Arch Linux

Derson5

Member

Registered: 2010-07-29

Posts: 35

[SOLVED] How to pass two encrypted disk with dracut?

Hi,

I created two virtual disk in qemu with 3 partitions each other:
VDA
vda1 - for efi
vda2 - for system (encrypted with crypto-luks)
vda3 - for boot

VDB
vdb1 - for nothing (just wanted the same schemat)
vdb2 - for system (encrypted with crypto-luks)
vdb3 - for boot

vda2 and vdb2 are encrypted and paired with btrfs raid1. vda3 and vdb3 are just paired with btrfs raid1. For kernel image I used dracut.

lsblk -f

NAME      FSTYPE      FSVER LABEL     UUID                                 FSAVAIL FSUSE% MOUNTPOINT
loop0     squashfs    4.0                                                                 
sr0       iso9660           RESCUE701 2020-11-22-07-45-48-00                              
vda                                                                                       
├─vda1    vfat        FAT32           D291-2216                                           
├─vda2    crypto_LUKS 2               5469bc3c-62a6-46b4-aa5f-6a3d40ecbaa5                
│ └─arch1 btrfs             evildead  e96cf794-128c-4d7d-a31d-0ebee10e74d9  243.2G     2% /var/lib/postgres
└─vda3    btrfs             boot      9ec714e2-7d30-4b47-b513-07437262dd97                
vdb                                                                                       
├─vdb1    vfat        FAT32           0460-E84C                                           
├─vdb2    crypto_LUKS 2               48a50855-b683-4b3a-8be5-e5fd89437329                
│ └─arch2 btrfs             evildead  e96cf794-128c-4d7d-a31d-0ebee10e74d9                
└─vdb3    btrfs             boot      9ec714e2-7d30-4b47-b513-07437262dd97

/etc/fstab

# Static information about the filesystems.
# See fstab(5) for details.

# <file system> <dir> <type> <options> <dump> <pass>
# /dev/mapper/arch1 LABEL=evildead
UUID=e96cf794-128c-4d7d-a31d-0ebee10e74d9       /               btrfs           rw,relatime,compress-force=zstd:3,space_cache,subvolid=261,subvol=/evildead,subvol=evildead     0 0

# /dev/mapper/arch1 LABEL=evildead
UUID=e96cf794-128c-4d7d-a31d-0ebee10e74d9       /home           btrfs           rw,relatime,compress-force=zstd:3,space_cache,subvolid=262,subvol=/evildead-home,subvol=evildead-home   0 0

# /dev/mapper/arch1 LABEL=evildead
UUID=e96cf794-128c-4d7d-a31d-0ebee10e74d9       /var/lib/postgres       btrfs           rw,relatime,compress-force=zstd:3,space_cache,subvolid=263,subvol=/postgresql,subvol=postgresql 0 0

# /dev/vda3 LABEL=boot
UUID=9ec714e2-7d30-4b47-b513-07437262dd97       /boot           btrfs           rw,relatime,compress-force=zstd:3,space_cache,subvolid=5,subvol=/       0 0

/etc/crypttab

# Configuration for encrypted block devices.
# See crypttab(5) for details.

# NOTE: Do not list your root (/) partition here, it must be set up
#       beforehand by the initramfs (/etc/mkinitcpio.conf).

# <name>       <device>                                     <password>              <options>
# home         UUID=b8ad5c18-f445-495d-9095-c9ec4f9d2f37    /etc/mypassword1
# data1        /dev/sda3                                    /etc/mypassword2
# data2        /dev/sda5                                    /etc/cryptfs.key
# swap         /dev/sdx4                                    /dev/urandom            swap,cipher=aes-cbc-essiv:sha256,size=256
# vol          /dev/sdb7                                    none

arch1         UUID=5469bc3c-62a6-46b4-aa5f-6a3d40ecbaa5        none    luks
arch2         UUID=48a50855-b683-4b3a-8be5-e5fd89437329        none    luks

/etc/dracut.conf.d/myflags.conf

hostonly="yes"
compress="zstd"
add_dracutmodules+=" crypt btrfs "

/etc/dracut.conf.d/cmdline.conf

kernel_cmdline="rd.luks.uuid=luks-5469bc3c-62a6-46b4-aa5f-6a3d40ecbaa5 root=/dev/mapper/arch1 rootfstype=btrfs rootflags=rw,relatime"

When system boot, I see grub, I can choose normal kernel or fallback version, after this I need to push password for disk1 and disk2, but when enter password for one of disks, I can't push passwod for second one. I'm not sure what I do wrong. I bet on badly made /etc/dracut.conf.d/cmdline.conf, maybe add second disk? But I'm not sure how to write this.

https://imgur.com/sWvs5Ao

Edit.
I slve this, I needed change /etc/dracut.conf.d/cmdline.conf to this:

kernel_cmdline="rd.luks.uuid=luks-5469bc3c-62a6-46b4-aa5f-6a3d40ecbaa5 root=/dev/mapper/arch1 rootfstype=btrfs rootflags=rw,relatime rd.cmdline=ask rd.luks.uuid=luks-48a50855-b683-4b3a-8be5-e5fd89437329 root=/dev/mapper/arch2 rootfstype=btrfs rootflags=rw,relatime"

Last edited by Derson5 (2020-12-28 22:39:17)