Dracut for GPG-LUKS/ZFS/SSHD

Orionos · n00b Joined: 27 Apr 2014 Posts: 29

I'm trying to build an initramfs for a headless server using a GPG encrypted LUKS keyfile to unlock a ZFS root system.

Using Genkernel (in combination with GnuPG Legacy) I can make a functional initramfs. But as a headless server I'd need to use a SSH connection to unlock it, which Genkernel doesn't do.

Dracut can do everything, including SSH, but I can't figure out how to make the ZFSonLinux module for Dracut. I can do a git clone of the whole ZFSonLinux repository, but how can I make the Dracut module?

The second problem is the fact that I can't seem to unlock the GPG keyfile remotely, but I'd already be happy with the first. So I'd need Genkernel SSH or Dracut ZFS. Better-Initramfs doesn't seem to have the modules.

Can anybody assist?

Orionos · n00b Joined: 27 Apr 2014 Posts: 29

Well, now I just feel silly. When I could find no instructions for the ZFS dracut module in its manual, I assumed I needed to build a custom module. But it's already in there by default. And after some messing with the bootfs property, it boots.

Which leaves me with figuring out how to remotely unlock that GPG keyfile. When mounting, it uses a pipeline to unlock the keyfile with GPG and pipe it through to cryptsetup. That doesn't work over SSH though, I get a broken pipe.

The challenges a Windows administrator faces with Linux...