Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
systemd + cryptsetup (Solved) (2 solutions given)
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Portage & Programming
View previous topic :: View next topic  
Author Message
nlsa8z6zoz7lyih3ap
Apprentice
Apprentice


Joined: 25 Sep 2007
Posts: 287
Location: Canada

PostPosted: Sat Oct 12, 2013 1:43 am    Post subject: systemd + cryptsetup (Solved) (2 solutions given) Reply with quote

I have an encrypted root and several other encrypted partions encrypted with cryptsetup.
This has worked flawlessly for years using openrc but I can not make it work with systemd.
Does anyone know how it can be done using systemd?


The way it worked with openrc

I use the following initramfs
which mounts / (usr is on the same root partition.)


Code:
#!/bin/busybox sh

# Mount the /proc and /sys filesystems.
mount -t proc none /proc
mount -t sysfs none /sys
mount -t devtmpfs none /dev

# Do your stuff here.
cryptsetup -T 5 luksOpen /dev/sda7 root


# Mount the root filesystem.
mount -t ext4 -o ro /dev/mapper/root  /mnt/root

# Clean up.
umount /proc
umount /sys

# Boot the real thing.
exec switch_root /mnt/root  /sbin|grep init



To cryptsetup the other partitions I have inserted the followinfg into /etc/init.d/fsck
Code:
start()
{
       modprobe loop

          cryptsetup --key-file=/root/.gnupg/sda9crypt  create sda9 /dev/sda9
         echo Iaxag1 |cryptsetup   luksOpen  /dev/sda8  sda8
             cryptsetup --key-file=/root/.gnupg/sdbcrypt  create sdb /dev/sdb
             cryptsetup --key-file=/root/.gnupg/sdccrypt  create sdc /dev/sdc


/etc/fstab contained lines such as
Code:
/dev/mapper/sda9             /sda9           ext4    etc etc


The above works flawlessly with openrc



The way I tried to do it with systemd

I replaced the initramfs with

Code:
/bin/busybox sh

# Mount the /proc and /sys filesystems.
mount -t proc none /proc
mount -t sysfs none /sys
mount -t devtmpfs none /dev

# Do your stuff here.
cryptsetup -T 5 luksOpen /dev/sda7 root


# Mount the root filesystem.
mount -t ext4 -o ro /dev/mapper/root  /mnt/root

# Clean up.
umount /proc
umount /sys

# Boot the real thing.
exec switch_root /mnt/root  /usr/bin/systemd


Since systemd doesn't read /etc/init.d/fsck I edited /etc/cryptab to contain entries such as the following:
Code:
target=sda9
source='/dev/sda9'
key='/root/.gnupg/sda9crypt'


This does not work. When trying to boot with systemd I get

Quote:
a start job is running for dev-mapper-sda9.device[

And the boot process hangs.

Can anyone advise me as to whether or not it should be possible to boot my system using systemd?


Last edited by nlsa8z6zoz7lyih3ap on Thu Oct 17, 2013 3:21 pm; edited 3 times in total
Back to top
View user's profile Send private message
croutch
n00b
n00b


Joined: 04 Aug 2012
Posts: 31
Location: göteborg

PostPosted: Sat Oct 12, 2013 7:14 am    Post subject: Reply with quote

Hello.

from the end of http://wiki.gentoo.org/wiki/Systemd#Services

sys-fs/cryptsetup
Systemd doesn't seem to respect /etc/conf.d/dmcrypt (bug #429966 ?):
File/etc/crypttabConfiguration file for encrypted block devices.
crypt-home UUID=c25dd0f3-ecdd-420e-99a8-0ff2eaf3f391 -

from same link
Booting with systemd

have init=/usr/lib/systemd/systemd in grub or initramfs.

You have ( i dont know if this is the same)
# Boot the real thing.
exec switch_root /mnt/root /usr/bin/systemd

Look here to
http://www.freedesktop.org/software/systemd/man/systemd-cryptsetup-generator.html
http://www.freedesktop.org/software/systemd/man/systemd-cryptsetup@.service.html

here are maby more to
http://unix.stackexchange.com/questions/64693/how-do-i-configure-systemd-to-activate-an-encrypted-swap-file

croutch
Back to top
View user's profile Send private message
nlsa8z6zoz7lyih3ap
Apprentice
Apprentice


Joined: 25 Sep 2007
Posts: 287
Location: Canada

PostPosted: Sat Oct 12, 2013 11:45 pm    Post subject: Reply with quote

Progress Report

I can now boot using systemd into a system that has all of the encrypted partitions except for / remove from /etc/fstab.
Using croutch's comment
Quote:
have init=/usr/lib/systemd/systemd in grub or initramfs


I have replaced my initramfs with
Code:
#!/bin/busybox sh

# Mount the /proc and /sys filesystems.
mount -t proc none /proc
mount -t sysfs none /sys
mount -t devtmpfs none /dev

# Do your stuff here.
cryptsetup -T 5 luksOpen /dev/sda7 root


# Mount the root filesystem.
mount -t ext4 -o ro /dev/mapper/root  /mnt/root

# Clean up.
umount /proc
umount /sys
init=/usr/lib/systemd/systemd
export initand mount these partitions by hand.
# Boot the real thing.
exec switch_root /mnt/root  $init


This boots me into the text console bash. I then cryptsetup and mount the other encyrpted partitions by hand.
My ethernet device (which has been persistently renamed to eeth0) does not come up, so I bring the internet up with
Code:
ifconfig eeth0 up
dhcpcd eeth0


I then start kdm manually.

So at this moment I am able to boot using systemd + a fair amount of manual work of my own. I am a far cry from have everything automated but intend to play around with it a bit more.

Ideas or comments from anyone would still be welcomed.
Back to top
View user's profile Send private message
croutch
n00b
n00b


Joined: 04 Aug 2012
Posts: 31
Location: göteborg

PostPosted: Sun Oct 13, 2013 3:30 am    Post subject: Reply with quote

look here for network info.
http://www.freedesktop.org/wiki/Software/systemd/PredictableNetworkInterfaceNames/
predictablenetworkinterfaceNames= enp3s0,enp2s0

if you use dhcpcd,enable network like this.
systemctl enable dhcpcd.service

Note: If it doesn't work, use: # systemctl enable dhcpcd@interface_name.service

for kdm
systemctl enable kdm.service
systemctl start kdm.service

reboot and test.

maby give you som hints.
https://bbs.archlinux.org/viewtopic.php?id=171006

croutch
Back to top
View user's profile Send private message
nlsa8z6zoz7lyih3ap
Apprentice
Apprentice


Joined: 25 Sep 2007
Posts: 287
Location: Canada

PostPosted: Mon Oct 14, 2013 12:40 am    Post subject: Reply with quote

Progress Report
By following the man page for crypttab I can get systemd to setup luks encrypted partions..
Specifically, by placing
Code:
sda8 /dev/sda8
as a line in /etc/crypttab, systemd prompts me for a password during boot and all works just fine.
However man crypttab also gives instructions for giving a path to a file that contains the password and then not having to enter the password in the terminal during boot.

I can not make this work.

More importantly, two of my encrypted block devices are not in luks format. For example when using openrc
I put the following line in the appropriate place in /etc/init.d/fsck
Code:
cryptsetup --key-file=/root/.gnupg/sda9crypt  create sda9 /dev/sda9

This worked just fine in openrc

However I have not been able to make it work using /etc/crypttab and systemd . In one of my attempts I added
Code:
 sda9 /dev/sda9                                       none                                plain,key-file=/root/.gnupg/sda9crypt


to /etc/crypttab.

and in another I added
Code:
 sda9 /dev/sda9                                                                      plain,key-file=/root/.gnupg/sda9crypt


In all of my attempts, I was prompted for a password during boot, which is ridiculous as there is none. Even when I typed in the path to the key rather than the non-existent password,
systemd failed to set this up for me.

Does anyone know if this is a bug or a failure on my part?

Comment thanks to croutch for all of the good suggestions regarding this and sytemd in general. Except for the encrypted partition problem, everything work very well and with great speed. I was happy with every aspect of systemd except for the encryption problem. However that failure is a deal breaker for me.

Unless someone has a solution, I will be removing systemd from my system and reverting to openrc in a few days.
I should point out that I really like openrc, but was also curious to give systemd a try.
Back to top
View user's profile Send private message
croutch
n00b
n00b


Joined: 04 Aug 2012
Posts: 31
Location: göteborg

PostPosted: Mon Oct 14, 2013 4:31 am    Post subject: Reply with quote

I dont give up yet :).

I dont know anything about encryption,raid,lvm.
What i understand of systemd so should it pick up all that automatic.

I recommend you to check arch linux wiki because they are a little ahead when it come to systemd.

https://wiki.archlinux.org/index.php/dm-crypt_with_LUKS
https://wiki.archlinux.org/index.php/dm-crypt_with_LUKS#Using_GPG_or_OpenSSL_Encrypted_Keyfiles

Could genkernel or drakut be better to create an initramfs?

croutch
Back to top
View user's profile Send private message
nlsa8z6zoz7lyih3ap
Apprentice
Apprentice


Joined: 25 Sep 2007
Posts: 287
Location: Canada

PostPosted: Tue Oct 15, 2013 6:53 pm    Post subject: Reply with quote

Most of this post has been deleted to be replaced with one below.

Last edited by nlsa8z6zoz7lyih3ap on Tue Oct 15, 2013 10:15 pm; edited 1 time in total
Back to top
View user's profile Send private message
croutch
n00b
n00b


Joined: 04 Aug 2012
Posts: 31
Location: göteborg

PostPosted: Tue Oct 15, 2013 8:49 pm    Post subject: Reply with quote

Well, i have no clue why everything working on your system now.

But that is very nice you got it working :).
Back to top
View user's profile Send private message
nlsa8z6zoz7lyih3ap
Apprentice
Apprentice


Joined: 25 Sep 2007
Posts: 287
Location: Canada

PostPosted: Wed Oct 16, 2013 1:21 am    Post subject: Reply with quote

Apparently I was using an initramfs that did the cryptsetup for me.

My searches on the internet have led me to believe that systemd's encryption setup does not support all of the of the encryption types that cryptsetup does, and in
particular does not support some of mine (plain) or luks with a keyfile rather than a password.. (added in edit Oct 17) I now know that it does support luks with a keyfile-see my next post

The following example is from man crypttab
Quote:
luks-2505567a-9e27-4efe-a4d5-15ad146c258b UUID=2505567a-9e27-4efe-a4d5-15ad146c258b - timeout=0
swap /dev/sda7 /dev/urandom swap

And this does not cover some of my encyrption types. I believe that this is why systemd hangs when trying to mount my encrypted partitions.

So here is what I now do to succeed (In fact nothing else that I have tried works.)
    Mark all of the encrypted partitions as nonauto in the options section of /etc/fstab, so that systemd leaves them alone.
    write a bash script (I called it /root/sys.sh) that does cryptsetup, fsck and then mounts the encrypted partitions.
    At then end of the script add systemctl start kdm


It is possible to do the cryptsetup and mounting in the initramfs, but alas busybox does not support fsck.ext4, so this means that fsck would not be done on these partitions

Perhaps it is possible to have systemd run my sysd.sh script for me to automate everything for me, but I haven't delved enough into systemd yet to be able to do this.

The booting is really not noticeably fast given all of my customizations, but the shutdown is blinding fast.

I would like to thank croutch again for his responses and his blog http://croutchie.blogspot.se/ .


Last edited by nlsa8z6zoz7lyih3ap on Thu Oct 17, 2013 3:20 pm; edited 1 time in total
Back to top
View user's profile Send private message
init_6
Apprentice
Apprentice


Joined: 22 Jun 2008
Posts: 162

PostPosted: Wed Oct 16, 2013 7:52 am    Post subject: Reply with quote

Read wiki and try my initramfs
Back to top
View user's profile Send private message
nlsa8z6zoz7lyih3ap
Apprentice
Apprentice


Joined: 25 Sep 2007
Posts: 287
Location: Canada

PostPosted: Thu Oct 17, 2013 3:19 pm    Post subject: Reply with quote

Here are 2 full solutions to this topic.

(1) The one outline above by init_6.
Thank you init_6 for explaining how to do all of this in the initramfs. This solution has the advantage of not requiring changes to the partitions and encryption, which the 2nd solution does

(2) Redoing the partitions and encryptions to be compatible with systemd's crypttab.
I have identified what I believe are the 2 reasons that systemd did not mount my encrypted devices as they were set up before many years ago.
(i) one of my encrypted devices was /dev/sdb (an entire drive rather than a partition) I noticed that the command blkid does not even list /dev/sdb, tho' it does pick up partitions.
(ii) the encryption for /dev/sda9 was done previously with the command cryptsetup --key-file=/root/.gnupg/sdbcrypt create sda9 /dev/sda9
Despite many attempts and hints in the man crypttab page that this should be possible, I have been unable to make (ii) work under systemd and /etc/crypttab.
Therefore I tried the following, and found that it works:
(A) Change the type of encrypted partitions to luks (see man cryptsetup for details) To avoid having to enter a password at boot, I did this with the following command
Code:
cryptsetup luksFormat  /dev/sda9 /root/.gnupg/sda9crypt

for my /dev/sda9, add the following line to /etc/crypttab
Code:
sda9 /dev/sda9  /root/.gnupg/sda9crypt     luks

Of course I had to previously create the key /root/.gnupg/sda9crypt as per standard cryptsetup instructions. (There are many wikis on this)

(B) Partition any unpartitioned encrypted drives. For example /dev/sdb is partitioned to contain the single partition /dev/sdb1, and this is then encrypted as in (A).

Perhaps there are other solutions using /etc/crypttab, but this is the only thing that worked for me.

Of course, /etc/fstab willl need to be modified.

WARNING: Data must be backed up on drives and partitions that are being changed as above, and then restored after the changes have been made.
In may case with two 2 terabyte drives and a 500 gb drive, this took considerable time to do.



Thanks to everyone for their help. I am now marking this as "solved"
Added in edit Don't forget to set the cryptosetup use flag
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Portage & Programming All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum