Hi folks,
I have Alpine Linux installed in an encrypted LUKS partition. I came across this tutorial which shows how to setup a key in a USB drive and when the drive is inserted and the computer booted, the LUKS partition auto-unlocks with the key on the USB drive.
I would like to setup the same thing but I do not have Alpine linux installed on ZFS, so I’m looking for ways to adapt the instructions.
So far, what I’ve done is:
- I’ve setup the key on the usb stick and I can unlock the LUKS partition with that key.
- create a
/etc/mkinitfs/features.d/usb-unlock.shscript with the following content:
(the echo to /dev/kmesg was to check whether the script did indeed run at boot by trying to print to the kernel messages but I can’t find anything in the kernel messages).
#!/bin/sh
echo "usb-unlock script starting..." > /dev/kmsg
USB_MOUNT="/mnt/my-usb-key" # The USB stick mounting point
LUKS_KEY_FILE="awesome.key" # The name of your keyfile on the USB stick
# Search for the USB stick with the key
for device in $(ls /dev/disk/by-uuid/*); do
mount $device $USB_MOUNT 2>/dev/null
if [ -f "$USB_MOUNT/$LUKS_KEY_FILE" ]; then
# Unlock the LUKS partition
cryptsetup luksOpen /dev/sda3 cryptroot \
--key-file "$USB_MOUNT/$LUKS_KEY_FILE" && exit 0
fi
umount $USB_MOUNT
done
echo "No USB key found, falling back to password prompt." # this message never appears, despite not having found the key on the usb stick
echo "usb-unlock script ending." > /dev/kmsg
- I added
usb-unlockto thefeaturesinmkinitfs.conf:
mytestalpine:~# cat /etc/mkinitfs/mkinitfs.conf
features="ata base ide scsi usb virtio ext4 cryptsetup keymap usb-unlock"
- run
mkinitfsto rebuild the initramfs. Then reboot to test the implementation, which was unsuccessful.
What am I missing / doing wrong? Thank you for your help!
Edit: forgot to add step 4
Thank you for your help.
I decided to give dracut a shot, see how far I could get.
I created a directory
/usr/lib/dracut/modules.d/99usb-mountin which I created two scripts: A first module/usr/lib/dracut/modules.d/99usb-mount/module-setup.sh, executable:#!/bin/bash check() { return 0 } depends() { echo "crypt" return 0 } install() { inst_hook pre-mount 90 "$moddir/usb-mount.sh" }And a second script
/usr/lib/dracut/modules.d/99usb-mount/usb-mount.sh, also executable:#!/bin/bash LUKS_PARTITION=/dev/sda3 USB_NKL=/dev/disk/by-uuid/<MY-UUID> USB_MOUNT_DIR=/mnt/my-usb/ KEY_FILENAME=mykey.key # Wait for the USB to be detected and available for i in {1..10}; do if [ -b ${USB_NKL} ]; then break fi sleep 1 done # Mount the USB stick mount ${USB_NKL} ${USB_MOUNT_DIR} # Check if the mount was successful if [ $? -ne 0 ]; then echo "Failed to mount USB stick" exit 1 fi # Unlock the LUKS partition using the keyfile if [ -e "${USB_MOUNT_DIR}/${KEY_FILENAME}" ]; then cryptsetup luksOpen "${LUKS_PARTITION}" cryptroot --key-file "${USB_MOUNT_DIR}/${KEY_FILENAME}" else echo "Keyfile not found!" echo "Failed to unlock LUKS partition" exit 1 fiI then fixed some dependencies and got around installing
device-mapper, providingdmsetup, required bydm, required bycrypt, required by my scripts.Then I ran:
dracut -f, which didn’t seem to have any issue and includes my module:[...] dracut[I]: *** Including module: usb-mount *** [...] dracut[E]: ldconfig exited ungracefully [...] dracut[I]: *** Creating initramfs image file '/boot/initramfs-6.6.54-0-lts.img' done ***Not sure if this
ldconfigerror should be of any concern? The end image seems to have been created successfully.When I check the verbose output, I see my module being included:
dracut[D]: -rwxr-xr-x 0/0 747 2024-10-07 22:30:00 lib/dracut/hooks/pre-mount/90-usb-mount.shHowever, it is here numbered 90 when above I had placed it in 99, no idea what that’s about? (edit: actually I wrote 90 in the
module-setup.sh, so this is normal I guess).Then I rebooted with my key and the prompt for my password to unlock my LUKS partition still appeared.
In the kernel messages I see my usb stick being detected (perhaps not mounted?) prior to the password prompt, so not sure what’s going on. Do you see any issue with my attempt? Or would you happen to have any propositions for debugging this further? I’m a bit lost as to how I can diagnose the issue.
Here are the kernel messages regarding the usb detection and a few seconds later, me unlocking the LUKS partition:
[ 1.748076] usb 1-1: new high-speed USB device number 2 using xhci_hcd # usb 1-1 / sdb is my USBkey. It seems to have been detected but not mounted? [ 2.068060] device-mapper: uevent: version 1.0.3 [ 2.068190] device-mapper: ioctl: 4.48.0-ioctl (2023-03-01) initialised: dm-devel@redhat.com [ 2.078157] Key type encrypted registered [ 2.153792] usb 1-1: New USB device found, idVendor=067b, idProduct=2517, bcdDevice= 1.00 [ 2.153799] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=6 [ 2.153801] usb 1-1: Product: ClipDrive [ 2.153803] usb 1-1: Manufacturer: BUFFALO [ 2.153805] usb 1-1: SerialNumber: A9200502030000221 [ 2.155494] usb-storage 1-1:1.0: USB Mass Storage device detected [ 2.157341] scsi host3: usb-storage 1-1:1.0 [ 2.159772] usbcore: registered new interface driver uas [ 3.221531] scsi 3:0:0:0: Direct-Access BUFFALO ClipDrive 1.00 PQ: 0 ANSI: 0 CCS [ 3.224250] sd 3:0:0:0: [sdb] 507904 512-byte logical blocks: (260 MB/248 MiB) [ 3.227885] sd 3:0:0:0: [sdb] Write Protect is off [ 3.227899] sd 3:0:0:0: [sdb] Mode Sense: 23 00 00 00 [ 3.231635] sd 3:0:0:0: [sdb] No Caching mode page found [ 3.231645] sd 3:0:0:0: [sdb] Assuming drive cache: write through [ 3.247551] sd 3:0:0:0: [sdb] Attached SCSI removable disk [ 6.323670] EXT4-fs (dm-0): orphan cleanup on readonly fs # the 3 seconds gap is me unlocking the LUKS using the keyboard [ 6.323954] EXT4-fs (dm-0): mounted filesystem 33a8b408-37ff-4b8a-98bf-bba8b6f00604 ro with ordered data mode. Quota mode: none. [ 6.324134] Mounting root: ok.Dracut may have this functionality already built in via rd.luks.key, so a custom module would really only make sense if you’re trying to do more than that. You can probably get away with just using that if you just want it to work, but if you want to customize stuff:
I suspect your module is running well after the device is already supposed to be
cryptsetup opened. The way the default crypt module handles it is by setting up udev configuration in a very early phase, and then having udev request the password a little bit later when it finds the device it’s trying to open, until all devices are ready. It’s a complex mechanism compared to Alpine’s straightforward script, but it’s much more flexible when it comes to ordering of things like RAID/network devices/LUKS/etc.The result of that is that your code would have to run much earlier. There’s some documentation on how hooks work, and the builtin
rd.luks.key/ keydev handler runs at cmdline 10. That’s well before your pre-mount, and probably where you’d want to run your code. Based on a cursory inspection of the other code, you could eithercryptsetup openit yourself if you use the name it expects (rd.luks.name=cmdline parameter orluks-$luks_container_uuid), or you could use that/tmp/luks.keysmechanism (it’s a dracut-internal thing so you won’t find much documentation, but it lives in crypt-lib.sh, cryptroot-ask.sh and probe-keydev.sh).As for debugging, the cmdline manpage has a few decent enough options.
rd.break=cmdlineor similar can force a shell before Dracut goes through a specific phase of hooks. You should be able to manually test doing things similar to your script at that point.Thank you for your help. I spent time digging into this rabbit hole, and while I’ve learned a lot, I am struggling to get the basics to work. Right now, I’m focusing on being able to just boot an image I created using dracut, excluding all the initial stuff I wanted, just be able to reproduce the original functionality of being able to unlock my luks partition using my keyboard.
Where I’m at: I am building my initramfs using the following command:
dracut -f -v --add crypt --add lvm --add dm. I get the following output log:Output log
mytestalpine:~# dracut -f -v --add crypt --add lvm --add dm dracut[I]: Executing: /usr/bin/dracut -f -v --add crypt --add lvm --add dm dracut[I]: Module ‘dash’ will not be installed, because command ‘dash’ could not be found! dracut[I]: Module ‘mksh’ will not be installed, because command ‘mksh’ could not be found! dracut[I]: Module ‘caps’ will not be installed, because command ‘capsh’ could not be found! dracut[I]: Module ‘modsign’ will not be installed, because command ‘keyctl’ could not be found! dracut[I]: Module ‘i18n’ will not be installed, because command ‘loadkeys’ could not be found! dracut[I]: Module ‘url-lib’ will not be installed, because command ‘curl’ could not be found! dracut[I]: Module ‘btrfs’ will not be installed, because command ‘btrfs’ could not be found! dracut[I]: Module ‘dmraid’ will not be installed, because command ‘dmraid’ could not be found! dracut[I]: Module ‘dmsquash-live-ntfs’ will not be installed, because command ‘ntfs-3g’ could not be found! dracut[I]: Module ‘mdraid’ will not be installed, because command ‘mdadm’ could not be found! dracut[I]: Module ‘crypt-gpg’ will not be installed, because command ‘gpg’ could not be found! dracut[I]: Module ‘cifs’ will not be installed, because command ‘mount.cifs’ could not be found! dracut[I]: Module ‘iscsi’ will not be installed, because command ‘iscsi-iname’ could not be found! dracut[I]: Module ‘iscsi’ will not be installed, because command ‘iscsiadm’ could not be found! dracut[I]: Module ‘iscsi’ will not be installed, because command ‘iscsid’ could not be found! dracut[I]: 95nfs: Could not find any command of ‘rpcbind portmap’! dracut[I]: Module ‘nvmf’ will not be installed, because command ‘nvme’ could not be found! dracut[I]: Module ‘nvmf’ will not be installed, because command ‘jq’ could not be found! dracut[I]: Module ‘biosdevname’ will not be installed, because command ‘biosdevname’ could not be found! dracut[I]: Module ‘masterkey’ will not be installed, because command ‘keyctl’ could not be found! dracut[I]: Module ‘dash’ will not be installed, because command ‘dash’ could not be found! dracut[I]: Module ‘mksh’ will not be installed, because command ‘mksh’ could not be found! dracut[I]: Module ‘caps’ will not be installed, because command ‘capsh’ could not be found! dracut[I]: Module ‘modsign’ will not be installed, because command ‘keyctl’ could not be found! dracut[I]: Module ‘url-lib’ will not be installed, because command ‘curl’ could not be found! dracut[I]: Module ‘btrfs’ will not be installed, because command ‘btrfs’ could not be found! dracut[I]: Module ‘dmraid’ will not be installed, because command ‘dmraid’ could not be found! dracut[I]: Module ‘dmsquash-live-ntfs’ will not be installed, because command ‘ntfs-3g’ could not be found! dracut[I]: Module ‘mdraid’ will not be installed, because command ‘mdadm’ could not be found! dracut[I]: Module ‘crypt-gpg’ will not be installed, because command ‘gpg’ could not be found! dracut[I]: Module ‘cifs’ will not be installed, because command ‘mount.cifs’ could not be found! dracut[I]: Module ‘iscsi’ will not be installed, because command ‘iscsi-iname’ could not be found! dracut[I]: Module ‘iscsi’ will not be installed, because command ‘iscsiadm’ could not be found! dracut[I]: Module ‘iscsi’ will not be installed, because command ‘iscsid’ could not be found! dracut[I]: 95nfs: Could not find any command of ‘rpcbind portmap’! dracut[I]: Module ‘nvmf’ will not be installed, because command ‘nvme’ could not be found! dracut[I]: Module ‘nvmf’ will not be installed, because command ‘jq’ could not be found! dracut[I]: Module ‘masterkey’ will not be installed, because command ‘keyctl’ could not be found! dracut[I]: *** Including module: sh *** dracut[I]: *** Including module: busybox *** dracut[I]: *** Including module: crypt *** dracut[I]: *** Including module: dm *** dracut[D]: Skipping udev rule: 10-dm.rules dracut[D]: Skipping udev rule: 13-dm-disk.rules dracut[D]: Skipping udev rule: 95-dm-notify.rules dracut[D]: Skipping udev rule: 64-device-mapper.rules dracut[D]: Skipping udev rule: 60-persistent-storage-dm.rules dracut[D]: Skipping udev rule: 55-dm.rules dracut[I]: *** Including module: kernel-modules *** dracut[I]: *** Including module: kernel-modules-extra *** dracut[D]: kernel-modules-extra: configuration source “/run/depmod.d” does not exist dracut[D]: kernel-modules-extra: configuration source “/etc/depmod.d” does not exist dracut[D]: kernel-modules-extra: configuration source “/lib/depmod.d” does not exist dracut[I]: *** Including module: lvm *** dracut[D]: Skipping udev rule: 11-dm-lvm.rules dracut[D]: Skipping udev rule: 64-device-mapper.rules dracut[D]: Skipping udev rule: 56-lvm.rules dracut[D]: Skipping udev rule: 60-persistent-storage-lvm.rules dracut[I]: *** Including module: rootfs-block *** dracut[I]: *** Including module: terminfo *** dracut[I]: *** Including module: udev-rules *** dracut[D]: Skipping udev rule: 70-persistent-net.rules dracut[I]: *** Including module: usrmount *** dracut[I]: *** Including module: base *** dracut[I]: *** Including module: fs-lib *** dracut[I]: *** Including module: shutdown *** dracut[I]: *** Including modules done *** dracut[I]: *** Installing kernel module dependencies *** dracut[I]: *** Installing kernel module dependencies done *** dracut[I]: *** Resolving executable dependencies *** dracut[I]: *** Resolving executable dependencies done *** dracut[I]: *** Hardlinking files *** dracut[D]: Mode: real dracut[D]: Method: sha256 dracut[D]: Files: 457 dracut[D]: Linked: 0 files dracut[D]: Compared: 0 xattrs dracut[D]: Compared: 6 files dracut[D]: Saved: 0 B dracut[D]: Duration: 0.015759 seconds dracut[I]: *** Hardlinking files done *** dracut[I]: Could not find ‘strip’. Not stripping the initramfs. dracut[I]: *** Generating early-microcode cpio image *** dracut[I]: *** Store current command line parameters *** dracut[I]: Stored kernel commandline: dracut[I]: rootfstype=ext4 rootflags=rw,relatime dracut[E]: ldconfig exited ungracefully dracut[I]: *** Creating image file ‘/boot/initramfs-6.6.56-0-lts.img’ *** dracut[I]: Using auto-determined compression method ‘gzip’ dracut[D]: Image: /var/tmp/dracut.Ds3W3x/initramfs.img: 12M dracut[D]: ======================================================================== dracut[D]: Version: dracut-060 dracut[D]: lib/dracut/dracut-060 dracut[D]: dracut[D]: Arguments: -f -v --add ‘crypt’ --add ‘lvm’ --add ‘dm’ dracut[D]: lib/dracut/build-parameter.txt dracut[D]: dracut[D]: dracut modules: dracut[D]: sh dracut[D]: busybox dracut[D]: crypt dracut[D]: dm dracut[D]: kernel-modules dracut[D]: kernel-modules-extra dracut[D]: lvm dracut[D]: rootfs-block dracut[D]: terminfo dracut[D]: udev-rules dracut[D]: usrmount dracut[D]: base dracut[D]: fs-lib dracut[D]: shutdown dracut[D]: lib/dracut/modules.txt dracut[D]: ========================================================================
<Truncanted due to char limit>
Then I updated the
/boot/extlinux.conffile, adding the following second entry (displaying the first one just for comparison):LABEL lts MENU DEFAULT MENU LABEL Linux lts LINUX vmlinuz-lts INITRD initramfs-lts APPEND root=/dev/mapper/root modules=sd-mod,usb-storage,ext4 cryptroot=<my-uuid> cryptdm=root quiet rootfstype=ext4 LABEL lts MENU LABEL dracut-img LINUX vmlinuz-lts INITRD /boot/initramfs-6.6.56-0-lts.img APPEND root=/dev/mapper/root modules=sd-mod,usb-storage,ext4 cryptroot=UUID=<my-uuid> cryptdm=root quiet rootfstype=ext4 rootflags=rw,relatimeI added the
rootflags=rw,relatimebecause this was shown in the dracut log, so I thought perhaps that mattered. But for the most part I left it the same as the previous entry, because I’m trying to do the same thing I suppose. Perhaps I’m mistaken?The current result of booting that image leads to a long loading (not asking for the passphrase to unlock the partition) then displaying the following error:
dracut Warning: Could not boot. dracut Warning: "/dev/mapper/root" does not exist Generating "/run/initramfs/rdsosreport.txt" You might want to save "/run/initramfs/rdsosreport.txt" to a USB stick or /boot after mounting them and attach it to a bug report. To get more debug information in the report, reboot with "rd.debug" added to the kernel command line. Dropping to debug shell.Before dropping me in a shell, in which I have not found anything useful to do. I am surely missing something basic as my understanding of what’s happening is pretty superfluous.
What I’m noticing which may be of importance:
dracut[E]: ldconfig exited ungracefully, in the dracut output log. Perhaps this matters and should be fixed? An image is nonetheless generated.device-mapperandlvmmissing, why did dracut complain about them missing for me to compile my own image? and would I need to add options in the/boot/extlinux.conffile, when they are not required for the original boot entry, when all I’m trying to do (as a start) is just make sure I can reproduce a bootable kernel image?I think you should check your
root=line and add ard.luks.uuid=to make it open it. Dracut will by default open the root FS as/dev/mapper/luks-abcdef...based on the LUKS container UUID. You can get that withcryptsetup luksUUID./dev/mapper/rootis just never going to show up unless you’ve assigned a custom name to that with the barely documentedrd.luks.name, and I don’t see that in your setup. Thecryptrootandcryptdmparameters aren’t used by Dracut either.With all of that missing it’s just gonna wait for that
/dev/mapper/rootto magically show up out of nowhere, without ever trying to open it.A correct cmdline will probably look something along the lines of
root=/dev/mapper/luks-<uuid> modules=sd-mod,usb-storage,ext4 rootfstype=ext4 rootflags=rw,relatime rd.luks.uuid=<uuid>and once opening with passphrase works, you can start to mess withrd.luks.key=/awesome.key(and readdquietwhen done debugging, if you want it that way).ldconfig errors and the missing modules should be fine. musl’s ldconfig is just a bit different but also isn’t required in quite the same way. I don’t think you should need to mess with modules manually. I don’t think you’re using LVM’s userland for your setup, just all the device-mapper kernel modules. Dracut will pull all the necessary bits in for you if you’re setting it up for LUKS.