Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[SOLVED] LUKS, crypt. root, dracut: wrong authentication.
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Other Things Gentoo
View previous topic :: View next topic  
Author Message
324874
Apprentice
Apprentice


Joined: 26 Jul 2014
Posts: 168

PostPosted: Wed Nov 09, 2016 7:14 pm    Post subject: [SOLVED] LUKS, crypt. root, dracut: wrong authentication. Reply with quote

Hi!

Quick request:
Can anyone provide a tutorial explaining how to load a UEFI image that decrypts (LUKS) the root filesystem?

Introduction:
I tried to install Gentoo once again (note). I learn programming and I wish to build secure softwares so I installed an hardened system.

Context: (boot, root file system encrypted, UEFI without bootloader)

I encrypted the root filesystem using LUKS and I built an initramfs with dracut. I read wiki articles (cf. ref) and the dracut manual.
The dracut manual says using the shell (rd.shell) to decrypt needed partitions or make the glue (write a script).
I don't know how to write the script so I added the rd.shell in the dracut configuration file: /etc/dracut.conf.
Finally, I created the initramfs and I embeded this one in the kernel.

Issue: (password prompt instead of key file)

I encrypted the partitions (LUKS) using a key file. However, I have to enter a password to unlock the root file system (boot).
I tried to add a password to access the encrypted storage and I used this password but the password didn't work (luksAddKey).

I don't understand well the dracut parameters or the needed kernel parameters:

I added dm, crypt, base, rootfs, usrmount, bash, kernel-modules, udev-rules, etc. (conf. file), --hostonly --no-compress initramfs (cmd line).
I hadn't try add_device+="..." and /etc/crypttab -- I added rd.shell and I used /etc/conf.d/dmcrypt (although I don't know how to use it).

ref:

Location of the thread:
I posted this message in this forum because I have succeeded several times the Gentoo installation and because I have another unrelated question.
A part of the system is in the testing branch (musl: experimental). Is is better to switch the system to the testing branch (~amd64)?

Note: I installed Gentoo different ways (meta-distribution). I didn't know what I wanted first times or how to get what I wanted.

Best regards, feng.


Last edited by 324874 on Thu Nov 10, 2016 11:32 am; edited 1 time in total
Back to top
View user's profile Send private message
Roman_Gruber
Advocate
Advocate


Joined: 03 Oct 2006
Posts: 3806
Location: Austro Bavaria

PostPosted: Wed Nov 09, 2016 10:59 pm    Post subject: Reply with quote

Quote:
Quick request:
Can anyone provide a tutorial explaining how to load a UEFI image that decrypts (LUKS) the root filesystem?



I usually do this.

Install a binary distro. Reuse the bootloader, ditch the rest. so i have a working grub2. (Faster, less errors. Installing from a working binary distro is the fastest way)

setup partitons as the gentoo handbook wants it.

make root partion as => big lvm container => big luks container inside => big ext4 inside (aka root) (I will not discuss why, too complicated ... too many opinions! I have my reasons and my backup strategy relies on this structure)

The boot partition contains the grub2 bootloader e.g. from linux mint, the grub.cfg is manually edited with nano so I can add / change the gentoo boot entries. The kernel line contains needed needed bootparameters for luks / lvm. the initramfs line contains the genkernel initramfs + microcode initramfs from intel.

I use openrc / eudev + minimalistic desctop. NO SYSTEMD

--

When you use gnu linux for quite a while and have a basic knowledge you will succeed with the above information.

For in detail guids you can reuse any ARCH / gentoo instruction. Careful as these days systemd disease makes things more complicated or worse.

Feel free to ask when something is not clear. I recommend that you read guides and when you understand what is done than you should start with that.

My way of installation was created from several guides, includes gentoo handbook, arch + gentoo generic guides in the past + expierence as long term gentoo user + generic info on how a box boots and such (has not changed basically since kernel 2.0.0). I designed it for privacy, easy way of backup my data. I doubt many have a working way of fully backup their hole gentoo installtion

--

Hardened makes things complicated. If it's useful or not? no idea. depends if you use binary gpu drivers or not!

no bootloader => well when you want ot go the difficult route

a key file? are you serious a key file? => complicated => hell no! (again many guys have different opinions)

Quote:
dracut is an event driven initramfs infrastructure. dracut (the tool) is used to create an initramfs image by copying tools and files from an installed system and combining it with the dracut framework, usually found in /usr/lib/dracut/modules.d.


well when you want to do everything from scratch go ahead

genkernel works for myself for years. I only create it once and reuse it.

genkernel uses busybox afaik. works, easy to understand. I had to fix a coding error in the initramfs created by the "evil" automated scripts. now it works. I do not see the point on redoing the work which others have done. I reuse what is available to speed up.

Quote:
I don't know how to write the script


+ no idea about dracut

reuse / use genkernel initramfs and thats it. when it does not work. unpack it, read the script and adapt it and repack. (I did that because of an error in genkernel / design flaw)


--

Hint: keep a live media on your shelf when you run encryption and keep necessary notes on your shelf too with that media on how to mount root for example !
Back to top
View user's profile Send private message
324874
Apprentice
Apprentice


Joined: 26 Jul 2014
Posts: 168

PostPosted: Thu Nov 10, 2016 7:40 am    Post subject: I've found errors: LUKS master key vs LUKS slot keys Reply with quote

Hi, Roman_Gruber! I thank you for the answer. I used a key file because the entropy is higher (random data). [1]
I don't use LVM with LUKS: "Be aware that if you add LVM into the mix, things can get very complicated." [2]

I found some errors/misunderstandings after I remembered the cryptsetup FAQ. I used the LUKS master key instead of the LUKS slot keys, in the dracut configuration file. [3]

Moreover, I remembered the shell (rd.shell) is launched when something goes wrong. However, I believe the process happened well.

I'm going to modify the configuration file to see if it works and I'm going to read again the cryptsetup FAQ because the presentation is clear.

Notes:
The first time, my purpose was to use plain dm-crypt. However, I haven't understood how to use it although I read the Arch Linux wiki articles about plain dm-crypt.
This method isn't promoted except for "security experts" (according to the maintainer(s) of the cryptsetup FAQ).

I find genkernel easier than dracut but I find that dracut is more suited for an advanced configuration.

[1] Source: https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions (section 5.9 Is LUKS secure with a low-entropy (bad) passphrase?)
[2] Source: idem. (section 2.2 LUKS on partitions or raw disks?)
[3] I sometimes "unmerge" dracut but the configuration file was protected so I kept the wrong configuration. I added luks.key... ="<LUKS master key>" instead of a LUKS slot key.

Best regards, feng.
Back to top
View user's profile Send private message
axl
Guru
Guru


Joined: 11 Oct 2002
Posts: 386
Location: Romania

PostPosted: Thu Nov 10, 2016 10:04 am    Post subject: Re: LUKS, encrypted root, dracut: wrong authentication metho Reply with quote

feng wrote:
Issue: (password prompt instead of key file)

I encrypted the partitions (LUKS) using a key file. However, I have to enter a password to unlock the root file system (boot).
I tried to add a password to access the encrypted storage and I used this password but the password didn't work (luksAddKey).


each luks fs can have up to 8 keys. keys could be either files or passwords. in fact, i dont think cryptsetup sees a difference. but admins do.

if you used a key file to lock a fs, you will reference it with -d. such as:

cryptsetup open /dev/sda sda-unlocked -d /path/to/key.file

if you use -d, cryptsetup will NOT ask you for a password but use /path/to/key.file as the password.

second thing you gonna know is that luksAddKey SHOULD work. same thing.

cryptsetup luksAddKey /path/to/luks_fs -d /path/to/key.file /path/to/another.key.

or

cryptsetup luksAddKey /path/to/luks_fs -d /path/to/key.file

and in this case, cryptsetup will know to unlock fs with /path/to/key.file and ask for a password from keyboard as new key.
Back to top
View user's profile Send private message
axl
Guru
Guru


Joined: 11 Oct 2002
Posts: 386
Location: Romania

PostPosted: Thu Nov 10, 2016 10:28 am    Post subject: Re: I've found errors: LUKS master key vs LUKS slot keys Reply with quote

feng wrote:
I find genkernel easier than dracut but I find that dracut is more suited for an advanced configuration.


I really dont know how dracut is handling luks, but I could explain how genkernel does. It's all about boot parameters. genkernel has: root/crypto_root, root_key, root_keydev. these are the most relevant.

There are 2 basic ways to unlock a luks fs at boot.

First easy way is to unlock it with a password inputed from keyboard. In which case, you dont do anything. Dont need to worry about the key. They key is in your head.

The second way is to make initrd unlock the fs for you using a key. Now obviously you do not want the key in the same place as all the other stuff that is locked, because you couldn't read it then. so it has to be on some device that is unlocked. It shouldn't be an internal device because that way anyone could just copy the key. So obviously a usb stick or smth like that.

and you can specify it like : root_keydev=UUID=blalblablalblablalbalbal root_key=/path/to/file/on/that/device

ideally you remove the key device after boot. it's only needed to unlock fs at boot.

the other way you could do it is to place the key within the initramfs file. i know it's insecure, but let's just say we wanna know how to do it.

the way to do it is to use INITRAMFS_OVERLAY parameter in genkernel.conf to point to a directory that has the key in it. not only the key but a /mnt/key/key.file.

in my case, i have /boot/key/mnt/key/localhost.key and INITRAMFS_OVERLAY="/boot/key".

when the initramfs is loaded, the script looks for the file specified by kernel parameter "key_file" in either /mnt/key or on device specified by kernel parameter root_keydev.

and that's about all there is. unless you have multiple luks root devices or luks swap.

even if you have systemd or lvm or mdadm, the above still stands the same.


also, am pretty sure dracut has different kernel parameters to do the same thing.
Back to top
View user's profile Send private message
324874
Apprentice
Apprentice


Joined: 26 Jul 2014
Posts: 168

PostPosted: Thu Nov 10, 2016 11:27 am    Post subject: Reply with quote

Hi axl!

Thank you for your explanation. I read again the cryptsetup FAQ and I learned that the encryption of the root is not what I want.

Quote:
Note that you cannot do this for encrypted root, that requires an initrd. On the other hand, an initrd is about as vulnerable to a competent attacker as a non-encrypted root, so there really is no security advantage to doing it that way. An attacker that wants to compromise your system will just compromise the initrd or the kernel itself. The better way to deal with this is to make sure the root partition does not store any critical data and move that to additional encrypted partitions. If you really are concerned your root partition may be sabotaged by somebody with physical access (that would however strangely not, say, sabotage your BIOS, keyboard, etc.), protect it in some other way. The PC is just not set-up for a really secure boot-chain (whatever some people may claim). -- source: https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions


I erased data on the storage media. I'm sorry for the trouble. :oops:
Back to top
View user's profile Send private message
irenicus09
Tux's lil' helper
Tux's lil' helper


Joined: 07 Jun 2013
Posts: 118

PostPosted: Thu Nov 10, 2016 1:20 pm    Post subject: Reply with quote

Hmm from what I see luks with lvm isn't that hard. I've a gentoo setup with luks + encryption and boot partition on USB.

Wasn't that hard to setup in my opinion, I did it the first time I installed Gentoo, but you just need to figure out the correct settings for grub config, update fstab with sdb1 (removable drive) and when installing grub use --removable flag.

What I'm more interested in is to try the patch for grub, that allows you to remove the luks header from your drive and migrate it to the boot partition on your USB drive. That way you would have plausible deniability in case someone seizes your laptop, and there would be no trace of encryption of any sort on the hard disk.

But I don't want to mess up my current install and I don't have much time these days, so I plan on experimenting with that at a later stage. :P

If anyone had success with that feel free to let me know :)
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Other Things Gentoo All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum