[SOLVED] Failing to setup password prompt on boot for LUKS encryption

deltaQuadrantTux · 2021-12-15 05:13:40

Hello all. In a few weeks ill be doing a moderate upgrade on my system and am planning to do a fresh install of linux. One of the things I have always skipped out on was setting up LUKs encryption - so, long story short, I'm trying to learn just that in a VM. The problem is that I am not being prompted for a password on boot. Right now my best hypothesis is that my /etc/crypttab is improperly setup. I am not certain on that, and since I am currently unsure of what to try next I figured I would ask here.

I targeted the "LVM on LUKS" section of the dm-crypt wiki page ( https://wiki.archlinux.org/title/Dm-cry … VM_on_LUKS ). I am utilizing UEFI, Grub, and targeting the regular encrypt hook. Finally, I also made sure to set lukes to user version/type 1 when running cryptsetup. Below are a few relevant files, please let me know if there are any that I've forgotten:

mkinitcpio.conf

# MODULES
# The following modules are loaded before any boot hooks are
# run.  Advanced users may wish to specify all system modules
# in this array.  For instance:
#     MODULES=(piix ide_disk reiserfs)
MODULES=()

# BINARIES
# This setting includes any additional binaries a given user may
# wish into the CPIO image.  This is run last, so it may be used to
# override the actual binaries included by a given hook
# BINARIES are dependency parsed, so you may safely ignore libraries
BINARIES=()

# FILES
# This setting is similar to BINARIES above, however, files are added
# as-is and are not parsed in any way.  This is useful for config files.
FILES=()

# HOOKS
# This is the most important setting in this file.  The HOOKS control the
# modules and scripts added to the image, and what happens at boot time.
# Order is important, and it is recommended that you do not change the
# order in which HOOKS are added.  Run 'mkinitcpio -H <hook name>' for
# help on a given hook.
# 'base' is _required_ unless you know precisely what you are doing.
# 'udev' is _required_ in order to automatically load modules
# 'filesystems' is _required_ unless you specify your fs modules in MODULES
# Examples:
##   This setup specifies all modules in the MODULES setting above.
##   No raid, lvm2, or encrypted root is needed.
#    HOOKS=(base)
#
##   This setup will autodetect all modules for your system and should
##   work as a sane default
#    HOOKS=(base udev autodetect block filesystems)
#
##   This setup will generate a 'full' image which supports most systems.
##   No autodetection is done.
#    HOOKS=(base udev block filesystems)
#
##   This setup assembles a pata mdadm array with an encrypted root FS.
##   Note: See 'mkinitcpio -H mdadm' for more information on raid devices.
#    HOOKS=(base udev block mdadm encrypt filesystems)
#
##   This setup loads an lvm2 volume group on a usb device.
#    HOOKS=(base udev block lvm2 filesystems)
#
##   NOTE: If you have /usr on a separate partition, you MUST include the
#    usr, fsck and shutdown hooks.
HOOKS=(base udev autodetect modconf block encrypt lvm2 filesystems keyboard fsck)

# COMPRESSION
# Use this to compress the initramfs image. By default, zstd compression
# is used. Use 'cat' to create an uncompressed image.
#COMPRESSION="zstd"
#COMPRESSION="gzip"
#COMPRESSION="bzip2"
#COMPRESSION="lzma"
#COMPRESSION="xz"
#COMPRESSION="lzop"
#COMPRESSION="lz4"

# COMPRESSION_OPTIONS
# Additional options for the compressor
#COMPRESSION_OPTIONS=()

Grub
This is the relevant portion of the default config, the rest i left unchanged.

GRUB_CMDLINE_LINUX="cryptdevice=UUID=b54f3850-89dd-4968-ac01-9a6a226f0bf1:cryptlvm root=/dev/theCup/root"

/etc/crypttab
Just the following line i added:

cryptDrive         /dev/vda2        none    timeout=180

Partition mapping

/dev/vda
--/dev/vda1 (EFI Boot partition)
--/dev/vda2
----/dev/theCup/root
----/dev/theCup/home
----/dev/theCup/swap

On boot you see regular Grub, then it displays the text Starting Version 249.7-2. It hangs here for a little bit (probably about a minute or 90 seconds). Then it spits out the error ERROR: Device '/dev/theCup/root' not found. Skipping fsck. And that's as far as I am getting at the moment!

Last edited by deltaQuadrantTux (2022-01-16 18:29:28)

deltaQuadrantTux · 2021-12-17 01:09:24

I'm not sure if a technical "bump" is allowed - but I've still been working away at trying to figure out what the problem is here. I've retraced the steps of the wiki-page, double checked various pages around Grub, mkinitcpio, cryptab, etc. I feel confident that the partitions and encryption itself are setup correctly. I can consistently and reliably mount and chroot into the encrypted partitions. Still, no matter what I've tried, I am never prompted for a password on boot.

Again, any and all help is appreciated! This is my last attempt at this I believe, as I've only so much time to spend tediously rebooting a virtual machine lol.

Mods, if this secondary comment/bump is not allowed then feel free to remove.

kuna · 2021-12-18 10:08:01

I ran into a somewhat similar situation to what you describe today. I had the UUID messed up in

/boot/loader/entries/arch.conf

. I'm not sure where I got the UUID that I was using, but it certainly wasn't the right one. Can you double-check the output of

blkid

to make sure you have the right UUID?

Last edited by kuna (2021-12-18 10:09:26)

deltaQuadrantTux · 2021-12-18 15:08:17

kuna wrote:

I ran into a somewhat similar situation to what you describe today. I had the UUID messed up in
/boot/loader/entries/arch.conf
. I'm not sure where I got the UUID that I was using, but it certainly wasn't the right one. Can you double-check the output of
blkid
to make sure you have the right UUID?

This is my hunch as well. In the time being I took a step back from LVM + Luks, and just targeted setting up standard Luks without a grouped volume. That, actually, worked well! Well, it didn't read my keyboard input - but I'm still counting it as a victory in the interim lol.

With that said, I've not attempted the LVM + Luks setup since. Logically, the only thing wrong here has to be the UUID - so my next attempt will likely involve trying other UUIDs as I was definitely getting confused there.

Danathar · 2022-01-06 19:51:04

kuna wrote:

I ran into a somewhat similar situation to what you describe today. I had the UUID messed up in
/boot/loader/entries/arch.conf
. I'm not sure where I got the UUID that I was using, but it certainly wasn't the right one. Can you double-check the output of
blkid
to make sure you have the right UUID?

I was looking into doing the full disk encryption thing myself as well, but everytime I read some documentation that indicates I'm going to have to enter a gaggly long UUID...well I KNOW I'll mess that up somehow and hose it. Scares me away every time. Not because I'm "scared" of doing it, but "scared" of investing all the time and effort only to be thwarted by a single mistake in a UUID entry.

Seems like this could be improved upon. Full disk encryption in Arch is a pain and takes time and work to do.

Slithery · 2022-01-06 20:16:27

Danathar wrote:

I was looking into doing the full disk encryption thing myself as well, but everytime I read some documentation that indicates I'm going to have to enter a gaggly long UUID...well I KNOW I'll mess that up somehow and hose it. Scares me away every time. Not because I'm "scared" of doing it, but "scared" of investing all the time and effort only to be thwarted by a single mistake in a UUID entry.

Copy and paste?

loqs · 2022-01-06 20:44:54

Generate the config line with the value filled in. Append that to the config, then you just need to position correctly in the config file, e.g..

echo "cryptdevice=UUID=$(blkid -s UUID -o value /dev/device):root root=/dev/mapper/root" >> /path/to/config

Last edited by loqs (2022-01-06 20:45:26)

Arch Linux

#1 2021-12-15 05:13:40

[SOLVED] Failing to setup password prompt on boot for LUKS encryption

#2 2021-12-17 01:09:24

Re: [SOLVED] Failing to setup password prompt on boot for LUKS encryption

#3 2021-12-18 10:08:01

Re: [SOLVED] Failing to setup password prompt on boot for LUKS encryption

#4 2021-12-18 15:08:17

Re: [SOLVED] Failing to setup password prompt on boot for LUKS encryption

#5 2022-01-06 19:51:04

Re: [SOLVED] Failing to setup password prompt on boot for LUKS encryption

#6 2022-01-06 20:16:27

Re: [SOLVED] Failing to setup password prompt on boot for LUKS encryption

#7 2022-01-06 20:44:54

Re: [SOLVED] Failing to setup password prompt on boot for LUKS encryption

Board footer