Fedora 12 + Luks

[geugen]

Hello,

following problem:

I devided my hard drive into several partitions.
sda1 - /boot
sda2 - /
sda 3 (secondary)
- sda5 - /home
- sda6 - swap

I am using LUKS encryption on 2, 5, 6. On boot the key for 2 is entered manually. Then, through /etc/crypttab and /etc/fstab, partitions 5 and 6 are decrypted through a key-file, which lays on sda2. That way I always needed to enter only one passphrase.
Now I installed Fedora 12. Even if I don't want to boot 5 and 6 (means I deactivated them in crypttab and fstab) the system still asks for a password during the boot.

What I tried was to install the kernel from Fedora 11 repository and boot with it and ... it works perfekt again! So, what's the problem with the new kernel from Fedora 12?
By the way, if I boot with Fedora12 kernel then after about two minutes of waiting and not entering the passphrases for 5 and 6 the boot process goes on as in Fedora 11 case and everything is loaded as it should be.

Thanks in advance

Eugen

[Sayen]

Hi
Take a look at man dracut.
You probably need one of flags to pass on kernel boot.
rd_NO_LUKS or if Your / is encrypted then rather rd_LUKS_UUID=<luks uuid>
/etc/crypttab is read later with rc.sysinit script, not init from initrd like image.

Regards
Jan

[geugen]

Hello Jan,

thanks for the hint. I've never heard of it before. However, after reading through the dracut webpage it seems as if you were absolutely right. Too bad the whole thing is so new. I have no clue where to start.
So far I tried to generate a new initramfs-image using dracut:

dracut rd_LUKS_UUID=<root-UUID> initramfs-2.6.31.fc12.x86_64.img 2.6.31.5-127
according to: dracut <OPTIONS> <image> <kernel version>

However, after the file was created and I restarted my pc (grub.conf was of course edited before that) a lot of errors came up. Therefore I returned to the old initramfs image again. What am I doing wrong?

Thans as always in advance
Eugen

[Sayen]

Hi
No need to create new initrd. Just edit Your /etc/grub.conf and adjust kernle line in correct section.
Sorry for being unclear.
Go to /usr/share/dracut if scripts can tell You how it all work
script cryptroot-ask.sh is lunched when requested from 90crypt/70-luks.rules (which is part of initrd udev rules, valid in time of booting)
Script checks if rd_LUKS_UUID is set and then asks for password only if uuid of device matches one in parameter list.
If there is rd_NO_LUKS parameter then 70-luks.rules is deleted before it become effective (parse-crypt.sh is responsible for that).

Regards
Jan

[geugen]

Hm, no luck! I have tried every possible combination and UUID in my grub.conf, but still, the system always wants the password for the other partitions. Maybe it's because of my x86_64 system, maybe because of something else.

Anyways, I really need a good working and secure system. However, at the moment fedora 12 doesn't seem offer it - a least not im my case. I am going to reinstall Fedora 11 and wait a while.

Thanks for the help. Really appreciated it!!!

[gotencool]

Originally Posted by geugen

Hm, no luck! I have tried every possible combination and UUID in my grub.conf, but still, the system always wants the password for the other partitions. Maybe it's because of my x86_64 system, maybe because of something else.

Anyways, I really need a good working and secure system. However, at the moment fedora 12 doesn't seem offer it - a least not im my case. I am going to reinstall Fedora 11 and wait a while.

Thanks for the help. Really appreciated it!!!

You must find the UUID of your LVM root partition:

[root@caleuche ~]# lvdisplay
--- Logical volume ---
LV Name /dev/VolGroupGC/LogVolRoot
VG Name VolGroupGC
LV UUID c9uMIe-Lqpk-6UOY-fMcf-6LEv-z1ZG-4edP2s
LV Write Access read/write
LV Status available
# open 1
LV Size 14,62 GB
Current LE 468
Segments 1
Allocation inherit
Read ahead sectors auto
- currently set to 256
Block device 253:0

Then, you must edit /boot/grub/grub.conf and add the dracut flag:

title Fedora (2.6.31.5-127.fc12.x86_64)
root (hd0,2)
kernel /vmlinuz-2.6.31.5-127.fc12.x86_64 ro root=/dev/mapper/VolGroupGC-LogVolRoot rd_LUKS_UUID=<your lvm root uuid>

Reboot and test.
regards.

[geugen]

Ok, now I am a bit confused. Why do I need the LVM root partition? Shouldn't I be using the luks one?

My original grub conf:

title Fedora (2.6.31.5-127.fc12.x86_64)
	root (hd0,0)
	kernel /vmlinuz-2.6.31.5-127.fc12.x86_64 ro root=/dev/mapper/luks-7ad085ad-c93d-4e07-a420-775d8f2c3368
	initrd /initramfs-2.6.31.5-127.fc12.x86_64.img

[root@lenovo-t61 ~]# lvdisplay 
  --- Logical volume ---
  LV Name                /dev/vg_lenovot61/lv_root
  VG Name                vg_lenovot61
  LV UUID                oTdjT1-ZeKX-uUAX-4OoH-MiPX-jQkP-Y4XzNL
  LV Write Access        read/write
  LV Status              available
  # open                 1
  LV Size                15,00 GB
  Current LE             3840
  Segments               1
  Allocation             inherit
  Read ahead sectors     auto
  - currently set to     256
  Block device           253:0

[root@lenovo-t61 ~]# blkid
/dev/sda1: UUID="d1ed46ad-9750-4368-9d04-082dea0ef096" TYPE="ext4" 
/dev/sda2: UUID="CYJaay-qeEe-RjV1-8USU-vFtm-tzE2-RpzbR9" TYPE="LVM2_member" 
/dev/mapper/vg_lenovot61-lv_root: UUID="7ad085ad-c93d-4e07-a420-775d8f2c3368" TYPE="crypto_LUKS"
...

Maybe our encryption strategy differs.
I created the encrypted luks partition during the fedora installation. By the way, it was the first time I started using lvm. Before I had my partitions devided as described in the first post without lvm. After this didn't work, I reinstalled the whole thing and let fedora devide my harddrive automatically. sda2 became lvm-group, which had logical partitions: root, home and swap. Here I activated the encryption, however, only for root. home and swap were encrypted later. Was this maybe a mistake.

I am planing on reinstalling the whole thing and do following:

Create structure:

sda1 - primary (for /boot)
sda2
  - sda3 (for root)
  - sda4 (rest for /home)
  - sda5 (for swap)

Next I encrypt sda3, sda4, sda5. After that I install Fedora 12.


OR should I just use the options offered during the installation and encrypt everything at once?

Thanks again :-)

[Sayen]

Hi
I do not have such setup around. Just crypted partition with key, so rd_NO_LUKS was choice for me.

Maybe there is a bug in rd_LUKS_UUID implementation.
I do not like the lines in script cryptroot-ask.sh:

if [ -n "$LUKS" ]; then
    ask=0
    luuid=${2##luks-}
    for luks in $LUKS; do
        if [ "${luuid##$luks}" != "$2" ]; then
            ask=1
        fi
    done
fi

LUKS is set to rd_LUKS_UUID list. luuid is checked device uuid like:
UUID="7ad085ad-c93d-4e07-a420-775d8f2c3368" TYPE="crypto_LUKS"

then ask should be set to 1 if and only if this luuid matches one on list provided on boot.
Then in my opinion ${luuid##$luks} should be compared to empty string rather than to
$2. To be precise it will always be not equal to $2.
Maybe use something like:

        if [ -z "${luuid##$luks}" ]; then
            ask=1
        fi

would work better?
You can always try to update two scripts in /usr/share/dracut and then rebuilding initramfs, probably with something like dracut <imagename> <kernel version>
After that new scripts should be in init image, still keep backup as I did not test it.

Regards
Jan