| Summary: | sys-kernel/dracut-017-r1 fails to pass gpg encrypted passphrase to cryptsetup | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | Hanspeter Spalinger <gentoo> |
| Component: | Current packages | Assignee: | Amadeusz Żołnowski (RETIRED) <aidecoe> |
| Status: | RESOLVED WORKSFORME | ||
| Severity: | minor | CC: | gentoo, kensington |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
| Attachments: | emerge --info output | ||
|
Description
Hanspeter Spalinger
2012-03-22 14:26:44 UTC
This is probably true. There's some weirdness on password processing between how it's done with "-d -" and without. Please read "NOTES ON PASSWORD PROCESSING" sections of cryptsetup man page. Does your decrypted key works with "cryptsetup -d /path/to/plain.key"? (In reply to comment #1) > Does your decrypted key works with "cryptsetup -d /path/to/plain.key"? No, it fails with again the error "No Key available with this passphrase" 'cryptsetup -d /tmp/luks.key luksOpen /dev/sda1 crypto' 'cat /tmp/luks.key | cryptsetup luksOpen /dev/sda1 crypto' works. But this made me go debugging some more. reading about cryptsetup I think the problem lies in this (from manpage, as you suggested): "If --key-file=- is used for reading the key from stdin, no trailing newline is stripped from the input. Without that option, cryptsetup strips trailing newlines from stdin input." The problem lies how I added the key originally as described in http://en.gentoo-wiki.com/wiki/DM-Crypt_with_LUKS There it is suggested to use 'gpg --quiet --decrypt rootkey.gpg | cryptsetup -v --cipher serpent-cbc-essiv:sha256 --key-size 256 luksFormat /dev/sda3' However, this will behave as the std-in and strip the newline. At decryption stage, using "-d -" will not strip the newline, and it fails. As I had the key decrypted into /tmp/luks.key, I went on and added that key AS A FILE with 'cat /tmp/luks.key | cryptsetup luksAddKey /dev/sda1 /tmp/luks.key' (this uses the key as a password and then adds the key as a file) NOW I can do 'cryptsetup -d /tmp/luks.key luksOpen /dev/sda1 crypto' and it opens the device and after adding "-d -" to the cryptroot-ask.sh file again (as it was in the original script) works too! So basically the advice in that wiki page does not work correctly with dracut. I think the best solution to all of this is to edit the wiki page and tell people to add "-d -" at the key setup if using dracut. 'gpg --quiet --decrypt rootkey.gpg | cryptsetup -d - -v --cipher serpent-cbc-essiv:sha256 --key-size 256 luksFormat /dev/sda3' Right, this should actually be documented. I'll leave it opened as reminder to do so. I tried to add a short note in the wiki page, but as I do not have a account there, I horribly failed by adding it at the luksOpen command instead the luksFormat. And now it seems I can not repair that mistake (but my updates do not appear anyway). Sorry for the trouble. I should think before act. I let the people with knowledge/expertise do the work. On a side note, on the discuss page (http://en.gentoo-wiki.com/wiki/Talk:DM-Crypt_with_LUKS ) they give a reasoning for using "-d -" instead just piping (it actually has security implications). So the whole page should be updated (not only about dracut) (In reply to comment #4) > I tried to add a short note in the wiki page, but as I do not have a account > there, I horribly failed by adding it at the luksOpen command instead the > luksFormat. And now it seems I can not repair that mistake (but my updates > do not appear anyway). > Sorry for the trouble. I should think before act. I let the people with > knowledge/expertise do the work. And have you managed to update Wiki? I've added note to dracut.cmdline man page (you will find it in 023), therefore I'm closing the bug. diff --git a/dracut.cmdline.7.asc b/dracut.cmdline.7.asc index 0b1b8a2..884b223 100644 --- a/dracut.cmdline.7.asc +++ b/dracut.cmdline.7.asc @@ -233,6 +233,29 @@ rd.luks.key=/foo/bar.key ---- + As you see, you can skip colons in such a case. ++ +[NOTE] +=============================== +Dracut pipes key to cryptsetup with _-d -_ argument, therefore you need to pipe +to crypsetup luksFormat with _-d -_, too! + +Here follows example for key encrypted with GPG: + +---- +gpg --quiet --decrypt rootkey.gpg \ +| cryptsetup -d - -v \ +--cipher serpent-cbc-essiv:sha256 \ +--key-size 256 luksFormat /dev/sda3 +---- + +If you use plain keys, just add path to _-d_ option: + +---- +cryptsetup -d rootkey.key -v \ +--cipher serpent-cbc-essiv:sha256 \ +--key-size 256 luksFormat /dev/sda3 +---- +=============================== |
