How to make Grub not ask for luks password for Ubuntu

I May Need · 2021-03-08 11:23:35

sda1 luks encrypted Arch with keyfiles sda1/a.key and also sda2/b.key
sda2 luks encrypted Ubuntu with keyfiles same as above

Computer boots up, and asks for sda1 luks password (which is the same as sda2 password) to get into grub.
Then, when I select Arch entry, I can boot into Arch without a password, also it puts sda2 as dev/mapper/Kubuntu automatically without a password.
But, when I select Ubuntu, it asks for sda2 luks password (which is the same as sda1 password). And also, after entering sda2 password, Ubuntu puts sda1 as /dev/mapper/Arch without a password.

At this point, I am able to unlock multiple drives with one password, but not able to boot into the second one without a password.

Is there a way to make grub not ask for luks password for sda2?
Can grub boot into 2 different entries by just entering password one time before grub?

Thanks.

Last edited by I May Need (2021-03-08 11:29:36)

Lone_Wolf · 2021-03-08 13:53:48

Maybe https://wiki.archlinux.org/index.php/GR … pted_/boot helps ?

I May Need · 2021-03-08 16:43:19

I have been reading every related page.
In this case, I am booting from Arch initramfs and kernel and I am trying to find the right entry for Ubuntu to tell that to use the passphrase I typed to enter grub.
But every time I am getting: "Trying to decrypt master key for sda2"

I even tried using the key file in sda2 to boot Arch without password (after entering grub). It works.
But I do not know how to boot Ubuntu without password, even though I am using a key file in sda2, where Ubuntu is, and even though this key file is in the key file pattern of Ubuntu.

Since, I am not getting much replies, I am now thinking, it might not be possible because Arch uses different initramfs and kernel, and Ubuntu uses different one.
Arch states that password are saved in the keyring, but of course this does (might) not apply to Ubuntu boot entry.
Maybe, I am just trying to do something impossible.
(I am able to unlock multiple drives, but not boot into them with the passphrase I type to enter grub)

/etc/default/grub has entries for both in the kernel parameters.

Last edited by I May Need (2021-03-08 16:45:12)

respiranto · 2021-03-08 22:39:57

I assume you followed this:
https://wiki.archlinux.org/index.php/Dm … _initramfs

If so, you should apply that not only to Arch, but also to Ubuntu. That is, modify the initrd, and possibly the kernel command line (in grub.cfg--on Arch, for Ubuntu).

I know that it is possible on Debian, so most likely also on Ubuntu.

I May Need · 2021-03-09 12:41:15

I am still not able to.

Let's say keyfile is on Ubuntu (sda2) at /etc/keys/key.key (And also on sda1/etc/keys/key.key, please read below)
How do I enter Arch mkinitcpio.conf this file?

Both sda1 and sda2 are btrfs and has subvolumes of @ and @home (key file is NOT in @home, so it does not matter. Grub entries states rootflags as subvol=@)

So, when it decrypts sda1, it goes to dev/mapper/Arch first, and in fstab, to / (In Ubuntu fstab, to /media/Arch)
When it decrypts sda2, it goes to dev/mapper/Kubuntu first, and in fstab, to /media/Kubuntu (In Ubuntu fstab, to / )

Currently, Ubuntu etc/cryptsetup-initramfs/conf.hook has /etc/keys/key.key and Arch /etc/mkinitcpio.conf has /etc/keys/key.key /media/Kubuntu/keys/key.key
(I copied the key.key to Arch and both partitions have both keys in their key slots and they share the same passphrase in their key slot 0 on both)

When I created the initramfs, it did not give an error, but of course at Grub stage, the partition is only mounted at /dev/mapper/Kubuntu. (or even not yet)

Ubuntu only allows *.* entries in conf.hook, but Arch mkinitcpio.conf allows multiple entries with separated by space.
But I still cannot find the right description in mkinitcpio.conf (or conf.hook) files entry or the right grub kernel parameters and the right grub entries.

The thing is that, when I choose the Ubuntu entry, it always states "Trying to decrypt master key at hd0,2. Please enter password for..."

I believe I do not have the right Ubuntu entry.

	load_video
	insmod gzio
	if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
	insmod part_msdos
	insmod cryptodisk
	insmod luks
	insmod gcry_rijndael
	insmod gcry_rijndael
	insmod gcry_sha256
	insmod btrfs
	cryptomount -u c1223888egf25998cc1eg63cb09gg73d
	set root='cryptouuid/c1223888egf25998cc1eg63cb09gg73d'
	if [ x$feature_platform_search_hint = xy ]; then
	  search --no-floppy --fs-uuid --set=root --hint='cryptouuid/c1223888egf25998cc1eg63cb09gg73d' 248335fb-egd7-55ed-b3b8-g2035dd52be1
	else
	  search --no-floppy --fs-uuid --set=root 248335fb-egd7-55ed-b3b8-g2035dd52be1
	fi
	linux	/@/boot/vmlinuz root=UUID=248335fb-egd7-55ed-b3b8-g2035dd52be1 rw rootflags=subvol=@ 
rd.luks.name=c1223888-egf2-5998-cc1e-g63cb09gg73d=Kubuntu 
rd.luks.key=c1223888-egf2-5998-cc1e-g63cb09gg73d=/etc/keys/key.key rd.luks.name=f0g9d2ff-f6f5-5f47-ccd4-486c26g41c05=Arch 
rd.luks.key=f0g9d2ff-f6f5-5f47-ccd4-486c26g41c05=/etc/keys/key.key quiet splash $vt_handoff
	initrd	/@/boot/initrd.img

/dev/sda1: UUID="f0g9d2ff-f6f5-5f47-ccd4-486c26g41c05"

/dev/sda2: UUID="c1223888-egf2-5998-cc1e-g63cb09gg73d"

/dev/mapper/Arch: LABEL="Arch" UUID="333f3fg2-8596-5ee8-078b-c8494c66df30"

/dev/mapper/Kubuntu: UUID="248335fb-egd7-55ed-b3b8-g2035dd52be1"

Last edited by I May Need (2021-03-09 18:16:53)

I May Need · 2021-03-11 09:34:54

respiranto wrote:

I assume you followed this:
https://wiki.archlinux.org/index.php/Dm … _initramfs
If so, you should apply that not only to Arch, but also to Ubuntu. That is, modify the initrd, and possibly the kernel command line (in grub.cfg--on Arch, for Ubuntu).
I know that it is possible on Debian, so most likely also on Ubuntu.

I wonder if you have a sample Ubuntu/debian entry.

My entry has to involve cryptomount and unfortunately cryptomount asks for the password instead of using the keyfile in initramfs.
In my entry, I have to cryptomount, otherwise, it is not finding the encrypted device uuid (uuid of /dev/mapper/Kubuntu)

respiranto · 2021-03-14 18:57:02

From your `grub.cfg' excerpt:

	cryptomount -u c1223888egf25998cc1eg63cb09gg73d

This should cause the second password prompt. I wrongly thought it was displayed in the initrd stage.

To have a single GRUB password prompt for both installations, both pairs of initrd and kernel need to the reside on the same encrypted container. Therefore, either
a) move both installations' `/boot' partitions on top of the same LUKS container (e.g., use LVM; Btrfs probably also works), or
b) move both /boot directories on the same filesystem.

On a)
I don't know much about Btrfs, but I assume you could create a subvolume "ubuntu-boot" on Arch's Btrfs and mount it at /boot in Ubuntu (and elsewhere in Arch).

On b)
The easy version would essentially be:

arch> mv /media/Kubuntu/boot /ubuntu-boot
arch> mkdir /media/Kubuntu/boot
arch> mount -o bind /ubuntu-boot /media/Kubuntu/boot
arch> $EDITOR /media/Kubuntu/etc/fstab    # bind-mount /media/arch/ubuntu-boot at /boot
arch> # Update grub.cfg

I May Need · 2021-03-15 12:28:48

respiranto wrote:

From your `grub.cfg' excerpt:
	cryptomount -u c1223888egf25998cc1eg63cb09gg73d
This should cause the second password prompt. I wrongly thought it was displayed in the initrd stage.
To have a single GRUB password prompt for both installations, both pairs of initrd and kernel need to the reside on the same encrypted container. Therefore, either
a) move both installations' `/boot' partitions on top of the same LUKS container (e.g., use LVM; Btrfs probably also works), or
b) move both /boot directories on the same filesystem.
On a)
I don't know much about Btrfs, but I assume you could create a subvolume "ubuntu-boot" on Arch's Btrfs and mount it at /boot in Ubuntu (and elsewhere in Arch).
On b)
The easy version would essentially be:
arch> mv /media/Kubuntu/boot /ubuntu-boot
arch> mkdir /media/Kubuntu/boot
arch> mount -o bind /ubuntu-boot /media/Kubuntu/boot
arch> $EDITOR /media/Kubuntu/etc/fstab    # bind-mount /media/arch/ubuntu-boot at /boot
arch> # Update grub.cfg

Thanks for this.
I will inform the results.

Arch Linux

#1 2021-03-08 11:23:35

How to make Grub not ask for luks password for Ubuntu

#2 2021-03-08 13:53:48

Re: How to make Grub not ask for luks password for Ubuntu

#3 2021-03-08 16:43:19

Re: How to make Grub not ask for luks password for Ubuntu

#4 2021-03-08 22:39:57

Re: How to make Grub not ask for luks password for Ubuntu

#5 2021-03-09 12:41:15

Re: How to make Grub not ask for luks password for Ubuntu

#6 2021-03-11 09:34:54

Re: How to make Grub not ask for luks password for Ubuntu

#7 2021-03-14 18:57:02

Re: How to make Grub not ask for luks password for Ubuntu

#8 2021-03-15 12:28:48

Re: How to make Grub not ask for luks password for Ubuntu

Board footer