Skip to content

Instantly share code, notes, and snippets.

@mfrister

mfrister/remote-unlock.md

Created December 18, 2015 20:01
Show Gist options
  • Star 5 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save mfrister/46133155c4afd8bb71c6 to your computer and use it in GitHub Desktop.
Save mfrister/46133155c4afd8bb71c6 to your computer and use it in GitHub Desktop.
Download ZIP
Remote unlock via SSH for encrypted root volume (Ubuntu 14.04.3)
Raw
remote-unlock.md

Remote unlock via SSH for encrypted root volume

Ubuntu 14.04.3

Install dropbear SSH server with automated hooks for being included in an initramfs.

apt-get install dropbear

Remove default private/public key for login, clear dss key (would be regenererated otherwise), remove insecure 1024-bit RSA host key and generate a new 2048-bit RSA host key (we'll have to keep the DSA-key, dropbear won't start otherwise - make sure to use RSA when connecting):

rm /etc/initramfs-tools/root/.ssh/id_rsa.{dropbear,pub}
rm /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key
dropbearkey -t rsa -s 2048 -f /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key

Add public keys to /etc/initramfs-tools/root/.ssh/authorized_keys.

Make dropbear run on port 222 - edit /usr/share/initramfs-tools/scripts/init-premount/dropbear and change one of the last few lines starting dropbear to:

/sbin/dropbear -p 222

Regenerate initramfs:

update-initramfs -u

Log in

Find the cryptsetup pcommand by running ps |grep cryptsetup. kill makes the boot process continue.

Unlocking then looks like this:

# /sbin/cryptsetup -T 1 --allow-discards luksOpen /dev/disk/by-uuid/<SOME UUID> sda3_crypt
Enter passphrase for /dev/disk/by-uuid/<SOME UUID>:
# kill -9 `pidof plymouth`

Troubleshooting

If you're getting a connection refused when trying to connect, dropbear might fail to start. You can use a rescue shell (add break=premount to the grub line beginning with linux) for debugging. Try to start dropbear with dropbear -F -E (foreground, logging to stderr) and see what happens.

I had one of the key files accidentally empty, which resulted in an error message including bad buf_getptr.

See also

  • /usr/share/initramfs-tools/hooks/dropbear - script that sets up dropbear in initramfs
  • /usr/share/initramfs-tools/scripts/init-premount/dropbear - script that starts dropbear

Quite a few of the following pages confuse how dropbear is configured on the root system vs. the initramfs and might also confuse or complicate other things. These are just the pages I looked at when setting this up.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment