18.04 cryptsetup запускает автоматическое монтирование root при загрузке с USB в качестве ключа
Я пытаюсь разблокировать / автоматически смонтировать рут на моем Ubuntu 18.04 LUKS Cryptsetup установка с USB-накопителя во время загрузки.
С приложенным сценарием или аналогичной версией он уже работал несколько недель назад (не могу вспомнить, так как на моем диске произошел аппаратный сбой, поэтому работа с резервной копией, возможно, имеет существенный недостаток, поскольку во время создания резервной копии работала),
Может быть, кто-то здесь может помочь мне исправить это, я попробовал так много вариантов сейчас и застрял.
В Интернете нет ни одной современной документации, надеюсь, что то, что я получил, достаточно близко...
#!/bin/bash
# https://www.oxygenimpaired.com/ubuntu-with-grub2-luks-encrypted-lvm-root-hidden-usb-keyfile # some lines taken from this link, its a bit dated tough.
#REPRODUCE START
# 1. install 18.04 with luks lvm default , set user to autologin
# 2. reboot after finished install, dont plugin any drives or main cryptoroot may end up on another part than sda3
# 3. after the new os is booted plugin the drive with this script so it ends up at sdb1
# 4. plugin the usb to be used as decrypt key so it ends up on sdc
# 5. run "sudo su" to enter root && run this script
#REPRODUCE END
# Ubuntu with Grub2 + LUKS encrypted LVM root + hidden USB keyfile
CRYPT_USB=sdc # change this for entire doc, cant use variables for the entire doc # usb drive to be used to decrypt the root
MAIN_PART=sda3 # default 18.04 cryptsetup root # change this for entire doc, cant use variables for the entire doc
UNLOCKUSB1=/lib/cryptsetup/scripts/unlkusb.sh # unlockfile
READADDKEY () { # previously filled with dev random
dd if=/dev/$CRYPT_USB of=/root/luks-secret.key bs=512 skip=4 count=8
cryptsetup luksAddKey /dev/$MAIN_PART /root/luks-secret.key --key-slot 1
shred --remove --zero /root/luks-secret.key
} # CREATE KEY END
CREATERULESFILE () {
GREP_SERIAL_CRYPT_USB=$(udevadm info -a -p `udevadm info -q path -n /dev/sdc` | grep ATTRS{serial} | head -n 1 | sed -e "s/ //g" )
#echo 'SUBSYSTEMS=="usb", ATTRS{serial}=="000A000A000x", KERNEL=="sd*", SYMLINK+="usbkey%n"' | sed -e 's/ATTRS{serial}=="//g' | sed -e 's/x"//g' | sed -e "s/000A000A000/$GREP_SERIAL_CRYPT_USB/g" > /etc/udev/rules.d/99-unlock-luks.rules
#echo 'SUBSYSTEMS=="usb", ATTRS{serial}=="000A000A000x", DRIVERS=="usb", SYMLINK+="usbkey%n"' | sed -e 's/ATTRS{serial}=="//g' | sed -e 's/x"//g' | sed -e "s/000A000A000/$GREP_SERIAL_CRYPT_USB/g" > /etc/udev/rules.d/99-unlock-luks.rules
echo 'SUBSYSTEMS=="usb", ATTRS{serial}=="000A000A000x", KERNEL=="sd*", DRIVERS=="usb", SYMLINK+="usbkey%n"' | sed -e 's/ATTRS{serial}=="//g' | sed -e 's/x"//g' | sed -e "s/000A000A000/$GREP_SERIAL_CRYPT_USB/g" > /etc/udev/rules.d/99-unlock-luks.rules
udevadm control --reload-rules # 4) Reload udev rules with:
# 5 ) Test that /dev/usbkey is created when the usb stick is inserted.
} # CREATE UDEV RULE END
CREATEUNLOCKFILE () {
touch $UNLOCKUSB1
cat << 'EOF' > $UNLOCKUSB1
#!/bin/sh
TRUE=0
FALSE=1
OPENED=$FALSE # flag tracking key-file availability
cat /proc/modules | busybox grep usb_storage >/dev/null 2>&1 # check and modprobe the USB driver if not already loaded
USBLOAD=0$?
if [ $USBLOAD -gt 0 ]; then
modprobe usb_storage >/dev/null 2>&1
fi
sleep 20 # give the system time to settle and open the USB device
if [ -b /dev/usbkey ]; then # check for the specifc /dev/usbkey device created by udev using /etc/udev/rules.d/99-unlock-luks.rules
dd if=/dev/usbkey bs=512 skip=4 count=8 | cat # if device exists then output the keyfile from the usb key (hidden key is 4096 bytes long starting at 2048 bytes)
OPENED=$TRUE
fi
# something isnt working here, if usb fails there is no pass prompt
if [ $OPENED -ne $TRUE ]; then
echo 'FAILED to get USB key file ...'
#if [ -x /bin/plymouth ] && plymouth --ping; then
#plymouth ask-for-password --prompt "Enter passphrase"
#else
/lib/cryptsetup/askpass "Enter passphrase"
#fi
else
echo "Success loading key file. Moving on."
fi
sleep 1
exit 0
EOF
chmod a+x $UNLOCKUSB1
}
CREATECRYPTTAVFILE () {
echo "sda3_crypt /dev/disk/by-uuid/$(blkid -o value -s UUID /dev/$MAIN_PART) none luks,keyscript=$UNLOCKUSB1" > /etc/crypttab
}
CREATECRYPTOROOTFILE () {
echo "CRYPTROOT=target=sda3_crypt,source=/dev/disk/by-uuid/$(blkid -o value -s UUID /dev/$MAIN_PART)" > /etc/initramfs-tools/conf.d/cryptroot
}
ADDINITRAMFS_MODULES () {
if [ $(cat /etc/initramfs-tools/modules | grep -c "usb_storage") -eq 0 ]; then
echo "usb_storage" >> /etc/initramfs-tools/modules
fi
if [ $(cat /etc/initramfs-tools/modules | grep -c "sha256") -eq 0 ]; then
echo "sha256" >> /etc/initramfs-tools/modules
fi
if [ $(cat /etc/initramfs-tools/modules | grep -c "aes-x86_64") -eq 0 ]; then
echo "aes-x86_64" >> /etc/initramfs-tools/modules
fi
if [ $(cat /etc/initramfs-tools/modules | grep -c "aes_generic") -eq 0 ]; then
echo "aes_generic" >> /etc/initramfs-tools/modules
fi
if [ $(cat /etc/initramfs-tools/modules | grep -c "crypto_api") -eq 0 ]; then
echo "crypto_api" >> /etc/initramfs-tools/modules
fi
if [ $(cat /etc/initramfs-tools/modules | grep -c "dm-crypt") -eq 0 ]; then
echo "dm-crypt" >> /etc/initramfs-tools/modules
fi
if [ $(cat /etc/initramfs-tools/modules | grep -c "scsi_dh") -eq 0 ]; then
echo "scsi_dh" >> /etc/initramfs-tools/modules
fi
if [ $(cat /etc/initramfs-tools/modules | grep -c "usbcore") -eq 0 ]; then
echo "usbcore" >> /etc/initramfs-tools/modules
fi
if [ $(cat /etc/initramfs-tools/modules | grep -c "usbhid") -eq 0 ]; then
echo "usbhid" >> /etc/initramfs-tools/modules
fi
}
CRATEUDEVUSBKEYHOOK () {
touch /etc/initramfs-tools/hooks/udevusbkey
cat << 'EOF' > /etc/initramfs-tools/hooks/udevusbkey
#!/bin/sh
# udev-usbkey script
PREREQ="udev"
prereqs()
{
echo "$PREREQ"
}
case $1 in
prereqs)
prereqs
exit 0
;;
esac
. /usr/share/initramfs-tools/hook-functions
cp /etc/udev/rules.d/99-unlock-luks.rules ${DESTDIR}/lib/udev/rules.d/ # Copy across relevant rules
exit 0
EOF
chmod a+x /etc/initramfs-tools/hooks/udevusbkey
}
SETUPGRUB () {
#sed -ie "s#quiet splash#cryptopts=target=sda3_crypt,source=/dev/disk/by-uuid/$(blkid -o value -s UUID /dev/$MAIN_PART),lvm=xubuntu-vg,keyscript=$UNLOCKUSB1#g" /etc/default/grub
#sed -ie "s#quiet splash#cryptopts=target=sda3_crypt,source=/dev/disk/by-uuid/$(blkid -o value -s UUID /dev/$MAIN_PART),lvm=/dev/mapper/xubuntu--vg-root,keyscript=$UNLOCKUSB1#g" /etc/default/grub
sed -ie "s#quiet splash#cryptopts=target=sda3_crypt,source=/dev/disk/by-uuid/$(blkid -o value -s UUID /dev/$MAIN_PART),lvm=xubuntu--vg-root,keyscript=$UNLOCKUSB1#g" /etc/default/grub
#sed -ie "s#quiet splash#ipv6.disable=1 cryptopts=target=sda3_crypt,source=/dev/disk/by-uuid/$(blkid -o value -s UUID /dev/$MAIN_PART),lvm=vg-your-root,keyscript=/lib/cryptsetup/scripts#g" /etc/default/grub
update-grub
}
UPDATEINIRAMFS () {
update-initramfs -u -k all
}
CHECKFILES() {
ls -la $UNLOCKUSB1
ls -la /etc/initramfs-tools/hooks/udevusbkey
ls -la /etc/udev/rules.d/99-unlock-luks.rules
ls -la /dev/usbkey && echo "if this fails, the usb maybe has to be replugged"
ls -la /etc/initramfs-tools/conf.d/cryptroot
cat /etc/crypttab
cat /etc/default/grub | grep GRUB_CMDLINE_LINUX_DEFAULT=
cat /etc/initramfs-tools/modules
cryptsetup luksDump /dev/sda3
}
READADDKEY
CREATERULESFILE
CREATEUNLOCKFILE
CREATECRYPTTAVFILE
CREATECRYPTOROOTFILE
ADDINITRAMFS_MODULES
CRATEUDEVUSBKEYHOOK
SETUPGRUB
UPDATEINIRAMFS
CHECKFILES