Is there anyway to boot root encrypted system with keyfile ?

Ask questions about Arch Linux ARM. Please search before making a new topic.

Is there anyway to boot root encrypted system with keyfile ?

Postby Hacksign » Wed Apr 05, 2017 6:27 am

Hi there, not sure whether posted under proper place.

Recently, I've got an cubieboard2 board with archlinuxarm installed, everthing works fine, until I decided to deploy an root-encrypted system on this board.

What I've done :
1. dd if=/dev/urandom bs=1 count=1024 | cryptsetup luksFormat /dev/tf/card/of/partition/two -
2. mount /dev/tf/card/of/partion/two /mnt
3. mount /dev/tf/card/of/partion/one /mnt/boot
4. download and extract ArchlinuxArm packages to /mnt
5. arch-chroot /mnt
6. pacman -S uboot-tools uboot-cubieboard2
7. edit /boot/boot.txt like below(partly) :
setenv bootargs console=${console} cryptdevice=/dev/mmcblk0p2:root root=/dev/mapper/root rw rootwait

8. edit /etc/fstab with proper settings of decrypted root fs and boot partion

But after I reboot system with this tf card, My cubieboard only requires xxxx.img through my gateway again and again (TFTP).

Question is:

How can I setup an working system with rootfs encrypted by luks, then make uboot unlock rootfs with a keyfile at boot time ?
Is it possible ?
Hacksign
 
Posts: 3
Joined: Wed Apr 05, 2017 6:07 am

Re: Is there anyway to boot root encrypted system with keyfi

Postby summers » Wed Apr 05, 2017 9:47 am

Haven't done it myself, but my guess is you need to ensure that the initramfs has enough information to access the encrypted rootfs. So I'll look into that myself ...
summers
 
Posts: 177
Joined: Sat Sep 06, 2014 12:56 pm

Re: Is there anyway to boot root encrypted system with keyfi

Postby Hacksign » Thu Apr 06, 2017 1:44 am

I need a separated keyfile store on an independence device.
So stored keyfile in initrd.img file do not meet my need.
Hacksign
 
Posts: 3
Joined: Wed Apr 05, 2017 6:07 am

Re: Is there anyway to boot root encrypted system with keyfi

Postby summers » Thu Apr 06, 2017 11:44 am

What I mean is the initramfs book will need to boot up enough, that its in a state where it can access the keystore, to unlock the encrypted hard disk.
summers
 
Posts: 177
Joined: Sat Sep 06, 2014 12:56 pm

Re: Is there anyway to boot root encrypted system with keyfi

Postby Hacksign » Fri Apr 07, 2017 5:50 am

well, understood. I will check the initrd's manual ...
Hacksign
 
Posts: 3
Joined: Wed Apr 05, 2017 6:07 am


Return to User Questions

Who is online

Users browsing this forum: Bing [Bot] and 3 guests