Setting up a LUKS partition to use a USB key

Question

Im playing with an old netbook I've been given, essentially practicing for when I get a new desktop. Anyway, I want to install Arch on a LUKS encrypted partition and have it unlocked at boot time using a key located on a USB key.
This is what I did first time round and whilst the root partition is indeed encrypted I'm having to type a passphrase every boot:
loadkeys uk
lsblk
gdisk /dev/sda
outout should eventually look like:
Command (? for help): p
Disk /dev/sda:
Logical sector size: 512 bytes
Disk identifier (GUID):
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is
Partitions will be aligned on 2048-sector boundaries
Total free space is 2014 sectors (1007.0 KiB)
Number Start (sector) End (sector) Size Code Name
1 2048 8191 3.0 MiB EF02 BIOS boot partition
2 8192 1032191 500.0 MiB 8300 boot
3 1032192 8300 root
cryptsetup -v --cipher aes-xts-plain64 --key-size 512 --hash sha512 --iter-time 5000 --use-random luksFormat /dev/sda3
enter a passphrase twice here
cryptsetup open /dev/sda3 ARCHROOT
mkfs.ext4 /dev/sda2
mkfs.btrfs /dev/mapper/ARCHROOT
mount /dev/mapper/ARCHROOT /mnt
cd /mnt
Would I need to
cryptsetup luksAddKey /path/to/keyfile
after the first cyptsetup step? If so can the live Arch environment mount USB drives at this point in the installation process?

Answer 1

frostschutz wrote:Do you have a backup of those headers, then? Kinda sucks to lose all your data to a faulty USB key.
hehe, yes several USB keys and other secure storage.
frostschultz wrote:Security wise it shouldn't matter, if someone can modify my Initramfs, they can also modify my Grub.
The other thing I forgot to mention is that my USB stick is also my boot device. There's no Grub or any other bootloader on the target systems to mess with. If started without the key, they just say "operating system not found". Even if someone got hold of the USB stick, as a last line of defence, all the keys and headers that Grub needs (as well as the Grub boot config) is stored on an encrypted partition on the USB stick that requires a passphrase to unlock.
frostschultz wrote:
I can pull my USB stick as soon as Grub is done loading the kernel and initramfs, i.e. the moment kernel messages start to appear. They keys and all are part of the Initramfs, so the USB stick is no longer necessary.
Basically, it's this method: https://wiki.gentoo.org/wiki/Custom_Ini … ed_Keyfile and the first example here: https://wiki.gentoo.org/wiki/Custom_Initramfs/Examples
That gentoo example doesn't use systemd. I wanted to use the native systemd functionality as much as possible. My my initramfs opens what's necessary for boot (essentially the root filesystem) and the main early-boot does everything else. I wanted to use the standard /etc/fstab and /etc/crypttab and allow systemd to sort everything out but I encountered the dependency problem. I have a very simple workaround for it, however.
I'll just add to that as well that the systemd issue is only on systems where the initramfs is insecure and, therefore, cannot contain keys. Those systems with the initramfs on an encrypted filesystem don't need the usb key to unlock the rest of the encrypted filesystems because the keys are in the encrypted initramfs. They only need the USB key to unlock the root. I cannot secure the initramfs on some systems because of the way they boot (specifically, non-x86 boxes that cannot use Grub or are unable to boot off arbitrary devices).
Last edited by starfry (2015-02-07 14:09:29)