You are not logged in.
Hello,
I have three hard drives:
- 1 SSD containing my /root partition; it's not encrypted;
- 1 HDD containing my /home partition; it's encrypted with LUKS, and uses LVM;
- 1 HDD containing some videos; it's also encrypted with LUKS, and uses the same passphrase as the other HDD.
I need two things:
1. decrypt my two disks at the same time: I'd like to enter the passphrase only once at boot; I've seen that you can use a keyfile, but I can't store it in my /root partition, since it's not encrypted; so I don't know how to solve this;
2. mount my second hard drive into the /videos folder of my /home partition in my first drive. Is it possible to mount it using my /etc/fstab, or should I only link my /videos folder to my second hard drive partition?
Thanks in advance for your help!
Last edited by LithoUser (2022-04-23 09:52:23)
Offline
1. decrypt my two disks at the same time: I'd like to enter the passphrase only once at boot; I've seen that you can use a keyfile, but I can't store it in my /root partition, since it's not encrypted; so I don't know how to solve this;
What is currently configured to unlock the two LUKS volumes? Are you currently prompted for the passphrase twice?
2. mount my second hard drive into the /videos folder of my /home partition in my first drive. Is it possible to mount it using my /etc/fstab, or should I only link my /videos folder to my second hard drive partition?
Have you tried it?
Offline
Thanks for answering!
Currently, I'm only prompted for the passphrase of my /home drive, using the following code in /etc/default/grub:
GRUB_CMDLINE_LINUX="cryptdevice=/dev/sdb1:vgroup"And I manually decrypt my second disk when I need it:
sudo cryptsetup luksOpen /dev/sdc1 lvm_newHave you tried it?
Which one? Should I rather try to mount it automatically with fstab inside of my /home/videos folder (I don't even know if it's possible), or to symlink it? I'm looking for an advice here...
Last edited by LithoUser (2022-04-19 08:48:24)
Offline
Thanks for answering!
Currently, I'm only prompted for the passphrase of my /home drive, using the following code in /etc/default/grub:
GRUB_CMDLINE_LINUX="cryptdevice=/dev/sdb1:vgroup"And I manually decrypt my second disk when I need it:
sudo cryptsetup luksOpen /dev/sdc1 lvm_new
If you instead of using grub to unlock /home use crypttab and also add the second disk to crypttab as well, systemd-cryptsetup will cache the password so you only need to enter it once.
loqs wrote:Have you tried it?
Which one? Should I rather try to mount it automatically with fstab inside of my /home/videos folder (I don't even know if it's possible), or to symlink it? I'm looking for an advice here...
You can use almost any directory as a mount point, so it is possible. If that user will be the only one using the file-system I can not see an issue with mounting it there.
Offline
Thanks for your help!
So:
1. I replace GRUB_CMDLINE_LINUX="cryptdevice=/dev/sdc1:vgroup_new" with GRUB_CMDLINE_LINUX="" in /etc/default/grub
2. In /etc/fstab, I delete the following line:
/dev/mapper/vgroup_new-lv_home_new /home ext4 rw,relatime 0 22. In /etc/crypttab (which is currently empty), I add:
home /dev/mapper/vgroup_new-lv_home_new
home/videos /dev/mapper/vgroup-lv_home/videosI should have added that my second HDD is in fact an old disk that contained all my /home folder; I've replaced it yesterday with a new hard drive. That's why both disks are encrypted and use LUKS, and that's why I have a "vgroup-lv_home" on my old HDD, and a "vgroup_new-lv_home_new" on my new one.
Is my approach the good one? Will the above code work, and ask for my passphrase only once?
Offline
crypttab opens the encrypted volumes. You still need fstab entries to mount the filesystems, the existing entry needs to mount the mapper entry for the LUKS volume not the LVM volume. I have never tried a / in the first field of crypttab. I suggest using - or _ instead.
In theory you should then only be prompted for one password.
Offline
Here's what I've done:
1. In /etc/default/grub: GRUB_CMDLINE_LINUX="cryptdevice=/dev/sdc1:vgroup_new" becomes GRUB_CMDLINE_LINUX=""
2. I've then re-generated /boot/grub/grub.cfg:
grub-mkconfig -o /boot/grub/grub.cfg3. I've edited /etc/crypttab like this:
home /dev/mapper/vgroup_new-lv_home_new
videos_old_hdd /dev/mapper/vgroup-lv_homeBut after a reboot, it doesn't work. It gives me the following error at startup (just after the grub screen):
ERROR: Failed to open encryption mapping: The device UUID=9e6(etc...) is not a LUKS volume and the crypto= parameter was not specified.
Last edited by LithoUser (2022-04-19 13:59:14)
Offline
The encrypt hook has been left in the hooks array in /etc/mkinitcpio.conf but there is are nothing for it to decrypt.
Offline
Right, I hadn't thought about that!
So I've chrooted, removed the "encrypt" hook and launched "mkinitcpio -P", then rebooted.
But it still doesn't work: the boot sequence is executed, then at the end of it (just before lightdm is launched) I have the following errors:
(1 of 2) A start job is running for /dev/mapper/vgroup-lv_home
(2 of 2) A start job is running for /dev/mapper/vgroup_new-lv_home_new
Last edited by LithoUser (2022-04-19 14:27:41)
Offline
Are the LVM2 physical and logical volumes detected and do they have the names you are using?
Offline
The boot sequence is displayed pretty fast, so I'm not sure how I could know that...
After a few minutes of the "start jobs", I'm in emergency mode. What should I do?
Offline
Check the output of:
pvs
vgs
lvs
ls /dev/mapperOffline
In fact, I can't type anything, since after the "start jobs", I have the following message (I translate it from french):
You are in emergency mode.
Unable to open access to the console, the root account is locked
See man page of sulogin(8) for more details.Press Enter to continue.
Pressing "Enter" only displays this same message again and again, but I never get a prompt...
Offline
Chroot in and comment out the crypttab entries. The system should then be able to complete booting.
Offline
did you add the UUID's to the crypttab?
you did this:
home /dev/mapper/vgroup_new-lv_home_new
videos_old_hdd /dev/mapper/vgroup-lv_homeshould be this:
new UUID=<uuid for NEW DRIVE goes here>
old UUID=<uuid for OLD DRIVE goes here> nofail,x-systemd.device-timeout=10the name of the lvms dont really matter so i just used NEW and OLD, also i added nofail for the dodgy drive that could fail at any time !
and for complete-ness here is what the fstab should look like:
/dev/mapper/vgroup_new-lv_home_new /home ext4 defaults 0 2
/dev/mapper/vgroup-lv_home /home/videos ext4 defaults,nofail,x-systemd.device-timeout=10 0 2that all SHOULD work, i had to re-think it many times so hope i got it right
EDIT: knew id make a mistake, added "ext4" to 2nd line of fstab
Last edited by jonno2002 (2022-04-20 01:44:11)
Offline
Mmmm... I'm not 100% sure of which UUID I should use: the one for my drive (/dev/sdc1) or the one for my /home partition?
$ lsblk -f
NAME TYPE FSTYPE LABEL UUID MOUNTPOINT
sda disk
└─sda1 part ext4 9e69dc04-0dce-48d4-8001-c6cb59e8446e /
sdb disk
└─sdb1 part crypto_LUKS 051f2f0a-948a-4df0-bec3-82c5c15cbcb4
sdc disk
└─sdc1 part crypto_LUKS aff8603c-ffff-405c-9ee0-0ae83c118a07
└─vgroup_new crypt LVM2_member PEBqC1-Fp8o-gfDW-yucg-OmtC-L5YZ-iOrXwO
├─vgroup_new-lv_swap_new lvm swap 76bc9719-61ae-4b94-9695-ac852e7edc67 [SWAP]
└─vgroup_new-lv_home_new lvm ext4 d8cd8eda-f1b4-4521-9c09-7606c24f2186 /homeOffline
the one for sdc1
Offline
It works now! A big thank you loqs and jonno2002!
One last thing: the root folder of my old HDD is now mounted in my videos folder; would there be a way to mount the videos folder of my old HDD instead of the root folder?
Offline
You have to mount the root of the filesystem (FS specific exceptions apply). You could bind mount the videos directory over the root directory so only the videos directory is visible.
Offline
In fact, it appears that my old drive is not mounted automatically.
Here's what I have now in my /etc/fstab:
# New HDD
/dev/mapper/vgroup_new-lv_home_new /home ext4 rw,relatime 0 2
# Old HDD
/dev/mapper/vgroup-lv_home /home/me/videos ext4 defaults,nofail,x-systemd.device-timeout=10 0 2If I launch "sudo mount -a" then my old drive is correctly mounted. But it's not mounted anymore after a reboot. What did I miss?
You could bind mount the videos directory over the root directory so only the videos directory is visible.
There are several folders (3 or 4) of my old drive that I'd like to mount in different folders of my new one. Is it possible?
Edit: I also have an error message when I reboot (just after the grub screen):
[ 2.948450] systemd[1]: /run/systemd/generator/systemd-cryptsetup@old_hdd.service:14: RequiresMountsFor= path is not absolute, ignoring: nofail,x-systemd.device-timeout=10
It refers to my /etc/crypttab file (containing "old_hdd etc."):
new_hdd UUID=aff8603c-ffff-405c-9ee0-0ae83c118a07
old_hdd UUID=051f2f0a-948a-4df0-bec3-82c5c15cbcb4 nofail,x-systemd.device-timeout=10Last edited by LithoUser (2022-04-20 09:43:41)
Offline
i think its because there is no 3rd field before the 4th field which is the options (nofail..etc), so it thinks that "nofail,x-systemd.device-timeout=10" is the location of the key/passphrase.
try this:
old_hdd UUID=051f2f0a-948a-4df0-bec3-82c5c15cbcb4 - nofail,x-systemd.device-timeout=10notice the " - " which should hopefully null the 3rd field and prompt for password, or in this case use the already given password for "new_hdd"
thats the plan anyway see if it works !
Offline
I'm really sorry for the late answer, I was away from my home for two days. Thanks a lot for your answer!
Your modification in /etc/crypttab worked: no more error message. But the "old_hdd" is still not mounted at boot. I have to mount it using "sudo mount -a".
I've checked the logs; there *could* be an explanation there:
$ journalctl -b
avril 23 07:48:53 MYPC systemd[1]: dev-mapper-vgroup\x2dlv_home.device: Job dev-mapper-vgroup\x2dlv_home.device/start timed out.
avril 23 07:48:53 MYPC systemd[1]: Timed out waiting for device /dev/mapper/vgroup-lv_home.
avril 23 07:48:53 MYPC systemd[1]: Dependency failed for File System Check on /dev/mapper/vgroup-lv_home.
avril 23 07:48:53 MYPC systemd[1]: Dependency failed for /home/me/videos/Films.It happens just after the passphrase has been entered.
So the 3 first lines refer to my new drive (the second line is displayed in red) and the last line refers to my old drive... but the error message is too vague to be useful for me.
Offline
maybe its taking longer than the 10 second timeout for the hdd to decrypt the lvm and have it available to mount.
i guess you could raise the timeout or add "noauto" to the options so it will mount on first access and not at boot time
Offline
Yes, raising the timeout in /etc/fstab to 30 secs allows it to correctly mount my drives. Thank you very much!
Now, instead of mounting my whole drive I need to find a way to mount only a few specific folders. For example, I need to do this:
old_hdd/Videos/my_movies -> mounted to new_hdd/home/me/videos/my_movies
new_hdd/home/me/downloads -> mounted to old_hdd/DownloadsYou could bind mount the videos directory over the root directory so only the videos directory is visible.
I don't understand what "bind mount the videos directory over the root directory" means...
... but maybe I should open a new post?
Last edited by LithoUser (2022-04-23 07:47:43)
Offline
you cant really use loqs method if you want to mount 2 different folders, here is what id do:
/etc/fstab:
/dev/mapper/vgroup-lv_home /home/me/oldhdd ext4 defaults,nofail,x-systemd.device-timeout=30 0 2
/home/me/oldhdd/Videos/my_movies /home/me/videos/my_movies none bind,nofail 0 0
/home/me/oldhdd/Downloads /home/me/downloads none bind,nofail 0 0make sure all mount points exist obviously, i dont know your filesystem so have just used the exact info youve given.
Offline