subject:"\[Bug 1223622\] Re\: add support for crypttab mounting of luks devices with detached headers"

I have gotten this to work in Ubuntu 15.10, which has cryptsetup 1.6.6.
As mentioned previously, the scripts in 1.6.6 have included the patches
from here with some modifications, along with additions for truecrypt
volumes, btrfs, and some improvement (hopefully) of situations where
it's necessary to wait for disks to come up.  Unfortunately, the
modifications to the detached header code introduced a number of errors
and was, in addition, crippled by the commenting out of the code that
inserted the header into the initramfs.  I'm about to upload the patches
here.  A couple of notes on usage/comments:

(1) A function in /lib/cryptsetup/cryptdisks.functions parses the
/etc/crypttab file, including any possible "header=" option.  This
function only works if  is a complete filename path.  That path may
need to be in quotes if it's got spaces in it, though I haven't tested
that part.  I <> this is only used for disks that come up after
root and (perhaps) are not listed as automount in /etc/fstab.

(2) The scripts in /usr/share/initramfs-tools/{hooks,scripts/local-
top}/cryptroot also parse the crypttab file (respectively a derivative
of that file) in order to bring up an encrypted root device.  If that
root device has a detached header, then the "header=" option can
refer either to a complete filename path, or to a file in the directory
/etc/initramfs-tools/conf.d/cryptheader.  Both ways of referring to the
file (now) work.

(3) It's the script /usr/share/initramfs-tools/hooks/cryptroot that had
the section commented out.  This section was taken directly from the
original scripts posted by Glenn.  That section is marked by a "TODO",
added by the maintainer, and which I have uncommented.

A final note.  When the header is not detached, it's possible to use
UUID's to refer to a device in crypttab.  Since the UUID is in the
header, when we have a detached header it is no longer possible to refer
to the device this way.  There is another unique means of referring to a
(hardware) disk, the WWN device identifier
(https://en.wikipedia.org/wiki/World_Wide_Name).  These can be found
listed in /dev/disk/by-id/wwn-*.  This is probably what you want to use
for the first, target, field in the crypttab file.

Ok, patches coming.  Hope it's useful!

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1223622

Title:
  add support for crypttab mounting of luks devices with detached
  headers

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1223622] Re: add support for crypttab mounting of luks devices with detached headers

I am attaching here the diff for the modified /usr/share/initramfs-
tools/scripts/local-top/cryptroot, to be used with cryptsetup 1.6.6,
which is the version in ubuntu 15.10. This patch corrects one error, and
includes a couple of additional comments to the maintainer.

** Patch added: "cryptsetup.1.6.6.initrd.cryptroot.scripts.new.patch"
   
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+attachment/4541311/+files/cryptsetup.1.6.6.initrd.cryptroot.scripts.patch

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1223622

Title:
  add support for crypttab mounting of luks devices with detached
  headers

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1223622] Re: add support for crypttab mounting of luks devices with detached headers

I am attaching here the diff for the modified /usr/share/initramfs-
tools/scripts/local-top/cryptroot, to be used with cryptsetup 1.6.6,
which is the version in ubuntu 15.10. This patch corrects one error, and
includes a couple of additional comments to the maintainer.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1223622

Title:
  add support for crypttab mounting of luks devices with detached
  headers

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1223622] Re: add support for crypttab mounting of luks devices with detached headers

I am attaching here the diff for the modified
/lib/cryptsetup/cryptdisks.functions, to be used with cryptsetup 1.6.6,
which is the version in ubuntu 15.10.  Note that this diff contains no
modification other than a comment by myself to the maintainer.

** Patch added: "cryptsetup.1.6.6.cryptdisks.functions.patch"
   
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+attachment/4541308/+files/cryptsetup.1.6.6.cryptdisks.functions.patch

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1223622

Title:
  add support for crypttab mounting of luks devices with detached
  headers

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1223622] Re: add support for crypttab mounting of luks devices with detached headers

I am attaching here the diff for the modified /usr/share/initramfs-
tools/hooks/cryptroot, to be used with cryptsetup 1.6.6, which is the
version in ubuntu 15.10.  This patch corrects two errors, and includes a
couple of additional comments to the maintainer.

** Patch added: "cryptsetup.1.6.6.initrd.cryptroot.hooks.patch"
   
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+attachment/4541309/+files/cryptsetup.1.6.6.initrd.cryptroot.hooks.patch

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1223622

Title:
  add support for crypttab mounting of luks devices with detached
  headers

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1223622] Re: add support for crypttab mounting of luks devices with detached headers

2015-12-15 Thread Attila Lendvai

security risk? that doesn't make much sense... in normal installs both
/boot and the luks headers are lying there on the disks unencrypted. i
don't see how packing the luks headers into the initramfs (/boot) could
make that any worse?

i'm not a linux guru by any means, but AFAIU:

  - grub loads the kernel and the initramfs (from /boot, but not as a
normal mount, but as some lower level infrastructure)

  - jumps to the kernel entry point address, passing it the initramfs
as a memory address. at this point nothing is mounted.

  - boot scripts in initramfs start to get executed and reach the
point of mounting rootfs. at this point /boot is probably not
mounted yet, but i don't see any obvious obstacles why it couldn't
be mounted before the rootfs, except that i have no clue about how
linux mount work. rootfs gets mounted as / after all, maybe that's
a headache if there's stuff like /boot already mounted.

thanks for looking into this! plausible deniability is becoming more
and more important now that poeple go to jail even in the the western
"free" democracies for as little as not giving out passwords...

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1223622

Title:
  add support for crypttab mounting of luks devices with detached
  headers

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1223622] Re: add support for crypttab mounting of luks devices with detached headers

2015-12-14 Thread DiagonalArg

@Attila - The patches from here seem to have been included (with some
changes) in the new scripts that are available in 15.10.  Unfortunately,
the scripts do not include the header in the initramfs, with a note that
this is a "security risk".  Hm.  So I thought I might just add the
header to the /boot directory which is unencrypted, thinking this would
be available at bootup.  Then I pointed the header= option there.
But that didn't work.  On bootup I get a message that the header file is
not available.  Dropping into a shell, I find that I am at the
(initramfs) prompt.

I'll have to review the boot process to find out if there is some part
of the /boot directory that is available, or if I actually must have the
header in the initramfs.  If the latter, then the scripts will (again)
have to be altered.

I really don't understand the point of crippling the scripts in that
way.  The idea is to put the header on a USB or SD and then carry that
with us.  I'm not clear on what the security problem is.  Having the
header hanging out there on the disk unprotected is not a security
problem??

Suggestions welcome!

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1223622

Title:
  add support for crypttab mounting of luks devices with detached
  headers

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1223622] Re: add support for crypttab mounting of luks devices with detached headers

2015-02-23 Thread DiagonalArg

@Attila - There's a little something here with updates as of Mar 2,
2014, though I'm not sure how far it goes: https://bugs.debian.org/cgi-
bin/bugreport.cgi?bug=716652

I did contact the maintainers about the scripts, but didn't hear back.

** Bug watch added: Debian Bug tracker #716652
   http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=716652

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1223622

Title:
  add support for crypttab mounting of luks devices with detached
  headers

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1223622] Re: add support for crypttab mounting of luks devices with detached headers

2015-02-20 Thread Attila Lendvai

it would be nice if someone could comment the debian bug URL's here, or
anything like that, so that distant wanderers like me can have an idea
how much work it is today to set up on debian jessie.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1223622

Title:
  add support for crypttab mounting of luks devices with detached
  headers

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1223622] Re: add support for crypttab mounting of luks devices with detached headers

** Patch removed: cryptsetup-1.4.3.ubuntu.raring.initrd.cryptroot-hook.patch
   
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+attachment/3956419/+files/cryptsetup-1.4.3.ubuntu.raring.initrd.cryptroot-hook.patch

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1223622

Title:
  add support for crypttab mounting of luks devices with detached
  headers

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1223622] Re: add support for crypttab mounting of luks devices with detached headers

After squashing one bug, I got this working on 12.04 with a root on lvm
on luks (sans header) and boot on USB with lvm.

Usage turned out to be slightly different than I had understood:

*
Adds a valid option to crypttab:
   header=filename

When the initramfs is created, filename will be included into the
/conf/conf.d/lukshdr directory of the initramfs.

filename will be searched for first in the default conf.d/lukshdr directory 
(which, in mkinitramfs, defaults to /etc/initramfs-tools/conf.d/lukshdr), then 
as an absolute path.  While cryptsetup allows the header to be on a device 
file, this is not an option for these patches, which need the file located in 
that directory.
***

I am attaching here the diff for the modified /usr/share/initramfs-
tools/scripts/local-top/cryptroot, to be used with cryptsetup 1.4.1,
which is the version in precise.

** Patch added: cryptsetup.1.4.1.initrd.cryptroot.scripts.new.patch
   
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+attachment/3963839/+files/cryptsetup.1.4.1.initrd.cryptroot.scripts.new.patch

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1223622

Title:
  add support for crypttab mounting of luks devices with detached
  headers

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1223622] Re: add support for crypttab mounting of luks devices with detached headers

And similarly for /lib/cryptsetup/cryptdisks.functions, which works with
either cryptsetup 1.4.1 or 1.4.3, in either precise or raring.

** Patch added: cryptsetup.1.4.[13].cryptdisks.functions.patch
   
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+attachment/3963843/+files/cryptsetup.1.4.%5B13%5D.cryptdisks.functions.patch

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1223622

Title:
  add support for crypttab mounting of luks devices with detached
  headers

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1223622] Re: add support for crypttab mounting of luks devices with detached headers

I am attaching here the diff for the modified /usr/share/initramfs-
tools/scripts/local-top/cryptroot, to be used with cryptsetup 1.4.3,
which is the version in raring.

** Patch added: cryptsetup.1.4.3.cryptroot.scripts.new.patch
   
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+attachment/3963840/+files/cryptsetup.1.4.3.cryptroot.scripts.new.patch

** Patch removed: 
cryptsetup-1.4.3.ubuntu.precise.initrd.cryptroot-script.patch
   
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+attachment/3956417/+files/cryptsetup-1.4.3.ubuntu.precise.initrd.cryptroot-script.patch

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1223622

Title:
  add support for crypttab mounting of luks devices with detached
  headers

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1223622] Re: add support for crypttab mounting of luks devices with detached headers

For clarity/consistency of filenames, I am attaching here the diff for
the modified /usr/share/initramfs-tools/hooks/cryptroot, to be used with
either cryptsetup 1.4.1 or 1.4.3, in either precise or raring.

** Patch added: cryptsetup.1.4.[13].initrd.cryptroot.hooks.patch
   
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+attachment/3963842/+files/cryptsetup.1.4.%5B13%5D.initrd.cryptroot.hooks.patch

** Patch removed: cryptsetup-1.4.3.ubuntu.raring.initrd.cryptroot-hook.patch
   
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+attachment/3956418/+files/cryptsetup-1.4.3.ubuntu.raring.initrd.cryptroot-hook.patch

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1223622

Title:
  add support for crypttab mounting of luks devices with detached
  headers

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1223622] Re: add support for crypttab mounting of luks devices with detached headers

Apparently it only takes on patch at a time, so here's the cryptroot-
hook patch.

** Patch added: cryptsetup-1.4.3.ubuntu.raring.initrd.cryptroot-hook.patch
   
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+attachment/3956418/+files/cryptsetup-1.4.3.ubuntu.raring.initrd.cryptroot-hook.patch

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1223622

Title:
  add support for crypttab mounting of luks devices with detached
  headers

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1223622] Re: add support for crypttab mounting of luks devices with detached headers

Precise (12.04) has cryptsetup v.1.4.1, and these patches basically work
for that version also.

(1) /lib/cryptsetup/cryptdisks.functions works with no changes
(2) /usr/share/initramfs-tools/hooks/cryptroot works with no changes
(3) /usr/share/initramfs-tools/scripts/local-top/cryptroot needs a single
added.

I've broken @Glen's combined cryptroot patch into two, made the small mod,
and am attaching
it here.

Usage - The first script adds a valid option to crypttab:
header=filename

When the initramfs is created, the other two scripts include filename in the
initramfs and
keep track of how to assemble the boot disk on startup.

When the scripts look for filename to include it, the search will be first in
the conf.d directory,
which defaults to: /etc/initramfs-tools/conf.d. If it is not found there, then
it is searched as an
absolute path.

As far as I can tell, filename has to be a normal file, though
cryptsetup allows a device.

I haven't tested this yet, but I am close to trying and will report back
when I do.

** Patch added: cryptsetup-1.4.3.ubuntu.precise.initrd.cryptroot-script.patch

https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+attachment/3956417/+files/cryptsetup-1.4.3.ubuntu.precise.initrd.cryptroot-script.patch

--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1223622

Title:
add support for crypttab mounting of luks devices with detached
headers

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+subscriptions

--
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1223622] Re: add support for crypttab mounting of luks devices with detached headers

Apparently it only takes on patch at a time, so here's the cryptroot-
hook patch.

** Patch added: cryptsetup-1.4.3.ubuntu.raring.initrd.cryptroot-hook.patch
   
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+attachment/3956419/+files/cryptsetup-1.4.3.ubuntu.raring.initrd.cryptroot-hook.patch

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1223622

Title:
  add support for crypttab mounting of luks devices with detached
  headers

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1223622/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1223622] Re: add support for crypttab mounting of luks devices with detached headers