Auto-mount additional LUKS volumes on boot (CentOS)

[forkbomb]

My google-fu is not strong. Can't find answers on this one. Maybe I'm googling the wrong stuff.

Okay, so I just redid the server. Installed it something like this:
/dev/sda1, /boot, ext2 (unencrypted)
/dev/sda2, /, ext3 on luks
(Planning on a swapfile if needed.)

Installed via the normal install procedure for CentOS (used the 5.3 version of x86_64).

My external hard drives - to which I run backups and such - are also encrypted with LUKS, but I did this manually. So, they're not mounted on boot. As it stands right now, I'm asked to provide a passphrase to unlock the cryptosystem on /dev/sda2. That works fine.

1) I'd also like to get the other to mount, preferably, on boot. Any way to change what LUKS volumes are opened on boot?

OR

2) Any way to ensure that my externals will always be assigned the same device nodes? That way I could just write a script to be called by rc.local that opens the luks volumes (waiting for a password when run), mounts the filesystems, etc. In the way of additional explanation, one is Firewire and one is USB.

It wouldn't be a huge deal to remote in and do this manually (especially given how seldom I reboot the box), but
1) I'm sharing an NFS export off of one of the externals
2) I'd like to run totally automated backups to the other one.

[forkbomb]

Well, after a few reboots, the Firewire appears to be mounting as /dev/sdb consistently and the USB as /dev/sdc.

Maybe I should just put some cryptsetup and mount commands in rc.local and cross my fingers.

[mrHappyPants]

i've never used LUKS, but could you not just add the drives to your /etc/fstab?

[forkbomb]

i've never used LUKS, but could you not just add the drives to your /etc/fstab?

Yes, but before any filesystems "inside" the luks containers can be mounted, the cryptosystem itself has to be opened with the cryptsetup command.

For example:

cryptsetup luksOpen /dev/sdb1 luks-volume
mount /dev/mapper/luks-volume /some/mount/point

(When creating the filesystem you have to open the luks volume and then format /dev/mapper/luks-volume.)

Adding them to the fstab isn't enough to tell the OS to open the luks containers first. If you make your /etc/fstab entry point to /dev/mapper/lusk-volume, it'll be trying to mount a filesystem on a non-existent device node.

If you make your fstab entry point to /dev/sdb1, the luks volume won't be open and the OS will just see a partition with a bad/missing superblock.

There must be something somewhere (my guess is the initrd) that declares that the luks volume for / needs to be opened before the filesystem can be mounted.

[mrHappyPants]

okay I'm with you now.

There HAS to be something somewhere to do it for the root, yes, but I wish you the best of luck seeing as I have no idea...

[forkbomb]

OK. Sorry. Guess my explanation was insufficient.

The OS can't even read what luks containers need to be opened from /etc, because / itself is encrypted. So luks automounts must be read from the initrd.

[mrHappyPants]

no I understand you (I think?), the fs is encrypted so you mount it "through" the decrypter meaning you can't just put it in /etc/fstab. Could you just run a script in initrd to do your "cryptsetup luksOpen /dev/sdb1 luks-volume" part befora fstab is read? I don't know the ordering of things...

[forkbomb]

Yup, that's pretty much it. You need to run crypsetup luksOpen to get the decrypted dev node (in /dev/mapper).

For it to all be seamless and automatic, you'd still need an fstab entry (for example, my fstab does have an entry for root). But that dev node needs to be created first (that's the part that I assume is in the initrd for the / partition).

I wouldn't know how to start editing the initrd, unfortunately.

[forkbomb]

Got it now. The prompting of the password for my / comes earlier than the other two, but by editing /etc/crypttab and /etc/fstab, I got the other two to be automounted. The opening of the luks volume for the / must still be contained in the initrd, but the other two are opened when /etc/fstab mounts are brought up.

/etc/fstab:

/dev/mapper/luks-4fe5a07c-8dcf-46a4-9cc6-d7a5eef1ed94 /                       ext3    defaults        1 1
/dev/mapper/luks-wd		/mnt/ext-wd				ext3	defaults		0 0
/dev/mapper/luks-fantom    /mnt/ext-fantom			ext3	defaults		0 0

/etc/crypttab:

luks-4fe5a07c-8dcf-46a4-9cc6-d7a5eef1ed94	UUID=4fe5a07c-8dcf-46a4-9cc6-d7a5eef1ed94 	none
luks-fantom									UUID=a9b9b28b-f567-4ab0-92b5-cc400913762f	none
luks-wd										UUID=ba559117-558c-41ca-b984-0a45898e5686	none

Format of crypttab is: device node name to create in /dev/mapper, UUID/path of "real partition", password or keyfile (if none, the password must be input at boot time).

UUIDs were determined with the blkid command.