Swâmi Petaramesh | 22 Jul 08:02
Favicon

"Universal" keyscript for LVM encrypted systems with key on removable device

Hi folks,

Debian and Ubuntu installers include a "standard" way of building a 
fully-encrypted machine on a LUKS-encrypted LVM.

On top of this, I have written a more or less "universal" keyscript allowing 
the machine's LVM key to reside as a file on a removable device (i.e. USB key 
or SD-card) so this removable device will be the "key" for using the machine. 
That's quite convenient.

The removable device partition on which the keyfile resides can be FAT, 
ext2/3, or itself a LUKS-encrypted partition in which case the bootkeyscript 
will prompt for its passphrase for unlocking it and getting the key to the 
machine's main encrypted LVM. This allows for "two form factor 
authentication".

My script is rather automagic and doesn't need much more than being installed 
somewhere on the machine (typically /usr/local/sbin) and mentioned 
in /etc/crypttab before the initramfs is regenerated.
It doesn't need no change to the standard Debian or Ubuntu encrypted LVM setup 
or initramfs (besides mentioning the needed kernel modules for accessing the 
removable device in /etc/initramfs-tools/modules and optionally adding 2 
2-lines scripts in /etc/initramfs-tools/hooks for including a couple optional 
binaries in the initramfs.)

The partition on which the keyfile resides can be mentioned in /etc/crypttab 
either by its device name (sdb1) or LABEL or fs UUID (for unencryted fs), or 
LUKS volume UUID (for encrypted fs), allowing it to work on machines on which 
the device ID where the key device is inserted may change from one boot to 
another.
(Continue reading)


Gmane