[dm-crypt] luks header on initramfs img

[dm-crypt] luks header on initramfs img

[Henrique Abreu]

[-- Attachment #1: Type: text/plain, Size: 909 bytes --]

I use to have a setup with luks header on a separate file, as describe here:
https://wiki.archlinux.org/index.php/Dm-crypt/Specialties#Encrypted_system_using_a_remote_LUKS_header

But since update from 1.6.4 to 1.6.5 it doesn't work anymore. It just keeps
asking for the passphrase on and on without any error messages.

I noticed that, if I mount a usb drive and move the header from memory to
the drive, then attempt to open again with the exact same command (below)
it works:
# cryptsetup open --header header.img --type luks /dev/sda4 lvm

So, the difference is just where the header.img file is placed. For now, I
have downgraded back to 1.6.4 to keep my boot setup simpler.
I rather use the header image inside initramfs if possible instead of
having to mount a usb at boot just to read the header.

Does anyone know if that's intended for not working anymore or if it's a
bug?

Thanks,

Henrique Abreu

[-- Attachment #2: Type: text/html, Size: 1267 bytes --]

Re: [dm-crypt] luks header on initramfs img

[Milan Broz]

On 08/07/2014 03:09 AM, Henrique Abreu wrote:
> I use to have a setup with luks header on a separate file, as describe here:
> https://wiki.archlinux.org/index.php/Dm-crypt/Specialties#Encrypted_system_using_a_remote_LUKS_header
> 
> But since update from 1.6.4 to 1.6.5 it doesn't work anymore. It just keeps asking for the passphrase on and on without any error messages.
> 
> I noticed that, if I mount a usb drive and move the header from memory to the drive, then attempt to open again with the exact same command (below) it works:
> # cryptsetup open --header header.img --type luks /dev/sda4 lvm
> 
> So, the difference is just where the header.img file is placed. For now, I have downgraded back to 1.6.4 to keep my boot setup simpler.
> I rather use the header image inside initramfs if possible instead of having to mount a usb at boot just to read the header.
> 
> Does anyone know if that's intended for not working anymore or if it's a bug?

There is no reason this should not work.
(It could be bug elsewhere as well, 1.6.5 already uncovered 2 kernel bugs...)

Can you paste debug output from the failing command?
(Add --debug option.)

Thanks,
Milan

Re: [dm-crypt] luks header on initramfs img

[Milan Broz]

On 08/07/2014 06:16 AM, Milan Broz wrote:
> On 08/07/2014 03:09 AM, Henrique Abreu wrote:
>> I use to have a setup with luks header on a separate file, as describe here:
>> https://wiki.archlinux.org/index.php/Dm-crypt/Specialties#Encrypted_system_using_a_remote_LUKS_header
>>
>> But since update from 1.6.4 to 1.6.5 it doesn't work anymore. It just keeps asking for the passphrase on and on without any error messages.
>>
>> I noticed that, if I mount a usb drive and move the header from memory to the drive, then attempt to open again with the exact same command (below) it works:
>> # cryptsetup open --header header.img --type luks /dev/sda4 lvm
>>
>> So, the difference is just where the header.img file is placed. For now, I have downgraded back to 1.6.4 to keep my boot setup simpler.
>> I rather use the header image inside initramfs if possible instead of having to mount a usb at boot just to read the header.
>>
>> Does anyone know if that's intended for not working anymore or if it's a bug?
> 
> There is no reason this should not work.
> (It could be bug elsewhere as well, 1.6.5 already uncovered 2 kernel bugs...)

Should be fixed in devel git (and in 1.6.6 which will be released in a few days).
(Basically I forgot to use wrapper for device open which avoids using O_DIRECT
if not supported, like in tmpfs.)

Thanks for report!

Milan

Re: [dm-crypt] luks header on initramfs img

[Henrique Abreu]

[-- Attachment #1: Type: text/plain, Size: 1637 bytes --]

Thanks a lot Milan and sorry I hadn't had time to sent you the debug output.

Looking forward to version 1.6.6

Thanks,

Henrique Abreu


On Fri, Aug 8, 2014 at 10:22 AM, Milan Broz <gmazyland@gmail.com> wrote:

> On 08/07/2014 06:16 AM, Milan Broz wrote:
> > On 08/07/2014 03:09 AM, Henrique Abreu wrote:
> >> I use to have a setup with luks header on a separate file, as describe
> here:
> >>
> https://wiki.archlinux.org/index.php/Dm-crypt/Specialties#Encrypted_system_using_a_remote_LUKS_header
> >>
> >> But since update from 1.6.4 to 1.6.5 it doesn't work anymore. It just
> keeps asking for the passphrase on and on without any error messages.
> >>
> >> I noticed that, if I mount a usb drive and move the header from memory
> to the drive, then attempt to open again with the exact same command
> (below) it works:
> >> # cryptsetup open --header header.img --type luks /dev/sda4 lvm
> >>
> >> So, the difference is just where the header.img file is placed. For
> now, I have downgraded back to 1.6.4 to keep my boot setup simpler.
> >> I rather use the header image inside initramfs if possible instead of
> having to mount a usb at boot just to read the header.
> >>
> >> Does anyone know if that's intended for not working anymore or if it's
> a bug?
> >
> > There is no reason this should not work.
> > (It could be bug elsewhere as well, 1.6.5 already uncovered 2 kernel
> bugs...)
>
> Should be fixed in devel git (and in 1.6.6 which will be released in a few
> days).
> (Basically I forgot to use wrapper for device open which avoids using
> O_DIRECT
> if not supported, like in tmpfs.)
>
> Thanks for report!
>
> Milan
>

[-- Attachment #2: Type: text/html, Size: 2412 bytes --]