From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wr0-x22a.google.com (mail-wr0-x22a.google.com [IPv6:2a00:1450:400c:c0c::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.server123.net (Postfix) with ESMTPS for ; Sat, 29 Apr 2017 19:48:36 +0200 (CEST) Received: by mail-wr0-x22a.google.com with SMTP id w50so47595509wrc.0 for ; Sat, 29 Apr 2017 10:48:36 -0700 (PDT) MIME-Version: 1.0 From: Hammad Siddiqi Date: Sat, 29 Apr 2017 22:48:15 +0500 Message-ID: Content-Type: multipart/alternative; boundary=94eb2c0d21c29a52d8054e51cc36 Subject: [dm-crypt] (no subject) List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: dm-crypt@saout.de --94eb2c0d21c29a52d8054e51cc36 Content-Type: text/plain; charset=UTF-8 Hi,No key available with this passphrase. one of our host, running centos 7.1, crashed today with a kernel panic on qemu-kvm process. the VM disks were stored on encrypted volume, which became locked after reboot. the cryptseup luksOpen command throws "No Key available with this passphrase". The encrypted volume has a 512 bit key without any password. we also backup our key and both backup and key residing on server are same. We have tried to by pass current OS by booting up using live CD of Centos 7.1, Linux Mint 17, Ubuntu 17.04 with different versions of kernel and crypt setup. this did not succeed. we believe the key is correct but the Encrypted volume is not accepting it. Can you please help us on this. Please let me know if you need something else as well * command used: cryptsetup luksOpen --key-file /etc/luks.key /dev/disk/by-uuid/92de4358-d815-496a-8a58-60e55346161d raid10-2hs-island * Host Kernel Version: 3.10.0-229.el7.x86_64 * Host Cryptsetup version: 1.6.6 **output of cryptsetup luksOpen** **cryptsetup luksOpen --key-file /etc/luks.key /dev/disk/by-uuid/92de4358-d815-496a-8a58-60e55346161d raid10-2hs-island --verbose --debug** ``` # cryptsetup 1.7.2 processing "cryptsetup luksOpen --key-file /etc/luks.key /dev/disk/by-uuid/92de4358-d815-496a-8a58-60e55346161d raid10-2hs-island --verbose --debug" # Running command open. # Locking memory. # Installing SIGINT/SIGTERM handler. # Unblocking interruption on signal. # Allocating crypt device /dev/disk/by-uuid/92de4358-d815-496a-8a58-60e55346161d context. # Trying to open and read device /dev/disk/by-uuid/92de4358-d815-496a-8a58-60e55346161d with direct-io. # Initialising device-mapper backend library. # Trying to load LUKS1 crypt type from device /dev/disk/by-uuid/92de4358-d815-496a-8a58-60e55346161d. # Crypto backend (gcrypt 1.5.3) initialized in cryptsetup library version 1.7.2. # Detected kernel Linux 3.10.0-229.el7.x86_64 x86_64. # Reading LUKS header of size 1024 from device /dev/disk/by-uuid/92de4358-d815-496a-8a58-60e55346161d # Key length 64, device size 15622799360 sectors, header size 4036 sectors. # Timeout set to 0 miliseconds. # Password retry count set to 3. # Password verification disabled. # Iteration time set to 2000 miliseconds. # Password retry count set to 1. # Activating volume raid10-2hs-island [keyslot -1] using keyfile /etc/luks.key. # dm version [ opencount flush ] [16384] (*1) # dm versions [ opencount flush ] [16384] (*1) # Detected dm-crypt version 1.13.0, dm-ioctl version 4.29.0. # Device-mapper backend running with UDEV support enabled. # dm status raid10-2hs-island [ opencount flush ] [16384] (*1) # File descriptor passphrase entry requested. # Trying to open key slot 0 [ACTIVE_LAST]. # Reading key slot 0 area. # Using userspace crypto wrapper to access keyslot area. # Trying to open key slot 1 [INACTIVE]. # Trying to open key slot 2 [INACTIVE]. # Trying to open key slot 3 [INACTIVE]. # Trying to open key slot 4 [INACTIVE]. # Trying to open key slot 5 [INACTIVE]. # Trying to open key slot 6 [INACTIVE]. # Trying to open key slot 7 [INACTIVE]. No key available with this passphrase. # Releasing crypt device /dev/disk/by-uuid/92de4358-d815-496a-8a58-60e55346161d context. # Releasing device-mapper backend. # Unlocking memory. Command failed with code 1: Operation not permitted ``` **cryptsetup luksDump:** ``` cryptsetup -v luksDump /dev/sdb LUKS header information for /dev/sdb Version: 1 Cipher name: aes Cipher mode: xts-plain64 Hash spec: sha1 Payload offset: 4096 MK bits: 512 MK digest: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX MK salt: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX MK iterations: 36750 UUID: ############################# Key Slot 0: ENABLED Iterations: 141435 Salt: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Key material offset: 8 AF stripes: 4000 Key Slot 1: DISABLED Key Slot 2: DISABLED Key Slot 3: DISABLED Key Slot 4: DISABLED Key Slot 5: DISABLED Key Slot 6: DISABLED Key Slot 7: DISABLED Command successful. ``` --94eb2c0d21c29a52d8054e51cc36 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hi,No key available with this passphrase.
<= br>
one of our host, running centos 7.1, crashed today with a ker= nel panic on qemu-kvm process. the VM disks were stored on encrypted volume= , which became locked after reboot. the cryptseup luksOpen =C2=A0command th= rows "No Key available with this passphrase". The encrypted volum= e has a 512 bit key without any password. we also backup our key and both b= ackup and key residing on server are same. We have tried to by pass current= OS by booting up using live CD of Centos 7.1, Linux Mint 17, Ubuntu 17.04 = with different versions of kernel and crypt setup. this did not succeed. we= believe the key is correct but the Encrypted volume is not accepting it. C= an you please help us on this. Please let me know if you need something els= e as well

* command used: cryptsetup luksOpen --ke= y-file /etc/luks.key /dev/disk/by-uuid/92de4358-d815-496a-8a58-60e55346161d= raid10-2hs-island
* Host Kernel Version: 3.10.0-229.el7.x86_64
* Host Cryptsetup version: 1.6.6

**output= of cryptsetup luksOpen**

=C2=A0**cryptsetup luksO= pen --key-file /etc/luks.key /dev/disk/by-uuid/92de4358-d815-496a-8a58-60e5= 5346161d raid10-2hs-island --verbose --debug**
```
# cr= yptsetup 1.7.2 processing "cryptsetup luksOpen --key-file /etc/luks.ke= y /dev/disk/by-uuid/92de4358-d815-496a-8a58-60e55346161d raid10-2hs-island = --verbose --debug"
# Running command open.
# Locki= ng memory.
# Installing SIGINT/SIGTERM handler.
# Unblo= cking interruption on signal.
# Allocating crypt device /dev/disk= /by-uuid/92de4358-d815-496a-8a58-60e55346161d context.
# Trying t= o open and read device /dev/disk/by-uuid/92de4358-d815-496a-8a58-60e5534616= 1d with direct-io.
# Initialising device-mapper backend library.<= /div>
# Trying to load LUKS1 crypt type from device /dev/disk/by-uuid/9= 2de4358-d815-496a-8a58-60e55346161d.
# Crypto backend (gcrypt 1.5= .3) initialized in cryptsetup library version 1.7.2.
# Detected k= ernel Linux 3.10.0-229.el7.x86_64 x86_64.
# Reading LUKS header o= f size 1024 from device /dev/disk/by-uuid/92de4358-d815-496a-8a58-60e553461= 61d
# Key length 64, device size 15622799360 sectors, header size= 4036 sectors.
# Timeout set to 0 miliseconds.
# Passwo= rd retry count set to 3.
# Password verification disabled.
<= div># Iteration time set to 2000 miliseconds.
# Password retry co= unt set to 1.
# Activating volume raid10-2hs-island [keyslot -1] = using keyfile /etc/luks.key.
# dm version =C2=A0 [ opencount flus= h ] =C2=A0 [16384] (*1)
# dm versions =C2=A0 [ opencount flush ] = =C2=A0 [16384] (*1)
# Detected dm-crypt version 1.13.0, dm-ioctl = version 4.29.0.
# Device-mapper backend running with UDEV support= enabled.
# dm status raid10-2hs-island =C2=A0[ opencount flush ]= =C2=A0 [16384] (*1)
# File descriptor passphrase entry requested= .
# Trying to open key slot 0 [ACTIVE_LAST].
# Reading = key slot 0 area.
# Using userspace crypto wrapper to access keysl= ot area.
# Trying to open key slot 1 [INACTIVE].
# Tryi= ng to open key slot 2 [INACTIVE].
# Trying to open key slot 3 [IN= ACTIVE].
# Trying to open key slot 4 [INACTIVE].
# Tryi= ng to open key slot 5 [INACTIVE].
# Trying to open key slot 6 [IN= ACTIVE].
# Trying to open key slot 7 [INACTIVE].
No key= available with this passphrase.
# Releasing crypt device /dev/di= sk/by-uuid/92de4358-d815-496a-8a58-60e55346161d context.
# Releas= ing device-mapper backend.
# Unlocking memory.
Command = failed with code 1: Operation not permitted
```

**cryptsetup luksDump:**

```
cry= ptsetup -v luksDump /dev/sdb
LUKS header information for /dev/sdb=

Version: =C2=A0 =C2=A0 =C2=A0 =C2=A01
C= ipher name: =C2=A0 =C2=A0aes
Cipher mode: =C2=A0 =C2=A0xts-plain6= 4
Hash spec: =C2=A0 =C2=A0 =C2=A0sha1
Payload offset: 4= 096
MK bits: =C2=A0 =C2=A0 =C2=A0 =C2=A0512
MK digest: = =C2=A0 =C2=A0 =C2=A0XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
MK salt: =C2=A0 =C2=A0 =C2=A0 =C2=A0XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX= XXXXXXX
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 X= XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
MK iterations: =C2= =A036750
UUID: =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 ###############= ##############

Key Slot 0: ENABLED
=C2= =A0 =C2=A0 =C2=A0 =C2=A0 Iterations: =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 141435
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Salt: =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX= XXXXXXXXXXXXX
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 XXXXXXXXXXXX= XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Key= material offset: =C2=A0 =C2=A08
=C2=A0 =C2=A0 =C2=A0 =C2=A0 AF s= tripes: =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 4000
Key Slot 1= : DISABLED
Key Slot 2: DISABLED
Key Slot 3: DISABLED
Key Slot 4: DISABLED
Key Slot 5: DISABLED
Key S= lot 6: DISABLED
Key Slot 7: DISABLED
Command successful= .
```
--94eb2c0d21c29a52d8054e51cc36--