| View previous topic :: View next topic |
| Author |
Message |
324874
Apprentice
Joined: 26 Jul 2014
Posts: 168
|
 Posted: Wed Nov 09, 2016 7:14 pm Post subject: [SOLVED] LUKS, crypt. root, dracut: wrong authentication. |
 |
|
Hi!
Quick request:
Can anyone provide a tutorial explaining how to load a UEFI image that decrypts (LUKS) the root filesystem?
Introduction:
I tried to install Gentoo once again (note). I learn programming and I wish to build secure softwares so I installed an hardened system.
Context: (boot, root file system encrypted, UEFI without bootloader)
I encrypted the root filesystem using LUKS and I built an initramfs with dracut. I read wiki articles (cf. ref) and the dracut manual.
The dracut manual says using the shell (rd.shell) to decrypt needed partitions or make the glue (write a script).
I don't know how to write the script so I added the rd.shell in the dracut configuration file: /etc/dracut.conf.
Finally, I created the initramfs and I embeded this one in the kernel.
Issue: (password prompt instead of key file)
I encrypted the partitions (LUKS) using a key file. However, I have to enter a password to unlock the root file system (boot).
I tried to add a password to access the encrypted storage and I used this password but the password didn't work (luksAddKey).
I don't understand well the dracut parameters or the needed kernel parameters:
I added dm, crypt, base, rootfs, usrmount, bash, kernel-modules, udev-rules, etc. (conf. file), --hostonly --no-compress initramfs (cmd line).
I hadn't try add_device+="..." and /etc/crypttab -- I added rd.shell and I used /etc/conf.d/dmcrypt (although I don't know how to use it).
ref:
Location of the thread:
I posted this message in this forum because I have succeeded several times the Gentoo installation and because I have another unrelated question.
A part of the system is in the testing branch (musl: experimental). Is is better to switch the system to the testing branch (~amd64)?
Note: I installed Gentoo different ways (meta-distribution). I didn't know what I wanted first times or how to get what I wanted.
Best regards, feng.
Last edited by 324874 on Thu Nov 10, 2016 11:32 am; edited 1 time in total |
|
| Back to top |
|
 |
Roman_Gruber
Advocate
Joined: 03 Oct 2006
Posts: 3846
Location: Austro Bavaria
|
| Posted: Wed Nov 09, 2016 10:59 pm Post subject: |
|
|
| Quote: | Quick request:
Can anyone provide a tutorial explaining how to load a UEFI image that decrypts (LUKS) the root filesystem?
|
I usually do this.
Install a binary distro. Reuse the bootloader, ditch the rest. so i have a working grub2. (Faster, less errors. Installing from a working binary distro is the fastest way)
setup partitons as the gentoo handbook wants it.
make root partion as => big lvm container => big luks container inside => big ext4 inside (aka root) (I will not discuss why, too complicated ... too many opinions! I have my reasons and my backup strategy relies on this structure)
The boot partition contains the grub2 bootloader e.g. from linux mint, the grub.cfg is manually edited with nano so I can add / change the gentoo boot entries. The kernel line contains needed needed bootparameters for luks / lvm. the initramfs line contains the genkernel initramfs + microcode initramfs from intel.
I use openrc / eudev + minimalistic desctop. NO SYSTEMD
--
When you use gnu linux for quite a while and have a basic knowledge you will succeed with the above information.
For in detail guids you can reuse any ARCH / gentoo instruction. Careful as these days systemd disease makes things more complicated or worse.
Feel free to ask when something is not clear. I recommend that you read guides and when you understand what is done than you should start with that.
My way of installation was created from several guides, includes gentoo handbook, arch + gentoo generic guides in the past + expierence as long term gentoo user + generic info on how a box boots and such (has not changed basically since kernel 2.0.0). I designed it for privacy, easy way of backup my data. I doubt many have a working way of fully backup their hole gentoo installtion
--
Hardened makes things complicated. If it's useful or not? no idea. depends if you use binary gpu drivers or not!
no bootloader => well when you want ot go the difficult route
a key file? are you serious a key file? => complicated => hell no! (again many guys have different opinions)
| Quote: | | dracut is an event driven initramfs infrastructure. dracut (the tool) is used to create an initramfs image by copying tools and files from an installed system and combining it with the dracut framework, usually found in /usr/lib/dracut/modules.d. |
well when you want to do everything from scratch go ahead
genkernel works for myself for years. I only create it once and reuse it.
genkernel uses busybox afaik. works, easy to understand. I had to fix a coding error in the initramfs created by the "evil" automated scripts. now it works. I do not see the point on redoing the work which others have done. I reuse what is available to speed up.
| Quote: | | I don't know how to write the script |
+ no idea about dracut
reuse / use genkernel initramfs and thats it. when it does not work. unpack it, read the script and adapt it and repack. (I did that because of an error in genkernel / design flaw)
--
Hint: keep a live media on your shelf when you run encryption and keep necessary notes on your shelf too with that media on how to mount root for example ! |
|
| Back to top |
|
|
324874
Apprentice
Joined: 26 Jul 2014
Posts: 168
|
| Posted: Thu Nov 10, 2016 7:40 am Post subject: I've found errors: LUKS master key vs LUKS slot keys |
|
|
Hi, Roman_Gruber! I thank you for the answer. I used a key file because the entropy is higher (random data). [1]
I don't use LVM with LUKS: "Be aware that if you add LVM into the mix, things can get very complicated." [2]
I found some errors/misunderstandings after I remembered the cryptsetup FAQ. I used the LUKS master key instead of the LUKS slot keys, in the dracut configuration file. [3]
Moreover, I remembered the shell (rd.shell) is launched when something goes wrong. However, I believe the process happened well.
I'm going to modify the configuration file to see if it works and I'm going to read again the cryptsetup FAQ because the presentation is clear.
Notes:
The first time, my purpose was to use plain dm-crypt. However, I haven't understood how to use it although I read the Arch Linux wiki articles about plain dm-crypt.
This method isn't promoted except for "security experts" (according to the maintainer(s) of the cryptsetup FAQ).
I find genkernel easier than dracut but I find that dracut is more suited for an advanced configuration.
[1] Source: https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions (section 5.9 Is LUKS secure with a low-entropy (bad) passphrase?)
[2] Source: idem. (section 2.2 LUKS on partitions or raw disks?)
[3] I sometimes "unmerge" dracut but the configuration file was protected so I kept the wrong configuration. I added luks.key... ="<LUKS master key>" instead of a LUKS slot key.
Best regards, feng. |
|
| Back to top |
|
|
axl
Veteran
Joined: 11 Oct 2002
Posts: 1144
Location: Romania
|
| Posted: Thu Nov 10, 2016 10:04 am Post subject: Re: LUKS, encrypted root, dracut: wrong authentication metho |
|
|
| feng wrote: | Issue: (password prompt instead of key file)
I encrypted the partitions (LUKS) using a key file. However, I have to enter a password to unlock the root file system (boot).
I tried to add a password to access the encrypted storage and I used this password but the password didn't work (luksAddKey). |
each luks fs can have up to 8 keys. keys could be either files or passwords. in fact, i dont think cryptsetup sees a difference. but admins do.
if you used a key file to lock a fs, you will reference it with -d. such as:
cryptsetup open /dev/sda sda-unlocked -d /path/to/key.file
if you use -d, cryptsetup will NOT ask you for a password but use /path/to/key.file as the password.
second thing you gonna know is that luksAddKey SHOULD work. same thing.
cryptsetup luksAddKey /path/to/luks_fs -d /path/to/key.file /path/to/another.key.
or
cryptsetup luksAddKey /path/to/luks_fs -d /path/to/key.file
and in this case, cryptsetup will know to unlock fs with /path/to/key.file and ask for a password from keyboard as new key. |
|
| Back to top |
|
|
axl
Veteran
Joined: 11 Oct 2002
Posts: 1144
Location: Romania
|
| Posted: Thu Nov 10, 2016 10:28 am Post subject: Re: I've found errors: LUKS master key vs LUKS slot keys |
|
|
| feng wrote: | | I find genkernel easier than dracut but I find that dracut is more suited for an advanced configuration. |
I really dont know how dracut is handling luks, but I could explain how genkernel does. It's all about boot parameters. genkernel has: root/crypto_root, root_key, root_keydev. these are the most relevant.
There are 2 basic ways to unlock a luks fs at boot.
First easy way is to unlock it with a password inputed from keyboard. In which case, you dont do anything. Dont need to worry about the key. They key is in your head.
The second way is to make initrd unlock the fs for you using a key. Now obviously you do not want the key in the same place as all the other stuff that is locked, because you couldn't read it then. so it has to be on some device that is unlocked. It shouldn't be an internal device because that way anyone could just copy the key. So obviously a usb stick or smth like that.
and you can specify it like : root_keydev=UUID=blalblablalblablalbalbal root_key=/path/to/file/on/that/device
ideally you remove the key device after boot. it's only needed to unlock fs at boot.
the other way you could do it is to place the key within the initramfs file. i know it's insecure, but let's just say we wanna know how to do it.
the way to do it is to use INITRAMFS_OVERLAY parameter in genkernel.conf to point to a directory that has the key in it. not only the key but a /mnt/key/key.file.
in my case, i have /boot/key/mnt/key/localhost.key and INITRAMFS_OVERLAY="/boot/key".
when the initramfs is loaded, the script looks for the file specified by kernel parameter "key_file" in either /mnt/key or on device specified by kernel parameter root_keydev.
and that's about all there is. unless you have multiple luks root devices or luks swap.
even if you have systemd or lvm or mdadm, the above still stands the same.
also, am pretty sure dracut has different kernel parameters to do the same thing. |
|
| Back to top |
|
|
324874
Apprentice
Joined: 26 Jul 2014
Posts: 168
|
| Posted: Thu Nov 10, 2016 11:27 am Post subject: |
|
|
Hi axl!
Thank you for your explanation. I read again the cryptsetup FAQ and I learned that the encryption of the root is not what I want.
| Quote: | | Note that you cannot do this for encrypted root, that requires an initrd. On the other hand, an initrd is about as vulnerable to a competent attacker as a non-encrypted root, so there really is no security advantage to doing it that way. An attacker that wants to compromise your system will just compromise the initrd or the kernel itself. The better way to deal with this is to make sure the root partition does not store any critical data and move that to additional encrypted partitions. If you really are concerned your root partition may be sabotaged by somebody with physical access (that would however strangely not, say, sabotage your BIOS, keyboard, etc.), protect it in some other way. The PC is just not set-up for a really secure boot-chain (whatever some people may claim). -- source: https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions |
I erased data on the storage media. I'm sorry for the trouble.  |
|
| Back to top |
|
|
irenicus09
Tux's lil' helper
Joined: 07 Jun 2013
Posts: 118
|
| Posted: Thu Nov 10, 2016 1:20 pm Post subject: |
|
|
Hmm from what I see luks with lvm isn't that hard. I've a gentoo setup with luks + encryption and boot partition on USB.
Wasn't that hard to setup in my opinion, I did it the first time I installed Gentoo, but you just need to figure out the correct settings for grub config, update fstab with sdb1 (removable drive) and when installing grub use --removable flag.
What I'm more interested in is to try the patch for grub, that allows you to remove the luks header from your drive and migrate it to the boot partition on your USB drive. That way you would have plausible deniability in case someone seizes your laptop, and there would be no trace of encryption of any sort on the hard disk.
But I don't want to mess up my current install and I don't have much time these days, so I plan on experimenting with that at a later stage. 
If anyone had success with that feel free to let me know  |
|
| Back to top |
|
|
finalturismo
Guru
Joined: 06 Jan 2020
Posts: 410
|
| Posted: Fri Jan 22, 2021 3:24 am Post subject: Re: I've found errors: LUKS master key vs LUKS slot keys |
|
|
| axl wrote: | | feng wrote: | | I find genkernel easier than dracut but I find that dracut is more suited for an advanced configuration. |
I really dont know how dracut is handling luks, but I could explain how genkernel does. It's all about boot parameters. genkernel has: root/crypto_root, root_key, root_keydev. these are the most relevant.
There are 2 basic ways to unlock a luks fs at boot.
First easy way is to unlock it with a password inputed from keyboard. In which case, you dont do anything. Dont need to worry about the key. They key is in your head.
The second way is to make initrd unlock the fs for you using a key. Now obviously you do not want the key in the same place as all the other stuff that is locked, because you couldn't read it then. so it has to be on some device that is unlocked. It shouldn't be an internal device because that way anyone could just copy the key. So obviously a usb stick or smth like that.
and you can specify it like : root_keydev=UUID=blalblablalblablalbalbal root_key=/path/to/file/on/that/device
ideally you remove the key device after boot. it's only needed to unlock fs at boot.
the other way you could do it is to place the key within the initramfs file. i know it's insecure, but let's just say we wanna know how to do it.
the way to do it is to use INITRAMFS_OVERLAY parameter in genkernel.conf to point to a directory that has the key in it. not only the key but a /mnt/key/key.file.
in my case, i have /boot/key/mnt/key/localhost.key and INITRAMFS_OVERLAY="/boot/key".
when the initramfs is loaded, the script looks for the file specified by kernel parameter "key_file" in either /mnt/key or on device specified by kernel parameter root_keydev.
and that's about all there is. unless you have multiple luks root devices or luks swap.
even if you have systemd or lvm or mdadm, the above still stands the same.
also, am pretty sure dracut has different kernel parameters to do the same thing. |
I tried the following but i get the following in initramfs prompt shell.
| Code: | Using key device /dev/sda2 (Not sure why its calling it a key device, i just want to use the keyfile that is in it)
Mounting of device /dev/sda2 failed. (boot partition)
Could not find the root key device in UUID="blahblahblah" |
|
|
| Back to top |
|
|
Atha
Apprentice
Joined: 22 Sep 2004
Posts: 229
|
| Posted: Sat Jul 17, 2021 2:12 pm Post subject: |
|
|
I just stumbled upon this thread.
What there is to say is that encryption is a very complicated thing. And, yes, a nice tutorial would certainly be very helpful.
GRUB2 just learned to open LUKS2 encrypted partitions. There has to be a way to use a) a keyfile from an USB pen drive, or b) a password, that will open an encrypted /boot directory in which GRUB will find a second grub.cfg file to load, along with all the linux kernels and initrds. This way there would be a grub.cfg on the ESP, in order to load an alternative operating system (Windows) and to decrypt the real_boot partition, and go along with a second stage grub.cfg from there. The keyfiles for / (root) and anything else would be stored encrypted on the /boot partition...
That's what I've been trying to get working for some time, but gave up. GRUB2 wouldn't let me decrypt /boot, and I was also unable to open two individual encrypted partitions holding a RAID0 (mirroring) btrfs as root (/), because GRUB2 with crypt_root= and root= would only allow for one such partition, leading to btrfs failing as well (the second partition is then missing)...
For now I'm using the Debian default LVM encrypted / with an unencrypted /boot partition. Not satisfactory, but at least it works.
_________________
Think for yourself and let others enjoy the privilege of doing so too. – Voltaire |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Other Things Gentoo
