{"id":1042,"date":"2017-08-30T10:27:05","date_gmt":"2017-08-30T17:27:05","guid":{"rendered":"https:\/\/outflux.net\/blog\/?p=1042"},"modified":"2017-08-30T14:41:51","modified_gmt":"2017-08-30T21:41:51","slug":"grub-and-luks","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2017\/08\/30\/grub-and-luks\/","title":{"rendered":"GRUB and LUKS"},"content":{"rendered":"

I got myself stuck yesterday with GRUB running from an ext4 \/boot\/grub<\/code>, but with \/boot<\/code> inside my LUKS LVM root partition, which meant GRUB couldn’t load the initramfs and kernel.<\/p>\n

Luckily, it turns out that GRUB does know how to mount LUKS volumes (and LVM volumes), but all the instructions<\/a> I could find talk about setting this up ahead of time (“Add GRUB_ENABLE_CRYPTODISK=y<\/code> to \/etc\/default\/grub<\/code>“), rather than what the correct manual GRUB commands are to get things running on a failed boot.<\/p>\n

These are my notes on that, in case I ever need to do this again, since there was one specific gotcha with using GRUB’s cryptomount<\/code> command (noted below).<\/p>\n

Available devices were the raw disk (hd0)<\/code>, the \/boot\/grub<\/code> partition (hd0,msdos1)<\/code>, and the LUKS volume (hd0,msdos5)<\/code>:<\/p>\n

\n
\r\ngrub> ls\r\n(hd0) (hd0,msdos1) (hd0,msdos5)\r\n<\/pre>\n<\/blockquote>\n
Used cryptomount<\/code> to open the LUKS volume (but without ()<\/code>s! It says it works if you use parens, but then you can’t use the resulting (crypto0)<\/code>):<\/p>\n
\n
\r\ngrub> insmod luks\r\ngrub> cryptomount hd0,msdos5\r\nEnter password...\r\nSlot 0 opened.\r\n<\/pre>\n<\/blockquote>\n
Then you can load LVM and it’ll see inside the LUKS volume:<\/p>\n
\n
\r\ngrub> insmod lvm\r\ngrub> ls\r\n(crypto0) (hd0) (hd0,msdos1) (hd0,msdos5) (lvm\/rootvg-rootlv)\r\n<\/pre>\n<\/blockquote>\n
And then I could boot normally:<\/p>\n
\n
\r\ngrub> configfile $prefix\/grub.cfg\r\n<\/pre>\n<\/blockquote>\n
After booting, I added GRUB_ENABLE_CRYPTODISK=y<\/code> to \/etc\/default\/grub<\/code> and ran update-grub<\/code>. I could boot normally after that, though I’d be prompted twice for the LUKS passphrase (once by GRUB, then again by the initramfs).<\/p>\n
To avoid this, it’s possible to add a second LUKS passphrase, contained in a file in the initramfs, as described here<\/a> and works for Ubuntu and Debian too. The quick summary is:<\/p>\n
Create the keyfile and add it to LUKS:<\/p>\n
\n
\r\n# dd bs=512 count=4 if=\/dev\/urandom of=\/crypto_keyfile.bin\r\n# chmod 0400 \/crypto_keyfile.bin\r\n# cryptsetup luksAddKey \/dev\/sda5 \/crypto_keyfile.bin\r\n*enter original password*\r\n<\/pre>\n<\/blockquote>\n
Adjust the \/etc\/crypttab<\/code> to include passing the file via \/bin\/cat<\/code>:<\/p>\n
\n
\r\nsda5_crypt UUID=4aa5da72-8da6-11e7-8ac9-001cc008534d \/crypto_keyfile.bin luks,keyscript=\/bin\/cat\r\n<\/pre>\n<\/blockquote>\n
Add an initramfs hook to copy the key file into the initramfs, keep non-root users from being able to read your initramfs, and trigger a rebuild:<\/p>\n
\n
\r\n# cat > \/etc\/initramfs-tools\/hooks\/crypto_keyfile <<EOF\r\n#!\/bin\/bash\r\nif [ \"$1\" = \"prereqs\" ] ; then\r\n    cp \/crypto_keyfile.bin \"${DESTDIR}\"\r\nfi\r\nEOF\r\n# chmod a+x \/etc\/initramfs-tools\/hooks\/crypto_keyfile\r\n# chmod 0700 \/boot\r\n# update-initramfs -u\r\n<\/pre>\n<\/blockquote>\n
This has the downside of leaving a LUKS passphrase “in the clear” while you’re booted, but if someone has root, they can just get your dm-crypt<\/code> encryption key directly anyway:<\/p>\n
\n
\r\n# dmsetup table --showkeys sda5_crypt\r\n0 155797496 crypt aes-cbc-essiv:sha256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 0 8:5 2056\r\n<\/pre>\n<\/blockquote>\n
And of course if you’re worried about Evil Maid attacks, you’ll need a real static root of trust instead of doing full disk encryption passphrase prompting from an unverified \/boot<\/code> partition. :)<\/p>\n
© 2017, Kees Cook<\/a>. This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 License<\/a>.
\"CC<\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"
I got myself stuck yesterday with GRUB running from an ext4 \/boot\/grub, but with \/boot inside my LUKS LVM root partition, which meant GRUB couldn’t load the initramfs and kernel. Luckily, it turns out that GRUB does know how to mount LUKS volumes (and LVM volumes), but all the instructions I could find talk about […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,18,6,14,19],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/1042"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=1042"}],"version-history":[{"count":13,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/1042\/revisions"}],"predecessor-version":[{"id":1055,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/1042\/revisions\/1055"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=1042"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=1042"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=1042"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}