auto mount usb hdd with custom btrfs/luks/veracrypt parameters

pepelepew · 2021-05-06 10:25:17

Hi,

I'm not very experienced in Arch and coming from Manjaro, then EndeavourOS.

I've asked this question there but no answer, so thought I'd come to the source.

I’m trying to figure out following for XFCE (not at boot time):

1) How to auto-mount for external usb disks with btrfs default settings; This seems to work automatically anyway.

2) How to auto-mount for external usb disks with custom btrfs settings, ie. ZSTD:10 compression setting; then do this +

3) How to auto mount luks usb volumes;

a) Where does arch store the luks password when it auto mounts?

b) How does arch identify the usb disk? I'm guessing its from the UUID, but where is this stored if I want to reset it?

4) How to auto mount veracrypt usb volumes; then

5) How to auto mount hidden veracrypt usb volume;

6) How to auto mount usb volume with headerless luks offset (ie. hidden luks).

I've managed to do 2,3,4 at boot time with cryptab and fstab. cryptsetup doesn't care if its luks or veracrypt which is great. Not figured out how to do (5) or (6) at boot time.

(1) seems to auto happen for me, although I'm not clear on mechanism.

When looking at (1) it seems that this might be controlled by org.freedesktop.UDisks2.Filesystem. I say this because I received an error showing this process during my enquiries. Not sure where this saves the settings.

(3) was working for me too, but not anymore on a particular usb disk. I had put in the luks password once, and system seemed to remember it forever with auto luks mount in future. However, I then created a hidden luks volume on the same usb disk partition. (headerless with offset).

This stopped (3) working for me. I'm guessing arch must see it has 2 passwords stored for the same UUID and gets confused so stops? How could I reset this and delete the UUID saved?

I saw a post about polkit being used for auto-mount, but can see there are no settings under polkit rules.d so that can't be the mechanism.

I thought the automount might be using Volman from Thunar, but it runs even when Thunar isn’t working so I don’t think its Volman.

I’m pretty confident that the process (Udisks2 or Volman) is storing info about the USB UUID in my home directory somehwere. (I did a timeshift to previous snapshot and system still remembered the USB).

If anybody could assist to guide me with:

- (5), (6) at boot time

and

- (2) to (6) for external usb not at boot time , I'd be really grateful.

If it can't be answered in this forum, then there's nowhere else I can think of.

Please keep answer in simple terms with clear idiots guide steps, as I'm still a noob.

Thanks in advance.

ua4000 · 2021-05-11 07:50:23

Hi,
I will not answer your questions in any detail, but I will give you a hint, how to solve your *different* tasks:

a) read the arch wiki, many topics are there already answered, starting with "fstab" or "btrfs" for your 1)
b) if you stuck on a specific step, make a new post for exactly this *one* issue, paste you steps, and the error message, and what you have tried already. You will get probably more answers than on this "huge" issue catalog.

Khere · 2021-05-11 09:19:48

1) How to auto-mount for external usb disks with btrfs default settings; This seems to work automatically anyway.

You have to modify your /etc/fstab file, adding the PARTUUID of the partition and the mount options. For more info : https://wiki.archlinux.org/title/fstab

2) How to auto-mount for external usb disks with custom btrfs settings, ie. ZSTD:10 compression setting; then do this +

Also here you have to modify the fstab file or simply use systemd --> https://wiki.archlinux.org/title/fstab# … th_systemd

3) How to auto mount luks usb volumes;

https://kifarunix.com/automount-luks-en … -in-linux/

a) Where does arch store the luks password when it auto mounts?

The key is not stored with the encrypted data, the encrypted key is. This is part of the header. In short, when the volume is created a random key (the master key) is generated and this random key is encrypted using a key derived from the passphrase, and spread out (using an algorithm called 'afsplit'). This key derivation is designed to take a relatively long time (half a second or so), so it's relatively expensive to try passphrases as an attacker. By design the system's security depends on the passphrase's quality; a bad passphrase is somewhat protected due to the long time per try, but would fail in the end. The header also contains an independent check to see that the passphrase that was entered has resulted in the correct master key.

The header is not secret but essential to open the volume: it contains all the parameters that have been used when the volume was created, so that (with a correct passphrase) the master key can be recomputed from the header (and this key is used to decrypt the actual file system data). So it's always stored with the data. It is recommended to backup the header (to a separate system, say a USB drive), but this is just to prevent data loss when the header would get corrupted (if a bit is changed, you cannot recompute the correct master key any more).

b) How does arch identify the usb disk? I'm guessing its from the UUID, but where is this stored if I want to reset it?

If the PARTUUID (not UUID) is write in the fstab file with the mout option it will be detected and mounted, the only way to modify a PARTUUID is formatting the partition.
To get the PARTUUID of the partition use blkid :

sudo blkid /dev/*

4) How to auto mount veracrypt usb volumes

https://wiki.archlinux.org/title/TrueCr … t_on_login

5) How to auto mount hidden veracrypt usb volume;

https://wiki.archlinux.org/title/TrueCr … t_on_login

6) How to auto mount usb volume with headerless luks offset (ie. hidden luks).

IDK but try yo search on the Arch wiki

Last edited by Khere (2021-05-11 09:41:03)

pepelepew · 2021-05-16 19:53:54

thanks so much for the help and tips.

I've managed to:

1. auto-login on boot hidden veracrypt partition on sda, by doing the following:

cryptab
veracrypt1 /dev/sda5 /dev/null tcrypt-veracrypt,tcrypt-hidden,tcrypt-keyfile=/keyfile.bin

fstab
dev/mapper/veracrypt1 /media/veracrypt1 btrfs defaults,noatime,space_cache,autodefrag,compress=zstd:10 0 2

this works great.

I'm now trying to

2. auto-mount external USB hidden veracrypt volume.

I've checked

https://wiki.archlinux.org/title/fstab# … th_systemd

This would work with a luks partition as it has a UUID. I'm avoiding luks as its not compatible with windows machines and doesn't have easy hidden volume options.

With hidden veracrypt partition its a problem as the partition doesn't have a UUID so I can't identify it in cryptab or fstab.

Its too unreliable to use /dev/sdb3 as this could change if multiple usb disks added.

Do you have any ideas how I could reference the veracrypt usb without a UUID to refer to?

Thanks

pepelepew · 2021-05-17 01:35:48

Although I couldn't create UUID for veracrypt partition, I managed to use the PARTUUID for veracrypt partition on a GPT disk.

cryptab
veracrypt2 PARTUUID=xxxxxxx-b4b3-4371-9f43-xxxxxxxxxx /dev/null tcrypt-veracrypt,tcrypt-hidden,tcrypt-keyfile=/keyfile.bin

fstab
/dev/mapper/veracrypt2 /media/veracrypt2 btrfs defaults,noatime,space_cache,autodefrag,compress=zstd:10 0 2

I tried using nofail and noauto to test if this would work for an external usb, but it failed even on the above internal partition. System booted, but file programs stopped working like thunar and even ls.

#/dev/mapper/veracrypt2 /media/veracrypt2 btrfs nofail,x-systemd.device-timeout=1ms,noauto,x-systemd.automount,defaults,noatime,space_cache,autodefrag,compress=zstd:10 0 2

Could you please advise:

1. How can I identify an msdos usb partition? as it doesn't have partuuid (which is for gpt only I think), and label/uuid not accessible. I tried tune2fs but that gave an error when trying to change UUID on msdos usb partition with veracrypt.

2. Why does nofail and noauto not work in fstab?

3. How is endeavouros auto mounting a luks usb without any fstab entries? Just remembers password from last thunar use.

thanks

Khere · 2021-05-18 09:33:09

pepelepew wrote:

1. How can I identify an msdos usb partition? as it doesn't have partuuid (which is for gpt only I think), and label/uuid not accessible. I tried tune2fs but that gave an error when trying to change UUID on msdos usb partition with veracrypt.

The PARTUUID is the identifier of the partition, doesn't matter the type of the label partition.
For get the PARTUUID of a msdos partition you have to do

dd if=/dev/$YOURDEVICE bs=1 count=4 skip=440 2>/dev/null | od -t x4 -An

I'm not sure that's this work, use it at your risk, reference :
https://unix.stackexchange.com/question … tion-table.

2. Why does nofail and noauto not work in fstab?

Noauto is the option that means that the device would not be mounted at boot, Nofail allows the boot sequence to continue even if the drive fails to mount.
Both are option used at boot time and both aren't in default settings, but both also work

3. How is endeavouros auto mounting a luks usb without any fstab entries? Just remembers password from last thunar use.

Endeavouros is not arch, the boot option can be different

Last edited by Khere (2021-05-19 15:48:32)

Arch Linux

#1 2021-05-06 10:25:17

auto mount usb hdd with custom btrfs/luks/veracrypt parameters

#2 2021-05-11 07:50:23

Re: auto mount usb hdd with custom btrfs/luks/veracrypt parameters

#3 2021-05-11 09:19:48

Re: auto mount usb hdd with custom btrfs/luks/veracrypt parameters

#4 2021-05-16 19:53:54

Re: auto mount usb hdd with custom btrfs/luks/veracrypt parameters

#5 2021-05-17 01:35:48

Re: auto mount usb hdd with custom btrfs/luks/veracrypt parameters

#6 2021-05-18 09:33:09

Re: auto mount usb hdd with custom btrfs/luks/veracrypt parameters

Board footer