8106 uid=1000 auid=1000 ses=2 msg='op=PAM:accounting grantors=pam_permit,pam_time acct="arif" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
Nov 25 12:44:30 archie audit[8106]: CRED_REFR pid=8106 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
Nov 25 12:44:30 archie audit[8106]: USER_START pid=8106 uid=0 auid=1000 ses=2 msg='op=PAM:session_open grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
Nov 25 12:44:30 archie sudo[8106]:     arif : TTY=pts/0 ; PWD=/home/arif ; USER=root ; COMMAND=/usr/bin/mkdir -p /media/encrypted
Nov 25 12:44:30 archie sudo[8106]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
Nov 25 12:44:30 archie kernel: audit: type=1105 audit(1606279470.808:158): pid=8106 uid=0 auid=1000 ses=2 msg='op=PAM:session_open grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
Nov 25 12:44:30 archie sudo[8106]: pam_unix(sudo:session): session closed for user root
Nov 25 12:44:30 archie audit[8106]: USER_END pid=8106 uid=0 auid=1000 ses=2 msg='op=PAM:session_close grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
Nov 25 12:44:30 archie audit[8106]: CRED_DISP pid=8106 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
Nov 25 12:44:30 archie kernel: audit: type=1106 audit(1606279470.811:159): pid=8106 uid=0 auid=1000 ses=2 msg='op=PAM:session_close grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
Nov 25 12:44:30 archie kernel: audit: type=1104 audit(1606279470.811:160): pid=8106 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
Nov 25 12:44:30 archie dbus-daemon[343]: [system] Activating via systemd: service name='org.freedesktop.home1' unit='dbus-org.freedesktop.home1.service' requested by ':1.728' (uid=0 pid=8108 comm="sudo cryptsetup open /media/usbkey/disk.img usbkey")
Nov 25 12:44:30 archie dbus-daemon[343]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.home1.service': Unit dbus-org.freedesktop.home1.service not found.
Nov 25 12:44:30 archie sudo[8108]: pam_systemd_home(sudo:account): systemd-homed is not available: Unit dbus-org.freedesktop.home1.service not found.
Nov 25 12:44:30 archie audit[8108]: USER_ACCT pid=8108 uid=1000 auid=1000 ses=2 msg='op=PAM:accounting grantors=pam_permit,pam_time acct="arif" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
Nov 25 12:44:30 archie audit[8108]: CRED_REFR pid=8108 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
Nov 25 12:44:30 archie audit[8108]: USER_START pid=8108 uid=0 auid=1000 ses=2 msg='op=PAM:session_open grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
Nov 25 12:44:30 archie sudo[8108]:     arif : TTY=pts/0 ; PWD=/home/arif ; USER=root ; COMMAND=/usr/bin/cryptsetup open /media/usbkey/disk.img usbkey
Nov 25 12:44:30 archie sudo[8108]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
Nov 25 12:44:35 archie sudo[8108]: pam_unix(sudo:session): session closed for user root
Nov 25 12:44:35 archie audit[8108]: USER_END pid=8108 uid=0 auid=1000 ses=2 msg='op=PAM:session_close grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
Nov 25 12:44:35 archie audit[8108]: CRED_DISP pid=8108 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
Nov 25 12:44:35 archie dbus-daemon[343]: [system] Activating via systemd: service name='org.freedesktop.home1' unit='dbus-org.freedesktop.home1.service' requested by ':1.729' (uid=0 pid=8200 comm="sudo mount -t ext4 /dev/mapper/usbkey /media/encry")
Nov 25 12:44:35 archie dbus-daemon[343]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.home1.service': Unit dbus-org.freedesktop.home1.service not found.
Nov 25 12:44:35 archie audit[8200]: USER_ACCT pid=8200 uid=1000 auid=1000 ses=2 msg='op=PAM:accounting grantors=pam_permit,pam_time acct="arif" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
Nov 25 12:44:35 archie sudo[8200]: pam_systemd_home(sudo:account): systemd-homed is not available: Unit dbus-org.freedesktop.home1.service not found.
Nov 25 12:44:35 archie audit[8200]: CRED_REFR pid=8200 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
Nov 25 12:44:35 archie audit[8200]: USER_START pid=8200 uid=0 auid=1000 ses=2 msg='op=PAM:session_open grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
Nov 25 12:44:35 archie sudo[8200]:     arif : TTY=pts/0 ; PWD=/home/arif ; USER=root ; COMMAND=/usr/bin/mount -t ext4 /dev/mapper/usbkey /media/encrypted
Nov 25 12:44:35 archie sudo[8200]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
Nov 25 12:44:35 archie sudo[8200]: pam_unix(sudo:session): session closed for user root
Nov 25 12:44:35 archie audit[8200]: USER_END pid=8200 uid=0 auid=1000 ses=2 msg='op=PAM:session_close grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
Nov 25 12:44:35 archie audit[8200]: CRED_DISP pid=8200 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
Nov 25 12:44:35 archie kernel: EXT4-fs (dm-1): mounted filesystem with ordered data mode. Opts: (null)
Nov 25 12:44:35 archie kernel: ext4 filesystem being mounted at /media/encrypted supports timestamps until 2038 (0x7fffffff)
Nov 25 12:44:35 archie dbus-daemon[343]: [system] Activating via systemd: service name='org.freedesktop.home1' unit='dbus-org.freedesktop.home1.service' requested by ':1.730' (uid=0 pid=8204 comm="sudo chown -R 1000.1000 /media/encrypted ")
Nov 25 12:44:35 archie dbus-daemon[343]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.home1.service': Unit dbus-org.freedesktop.home1.service not found.
Nov 25 12:44:35 archie sudo[8204]: pam_systemd_home(sudo:account): systemd-homed is not available: Unit dbus-org.freedesktop.home1.service not found.
Nov 25 12:44:35 archie audit[8204]: USER_ACCT pid=8204 uid=1000 auid=1000 ses=2 msg='op=PAM:accounting grantors=pam_permit,pam_time acct="arif" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
Nov 25 12:44:35 archie audit[8204]: CRED_REFR pid=8204 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
Nov 25 12:44:35 archie sudo[8204]:     arif : TTY=pts/0 ; PWD=/home/arif ; USER=root ; COMMAND=/usr/bin/chown -R 1000.1000 /media/encrypted
Nov 25 12:44:35 archie audit[8204]: USER_START pid=8204 uid=0 auid=1000 ses=2 msg='op=PAM:session_open grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
Nov 25 12:44:35 archie sudo[8204]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
Nov 25 12:44:35 archie sudo[8204]: pam_unix(sudo:session): session closed for user root
Nov 25 12:44:35 archie audit[8204]: USER_END pid=8204 uid=0 auid=1000 ses=2 msg='op=PAM:session_close grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
Nov 25 12:44:35 archie audit[8204]: CRED_DISP pid=8204 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'

No errors whatsoever All my other logs for the entries before and after these are the same. For example, the last successful load:

Nov 24 22:49:09 archie dbus-daemon[334]: [system] Activating via systemd: service name='org.freedesktop.home1' unit='dbus-org.freedesktop.home1.service' requested by ':1.796' (uid=0 pid=9146 comm="sudo -p Password:  mkdir -p /media/encrypted ")
Nov 24 22:49:09 archie dbus-daemon[334]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.home1.service': Unit dbus-org.freedesktop.home1.service not found.
Nov 24 22:49:09 archie sudo[9146]: pam_systemd_home(sudo:account): systemd-homed is not available: Unit dbus-org.freedesktop.home1.service not found.
Nov 24 22:49:09 archie audit[9146]: USER_ACCT pid=9146 uid=1000 auid=1000 ses=2 msg='op=PAM:accounting grantors=pam_permit,pam_time acct="arif" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:09 archie audit[9146]: CRED_REFR pid=9146 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:09 archie audit[9146]: USER_START pid=9146 uid=0 auid=1000 ses=2 msg='op=PAM:session_open grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:09 archie sudo[9146]:     arif : TTY=pts/1 ; PWD=/home/arif ; USER=root ; COMMAND=/usr/bin/mkdir -p /media/encrypted
Nov 24 22:49:09 archie sudo[9146]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
Nov 24 22:49:09 archie sudo[9146]: pam_unix(sudo:session): session closed for user root
Nov 24 22:49:09 archie audit[9146]: USER_END pid=9146 uid=0 auid=1000 ses=2 msg='op=PAM:session_close grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:09 archie audit[9146]: CRED_DISP pid=9146 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:09 archie dbus-daemon[334]: [system] Activating via systemd: service name='org.freedesktop.home1' unit='dbus-org.freedesktop.home1.service' requested by ':1.797' (uid=0 pid=9148 comm="sudo cryptsetup open /media/usbkey/disk.img usbkey")
Nov 24 22:49:09 archie dbus-daemon[334]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.home1.service': Unit dbus-org.freedesktop.home1.service not found.
Nov 24 22:49:09 archie sudo[9148]: pam_systemd_home(sudo:account): systemd-homed is not available: Unit dbus-org.freedesktop.home1.service not found.
Nov 24 22:49:09 archie audit[9148]: USER_ACCT pid=9148 uid=1000 auid=1000 ses=2 msg='op=PAM:accounting grantors=pam_permit,pam_time acct="arif" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:09 archie audit[9148]: CRED_REFR pid=9148 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:09 archie audit[9148]: USER_START pid=9148 uid=0 auid=1000 ses=2 msg='op=PAM:session_open grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:09 archie sudo[9148]:     arif : TTY=pts/1 ; PWD=/home/arif ; USER=root ; COMMAND=/usr/bin/cryptsetup open /media/usbkey/disk.img usbkey
Nov 24 22:49:09 archie sudo[9148]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
Nov 24 22:49:13 archie sudo[9148]: pam_unix(sudo:session): session closed for user root
Nov 24 22:49:13 archie audit[9148]: USER_END pid=9148 uid=0 auid=1000 ses=2 msg='op=PAM:session_close grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:13 archie audit[9148]: CRED_DISP pid=9148 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:13 archie kernel: kauditd_printk_skb: 8 callbacks suppressed
Nov 24 22:49:13 archie kernel: audit: type=1106 audit(1606229353.441:736): pid=9148 uid=0 auid=1000 ses=2 msg='op=PAM:session_close grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:13 archie kernel: audit: type=1104 audit(1606229353.441:737): pid=9148 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:13 archie dbus-daemon[334]: [system] Activating via systemd: service name='org.freedesktop.home1' unit='dbus-org.freedesktop.home1.service' requested by ':1.798' (uid=0 pid=9240 comm="sudo mount -t ext4 /dev/mapper/usbkey /media/encry")
Nov 24 22:49:13 archie dbus-daemon[334]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.home1.service': Unit dbus-org.freedesktop.home1.service not found.
Nov 24 22:49:13 archie sudo[9240]: pam_systemd_home(sudo:account): systemd-homed is not available: Unit dbus-org.freedesktop.home1.service not found.
Nov 24 22:49:13 archie audit[9240]: USER_ACCT pid=9240 uid=1000 auid=1000 ses=2 msg='op=PAM:accounting grantors=pam_permit,pam_time acct="arif" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:13 archie audit[9240]: CRED_REFR pid=9240 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:13 archie audit[9240]: USER_START pid=9240 uid=0 auid=1000 ses=2 msg='op=PAM:session_open grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:13 archie sudo[9240]:     arif : TTY=pts/1 ; PWD=/home/arif ; USER=root ; COMMAND=/usr/bin/mount -t ext4 /dev/mapper/usbkey /media/encrypted
Nov 24 22:49:13 archie sudo[9240]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
Nov 24 22:49:13 archie kernel: audit: type=1101 audit(1606229353.448:738): pid=9240 uid=1000 auid=1000 ses=2 msg='op=PAM:accounting grantors=pam_permit,pam_time acct="arif" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:13 archie kernel: audit: type=1110 audit(1606229353.448:739): pid=9240 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:13 archie kernel: audit: type=1105 audit(1606229353.448:740): pid=9240 uid=0 auid=1000 ses=2 msg='op=PAM:session_open grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:13 archie audit[9240]: USER_END pid=9240 uid=0 auid=1000 ses=2 msg='op=PAM:session_close grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:13 archie audit[9240]: CRED_DISP pid=9240 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:13 archie sudo[9240]: pam_unix(sudo:session): session closed for user root
Nov 24 22:49:13 archie kernel: EXT4-fs (dm-0): mounted filesystem with ordered data mode. Opts: (null)
Nov 24 22:49:13 archie kernel: ext4 filesystem being mounted at /media/encrypted supports timestamps until 2038 (0x7fffffff)
Nov 24 22:49:13 archie kernel: audit: type=1106 audit(1606229353.454:741): pid=9240 uid=0 auid=1000 ses=2 msg='op=PAM:session_close grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:13 archie kernel: audit: type=1104 audit(1606229353.454:742): pid=9240 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:13 archie dbus-daemon[334]: [system] Activating via systemd: service name='org.freedesktop.home1' unit='dbus-org.freedesktop.home1.service' requested by ':1.799' (uid=0 pid=9245 comm="sudo chown -R 1000.1000 /media/encrypted ")
Nov 24 22:49:13 archie dbus-daemon[334]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.home1.service': Unit dbus-org.freedesktop.home1.service not found.
Nov 24 22:49:13 archie sudo[9245]: pam_systemd_home(sudo:account): systemd-homed is not available: Unit dbus-org.freedesktop.home1.service not found.
Nov 24 22:49:13 archie audit[9245]: USER_ACCT pid=9245 uid=1000 auid=1000 ses=2 msg='op=PAM:accounting grantors=pam_permit,pam_time acct="arif" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:13 archie kernel: audit: type=1101 audit(1606229353.458:743): pid=9245 uid=1000 auid=1000 ses=2 msg='op=PAM:accounting grantors=pam_permit,pam_time acct="arif" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:13 archie kernel: audit: type=1110 audit(1606229353.458:744): pid=9245 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:13 archie kernel: audit: type=1105 audit(1606229353.461:745): pid=9245 uid=0 auid=1000 ses=2 msg='op=PAM:session_open grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:13 archie audit[9245]: CRED_REFR pid=9245 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:13 archie audit[9245]: USER_START pid=9245 uid=0 auid=1000 ses=2 msg='op=PAM:session_open grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:13 archie sudo[9245]:     arif : TTY=pts/1 ; PWD=/home/arif ; USER=root ; COMMAND=/usr/bin/chown -R 1000.1000 /media/encrypted
Nov 24 22:49:13 archie sudo[9245]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=0)
Nov 24 22:49:13 archie audit[9245]: USER_END pid=9245 uid=0 auid=1000 ses=2 msg='op=PAM:session_close grantors=pam_limits,pam_unix,pam_permit acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:13 archie audit[9245]: CRED_DISP pid=9245 uid=0 auid=1000 ses=2 msg='op=PAM:setcred grantors=pam_faillock,pam_permit,pam_env,pam_faillock acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
Nov 24 22:49:13 archie sudo[9245]: pam_unix(sudo:session): session closed for user root

To be honest though, I don't know what I am looking for in the journals logs.

Arch Linux

#1 2020-11-25 07:43:49

LUKS encrypted container disappears completely after reboot

#2 2020-11-25 11:07:19

Re: LUKS encrypted container disappears completely after reboot

#3 2020-11-25 14:15:59

Re: LUKS encrypted container disappears completely after reboot

#4 2020-11-25 14:22:22

Re: LUKS encrypted container disappears completely after reboot

#5 2020-11-25 14:26:51

Re: LUKS encrypted container disappears completely after reboot

#6 2020-11-25 15:27:17

Re: LUKS encrypted container disappears completely after reboot

#7 2020-11-25 15:34:51

Re: LUKS encrypted container disappears completely after reboot

#8 2020-11-26 14:29:26

Re: LUKS encrypted container disappears completely after reboot

Board footer