Arch Linux

eom.dev

Member

Registered: 2022-02-11

Posts: 57

[SOLVED] full system encryption with external keyfile

I am attempting to configure full system encryption with an encrypted boot partition and am having difficulty getting grub to utilize a keyfile on an external USB.  My drive is partitioned as follows:

archiso ~ # lsblk
NAME                                                            MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS
loop0                                                             7:0    0 657.4M  1 loop  /run/archiso/airootfs
sda                                                               8:0    0 232.9G  0 disk  
├─sda1                                                            8:1    0   890M  0 part  /root/system/efi
└─sda2                                                            8:2    0   232G  0 part  
  └─luks-container-10312584f0d3                                 254:0    0   232G  0 crypt 
    ├─volume--group--2041db60d90b-logical--volume--cd8fcf56f8dc 254:1    0   128G  0 lvm   /root/system
    ├─volume--group--2041db60d90b-logical--volume--53a5cbe81740 254:2    0    64G  0 lvm   /root/system/var
    ├─volume--group--2041db60d90b-logical--volume--1a100498eb2f 254:3    0    32G  0 lvm   /root/system/home
    └─volume--group--2041db60d90b-logical--volume--34d7aadd612f 254:4    0     8G  0 lvm   
      └─luks-container-ee13bb65f750                             254:5    0     8G  0 crypt /root/system/vault
sdb                                                               8:16   1  28.9G  0 disk  
├─sdb1                                                            8:17   1   735M  0 part  /run/archiso/bootmnt
└─sdb2                                                            8:18   1    77M  0 part  
sdc                                                               8:32   1   3.8G  0 disk  /mnt

Device     Boot   Start       End   Sectors  Size Id Type
/dev/sda1          2048   1824767   1822720  890M ef EFI (FAT-12/16/32)
/dev/sda2       1824768 488397167 486572400  232G 8e Linux LVM

all sda and sdc mount points are ext4 with the exception of /root/system/efi, which is FAT32.

initramfs was configured to use systemd:

# vim:set ft=sh
# MODULES
# The following modules are loaded before any boot hooks are
# run.  Advanced users may wish to specify all system modules
# in this array.  For instance:
#     MODULES=(piix ide_disk reiserfs)
MODULES=()

# BINARIES
# This setting includes any additional binaries a given user may
# wish into the CPIO image.  This is run last, so it may be used to
# override the actual binaries included by a given hook
# BINARIES are dependency parsed, so you may safely ignore libraries
BINARIES=()

# FILES
# This setting is similar to BINARIES above, however, files are added
# as-is and are not parsed in any way.  This is useful for config files.
FILES=()

# HOOKS
# This is the most important setting in this file.  The HOOKS control the
# modules and scripts added to the image, and what happens at boot time.
# Order is important, and it is recommended that you do not change the
# order in which HOOKS are added.  Run 'mkinitcpio -H <hook name>' for
# help on a given hook.
# 'base' is _required_ unless you know precisely what you are doing.
# 'udev' is _required_ in order to automatically load modules
# 'filesystems' is _required_ unless you specify your fs modules in MODULES
# Examples:
##   This setup specifies all modules in the MODULES setting above.
##   No raid, lvm2, or encrypted root is needed.
#    HOOKS=(base)
#
##   This setup will autodetect all modules for your system and should
##   work as a sane default
#    HOOKS=(base udev autodetect block filesystems)
#
##   This setup will generate a 'full' image which supports most systems.
##   No autodetection is done.
#    HOOKS=(base udev block filesystems)
#
##   This setup assembles a pata mdadm array with an encrypted root FS.
##   Note: See 'mkinitcpio -H mdadm' for more information on raid devices.
#    HOOKS=(base udev block mdadm encrypt filesystems)
#
##   This setup loads an lvm2 volume group on a usb device.
#    HOOKS=(base udev block lvm2 filesystems)
#
##   NOTE: If you have /usr on a separate partition, you MUST include the
#    usr, fsck and shutdown hooks.
HOOKS=(base systemd autodetect keyboard modconf block sd-encrypt lvm2 filesystems fsck)

# COMPRESSION
# Use this to compress the initramfs image. By default, zstd compression
# is used. Use 'cat' to create an uncompressed image.
#COMPRESSION="zstd"
#COMPRESSION="gzip"
#COMPRESSION="bzip2"
#COMPRESSION="lzma"
#COMPRESSION="xz"
#COMPRESSION="lzop"
#COMPRESSION="lz4"

# COMPRESSION_OPTIONS
# Additional options for the compressor
#COMPRESSION_OPTIONS=()

and grub was configured as follows:

# GRUB boot loader configuration

GRUB_DEFAULT=0
GRUB_TIMEOUT=5
GRUB_DISTRIBUTOR="Arch"
GRUB_CMDLINE_LINUX_DEFAULT="loglevel=3 quiet"
GRUB_CMDLINE_LINUX="rd.luks.name={{luks-container-10312584f0d3-UUID}}=luks-container-10312584f0d3 rd.luks.key={{luks-container-10312584f0d3-UUID}}=/key-file-399909ae2535:UUID={{/dev/sdc-UUID}} root=/dev/volume-group-2041db60d90b/logical-volume-cd8fcf56f8dc"

# Preload both GPT and MBR modules so that they are not missed
GRUB_PRELOAD_MODULES="part_gpt part_msdos"

# Uncomment to enable booting from LUKS encrypted devices
GRUB_ENABLE_CRYPTODISK=y

# Set to 'countdown' or 'hidden' to change timeout behavior,
# press ESC key to display menu.
GRUB_TIMEOUT_STYLE=menu

# Uncomment to use basic console
GRUB_TERMINAL_INPUT=console

# Uncomment to disable graphical terminal
#GRUB_TERMINAL_OUTPUT=console

# The resolution used on graphical terminal
# note that you can use only modes which your graphic card supports via VBE
# you can see them in real GRUB with the command `vbeinfo'
GRUB_GFXMODE=auto

# Uncomment to allow the kernel use the same resolution used by grub
GRUB_GFXPAYLOAD_LINUX=keep

# Uncomment if you want GRUB to pass to the Linux kernel the old parameter
# format "root=/dev/xxx" instead of "root=/dev/disk/by-uuid/xxx"
#GRUB_DISABLE_LINUX_UUID=true

# Uncomment to disable generation of recovery mode menu entries
GRUB_DISABLE_RECOVERY=true

# Uncomment and set to the desired menu colors.  Used by normal and wallpaper
# modes only.  Entries specified as foreground/background.
#GRUB_COLOR_NORMAL="light-blue/black"
#GRUB_COLOR_HIGHLIGHT="light-cyan/blue"

# Uncomment one of them for the gfx desired, a image background or a gfxtheme
#GRUB_BACKGROUND="/path/to/wallpaper"
#GRUB_THEME="/path/to/gfxtheme"

# Uncomment to get a beep at GRUB start
#GRUB_INIT_TUNE="480 440 1"

# Uncomment to make GRUB remember the last selection. This requires
# setting 'GRUB_DEFAULT=saved' above.
#GRUB_SAVEDEFAULT=true

# Uncomment to disable submenus in boot menu
#GRUB_DISABLE_SUBMENU=y

# Probing for other operating systems is disabled for security reasons. Read
# documentation on GRUB_DISABLE_OS_PROBER, if still want to enable this
# functionality install os-prober and uncomment to detect and include other
# operating systems.
#GRUB_DISABLE_OS_PROBER=false

I can use the keys to unlock my drives to attempt different grub configurations, so I know they behave as expected; however, grub seems unable to utilize them to boot:

Welcome to GRUB!

Attempting to decrypt master key...
Enter passphrase for ...: _

I do not get to the grub splash screen, so I believe this is grub failing rather than the second request from initramfs (would specifying a keyfile with usb UUID in rd.luks.key satisfy this?).  My suspicion is that I am using the wrong UUIDs for the rd.luks.args - the wiki says to use the UUID of the luks container itself, but I'm not sure how the boot loader would know that before unlocking it.  I tried the UUIDs of the containing device as well with no luck.  I could use some help progressing as I am not sure what to try next.

Thank you for reading, I appreciate your time!

Last edited by eom.dev (2022-02-22 14:53:27)

frostschutz

Member

Registered: 2013-11-15

Posts: 1,649

Re: [SOLVED] full system encryption with external keyfile

cryptsetup luksDump?

eom.dev

Member

Registered: 2022-02-11

Posts: 57

Re: [SOLVED] full system encryption with external keyfile

cryptsetup luksDump?

Version:       	1
Cipher name:   	aes
Cipher mode:   	xts-plain64
Hash spec:     	sha256
Payload offset:	4096
MK bits:       	512
MK digest:     	aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 
MK salt:       	aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 
               	aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 
MK iterations: 	12345
UUID:          	{{/dev/sda2-UUID}}

Key Slot 0: ENABLED
	Iterations:         	1234567
	Salt:               	aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
	                      	aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa 
	Key material offset:	8
	AF stripes:            	4000
Key Slot 1: DISABLED
Key Slot 2: DISABLED
Key Slot 3: DISABLED
Key Slot 4: DISABLED
Key Slot 5: DISABLED
Key Slot 6: DISABLED
Key Slot 7: DISABLED

This largely looks as I would expect.  The UUID was the same as the one reported for /dev/sda2 by blkid, but I already tried this in the grub configuration.

As a side note, I'm not sure what, if anything, was necessary to censor from that output.  If you know I'd appreciate the knowledge.

frostschutz

Member

Registered: 2013-11-15

Posts: 1,649

Re: [SOLVED] full system encryption with external keyfile

The UUID shown in luksDump is the one you want for rd.luks...

There is only one key slot in use... is your keyfile ascii with no newlines, i.e. a typeable passphrase? If not you'll have to add a regular passphrase, so you can type it when Grub prompts you.

Grub has very limited crypto support and no support for keyfiles at all. If possible set it up without keyfiles first and only add it later if typing passphrase twice bothers you.

If your kernel/initramfs is unencrypted (on your efi partition or whatever), you can do away with grub's cryptodisk support altogether.

eom.dev

Member

Registered: 2022-02-11

Posts: 57

Re: [SOLVED] full system encryption with external keyfile

The UUID shown in luksDump is the one you want for rd.luks...

There is only one key slot in use... is your keyfile ascii with no newlines, i.e. a typeable passphrase? If not you'll have to add a regular passphrase, so you can type it when Grub prompts you.

Grub has very limited crypto support and no support for keyfiles at all. If possible set it up without keyfiles first and only add it later if typing passphrase twice bothers you.

If your kernel/initramfs is unencrypted (on your efi partition or whatever), you can do away with grub's cryptodisk support altogether.

Well that would be it then.  My intention was to only use a single key file on a usb to make that the single point of entry.  It sounds like there isn't really even a point to doing this since the key could just be embedded in initramfs.  Can you elaborate on the last part?  Do you mean that the efi partition contains something that negates the security?

eom.dev

Member

Registered: 2022-02-11

Posts: 57

Re: [SOLVED] full system encryption with external keyfile

That got me past grub, but now initramfs is timing out.  I'm having a very similar issue as mentioned here, but the proposed solution of moving autodetect later in the hooks did not solve the problem for me.  I tried adding the path to my LVM root as an argument to the grub configuration as well with no change in results.  Any suggestions?

eom.dev

Member

Registered: 2022-02-11

Posts: 57

Re: [SOLVED] full system encryption with external keyfile

That got me past grub, but now initramfs is timing out.  I'm having a very similar issue as mentioned here, but the proposed solution of moving autodetect later in the hooks did not solve the problem for me.  I tried adding the path to my LVM root as an argument to the grub configuration as well with no change in results.  Any suggestions?

It was my own fault with a typo in the UUID.  How embarrassing.