Arch Linux

chendler

Member

Registered: 2007-03-05

Posts: 13

[SOLVED] Root Encrypted Filesystem (LUKS)

Hello dudez! I just installed new fresh copy of Arch (Duke) here is my fstab

/dev/sda1 -> boot -> ext2
/dev/sda2 -> / -> reiserfs (/dev/mapper/root)

I cant boot it normal from beginnig always get same stuff

:: Checking Filesystems [BUSY]
/dev/mapper/root:  Reiserfs super block in block 16 on /dev/mapper/root of format 3.6 with standard journal
Blocks (total/free): 5000096/4884772 by 4096 bytes
Filesystem is clean
/dev/sda1: clean, 32/24096 files, 18360/96356 blocks

************** FILE SYSTEM CHECK FAILED ***************
Please repair manually and reboot. Note that the root
fileystem is currentyl mounted read-only. To remount
it read-write type: mount -n -o remount,rw /

blablabla

I checked all filesystems and they are clean and I still cant reboot! Help me please

Last edited by chendler (2007-06-09 21:29:28)

brain0

Developer

From: Aachen - Germany

Registered: 2005-01-03

Posts: 1,382

Re: [SOLVED] Root Encrypted Filesystem (LUKS)

Your /etc/fstab should have /dev/mapper/root as device for /, not /dev/sda2.

chendler

Member

Registered: 2007-03-05

Posts: 13

Re: [SOLVED] Root Encrypted Filesystem (LUKS)

it have /dev/mapper/root ;p

brain0

Developer

From: Aachen - Germany

Registered: 2005-01-03

Posts: 1,382

Re: [SOLVED] Root Encrypted Filesystem (LUKS)

Could you paste your fstab then?

chendler

Member

Registered: 2007-03-05

Posts: 13

Re: [SOLVED] Root Encrypted Filesystem (LUKS)

here it is:

none /dev/pts devpts defaults 0 0
none /dev/shm tmpfs defaults 0 0

/dev/cdrom /mnt/cdrom iso9660 ro,user,noauto,unhide 0 0
/dev/mapper/archive /mnt/archive reiserfs defaults 0 1
/dev/mapper/data /mnt/data reiserfs defults 0 1
/dev/mapper/home /home reiserfs defaults 1 2
/dev/mapper/root / reiserfs defaults 0 1
/dev/sda1 /boot ext2 defaults 0 1
/dev/mapper/swap swap swap defaults 0 0

I rewrited it by hand casue I dont have connection under arch till I boot

Last edited by chendler (2007-06-09 18:09:58)

brain0

Developer

From: Aachen - Germany

Registered: 2005-01-03

Posts: 1,382

Re: [SOLVED] Root Encrypted Filesystem (LUKS)

Obviously, at least one of the filesystems in /dev/mapper hasn't been opened. You could disable the filesystem check by putting a 0 in the last column to make your system boot.

chendler

Member

Registered: 2007-03-05

Posts: 13

Re: [SOLVED] Root Encrypted Filesystem (LUKS)

w00t thx brain0 ! I boot the arch finally. I notice that I dont have proper lines in /etc/crypttab
I make it

# NAME          SOURCE DEVICE           PASSWORD                OPTIONS
home            /dev/sda3               ASK
data            /dev/sda4               ASK
archive         /dev/sdb2               ASK

that for one, and rewrite the /etc/fstab

# <file system>         <dir>           <type>          <options>             <dump> <pass>
none                    /dev/pts        devpts          defaults                0       0
none                    /dev/shm        tmpfs           defaults                0       0
/dev/cdrom              /mnt/cdrom      iso9660         ro,user,noauto,unhide   0       0
/dev/mapper/archive     /mnt/archive    reiserfs        defaults                0       2
/dev/mapper/data        /mnt/data       reiserfs        defaults                0       2
/dev/mapper/home        /home           reiserfs        defaults                0       2
/dev/mapper/root        /               reiserfs        defaults                0       2
/dev/sda1               /boot           ext2            defaults                0       1
/dev/mapper/swap        swap            swap            defaults                0       0

and finally everything works cool and fast!! except this one line at boot

Configuring System Clock    [FAIL]
dunno why is it so I got proper date after login anyway;p

brain0

Developer

From: Aachen - Germany

Registered: 2005-01-03

Posts: 1,382

Re: [SOLVED] Root Encrypted Filesystem (LUKS)

w00t thx brain0 ! I boot the arch finally. I notice that I dont have proper lines in /etc/crypttab
I make it

# NAME          SOURCE DEVICE           PASSWORD                OPTIONS
home            /dev/sda3               ASK
data            /dev/sda4               ASK
archive         /dev/sdb2               ASK

that for one, and rewrite the /etc/fstab

As your root is already encrypted anyway, I recommend the following:

- Create a directory for keyfiles: mkdir /etc/crypttab.d; chmod 700 /etc/crypttab.d
- Create a keyfile: dd if=/dev/urandom of=/etc/crypttab.d/home bs=1K count=10; chmod 400 /etc/crypttab.d/home
- Add the keyfile as a second passphrase: cryptsetup luksAddKey /dev/sda3 /etc/crypttab.d/home (you have to enter your passphrase)
- Change /etc/crypttab to use it: home            /dev/sda3               /etc/crypttab.d/home

Do that for the other two as well. Now you only have to enter the passphrase for your root when you start the system, but you can still open the partitions with their own passphrase if necessary.

chendler

Member

Registered: 2007-03-05

Posts: 13

Re: [SOLVED] Root Encrypted Filesystem (LUKS)

Is it possible to get AES key from partition when someone for example get a root with exploit on my encrypted shell?

rochus

Member

Registered: 2007-02-14

Posts: 91

Re: [SOLVED] Root Encrypted Filesystem (LUKS)

Configuring System Clock    [FAIL]
dunno why is it so I got proper date after login anyway;p

Sorry for opening a solved thread, but do you have a solution to the Configuring System Clock failure? This happens to me, too...