[SOLVED] FULL disk encryption on Slackware - avoid having to type password twice

dosensuppe · 04-15-2023, 02:44 AM

Quote:

LuckyCyborg=how about to take this porting of mkinitcpio to Slackware as your pet project?

That sounds indeed like an interesting project. But I only have rudimentary programming experience. How to tackle this is beyond me.

LuckyCyborg · 04-15-2023, 04:18 AM

Quote:

Originally Posted by dosensuppe

That sounds indeed like an interesting project. But I only have rudimentary programming experience. How to tackle this is beyond me.

The mkinitcpio is basically a set of bash scripts.

And with all respect, I believe that someone using Slackware without speaking Bash is like moving in Germany without knowing the German language. What could go wrong?

henca · 04-15-2023, 05:07 AM

Quote:

Originally Posted by dosensuppe

I also don't know if something similar could be done with UEFI? Couldn't you install malicious software in the ESP partition as well?

An UEFI capable BIOS is rather powerful and understand things like a file system. It is capable of hosting both malware and bloatware in the BIOS itself, so I would not only worry about the disk contents.

regards Henrik

dosensuppe · 04-15-2023, 08:37 AM

Quote:

Originally Posted by Didier Spaier

Not needed.

Yes, according to this.

This is not working out for me, for some reason. I created a config file according to the instructions in the link:

Quote:

If you have any luks encrypted filesystems you must create a dracut drop-in config for that. Create the file /etc/dracut.conf.d/encryption.conf with the following content:

install_items+=" /etc/crypttab /crypto_keyfile.bin "

If you have an encrypted swap partition you must also add a line that looks like this to the encryption.conf file created above:

add_device+=" /dev/disk/by-uuid/ad44a367-09ec-4f74-bf66-f284438280db "

Indeed crypto_keyfile.bin shows up in the image and manually decrypting the partition using that file also works, but it doesn't want to auto encrypt and always ends up in that rescue mode, trying to boot the system.
Am I missing something here?

dosensuppe · 04-15-2023, 12:04 PM

Quote:

Originally Posted by LuckyCyborg

The mkinitcpio is basically a set of bash scripts.

And with all respect, I believe that someone using Slackware without speaking Bash is like moving in Germany without knowing the German language. What could go wrong?

Yes. You're right. I have done a bit of scripting before, but for now I just want a working laptop as I replaced the drive and am directly installing it on hardware now.
I'll try getting mkinitcpio running in a virtual machine later. Mark my words. Indeed it could be a great learning experience.

dosensuppe · 04-15-2023, 12:12 PM

Quote:

Didier Spaier

I also tried doing it via the kernel options according to these docs: https://www.mankier.com/7/dracut.cmd...ption-Standard
Created a file called /etc/dracut.conf.d/cmdline.conf :

Code:

kernel_cmdline="rd.luks.uuid=xxxxx(Blockdevice UUID)
root=UUID=xxxx(ROOT mapper device) 
rd.luks.allow-discards 
rootfstype=btrfs
rd.luks.key=/crypto_keyfile.bin:UUID=xxxxx(ROOT mapper-device)"

Still no luck

dosensuppe · 04-15-2023, 01:02 PM

Ok. I'm retarded. I forgot to edit the crypttab file. Anyways. Put something like that in there:

Code:

cryptroot      /dev/disk/by-uuid/xxxxx /crypto_keyfile.bin  luks

With mkinitcpio you somehow don't have to use crypttab. I forgot why or I never knew in the first place??
So to make it a bit more coherent.
First edit crypttab to include the root to encrypt, then add kernel options like mentioned before, listing the root drives to be encrypted, create a seperate config file containing this line:

Code:

install_items+=" /etc/crypttab /crypto_keyfile.bin "

and finally generate the image.
Well, that should be it.
Which one is the superior initramfs gen tool is up to personal preference I guess. I guess Dracut might be a bit more true to the Unix philosophy, being very modular.

If someone knows how mkinicpio manages to do without crypttab, please let me know.

sstm · 04-15-2023, 01:49 PM

It's all in the scripts. Open up the init file within those images - it's "just some shell script using some variables to run some commands based on your input". In case of an initrd or initramfs it's a shell script that reads files in the root of the image (/) like 'luksdev' and others.

dosensuppe · 04-15-2023, 03:38 PM

I can't get hibernation to work.
SWAP automatically mounts like I configured it to, but it won't hibernate.
I set

Code:

resume=UUID=xxx(encrypted blockdevice)

for both grub and dracut cmdoptions.
The menus don't even show up in KDE and XFCE. The command suggested in the wiki doesn't work.
UPower:

Code:

dbus-send --system --print-reply --dest="org.freedesktop.UPower" \
/org/freedesktop/UPower org.freedesktop.UPower.Hibernate

sstm · 04-15-2023, 04:02 PM

Quote:

Originally Posted by dosensuppe

I can't get hibernation to work.
SWAP automatically mounts like I configured it to, but it won't hibernate.
I set

Code:

resume=xxx(encrypted blockdevice)

for both grub and dracut cmdoptions.
The menus don't even show up in KDE and XFCE. The command suggested in the wiki doesn't work.
UPower:

Code:

dbus-send --system --print-reply --dest="org.freedesktop.UPower" \
/org/freedesktop/UPower org.freedesktop.UPower.Hibernate

Aha - well, a few questions - apologies if you've checked all of these before:

- Is your swap active? (the 'free' command should yield a line that starts with 'Swap:' - or use 'swapon -s')
- The partition you point to with resume=xxx should be the one that holds your swap - is it the right one?. (i.e. is your swap in lvm? then it needs to point to /dev/myvg/myswap where myvg and myswap being volume group name and swap partition name; if no lvm, it should be something like /dev/sda2 or /dev/nvme0p2 or whatever)
- You can extract the initrd file (zcat initrd | cpio -idmv) (best done in some tempdir) and look at whether or not it knows where to mount which swap partition or drive. (i.e. aside from mkinitrd and whatever else generates an initrd or initramfs image; look at what is actually generated as opposed to 'what the config files say will be generated')

dosensuppe · 04-15-2023, 04:20 PM

Quote:

Originally Posted by sstm

Aha - well, a few questions - apologies if you've checked all of these before:

- Is your swap active? (the 'free' command should yield a line that starts with 'Swap:' - or use 'swapon -s')
- The partition you point to with resume=xxx should be the one that holds your swap - is it the right one?. (i.e. is your swap in lvm? then it needs to point to /dev/myvg/myswap where myvg and myswap being volume group name and swap partition name; if no lvm, it should be something like /dev/sda2 or /dev/nvme0p2 or whatever)
- You can extract the initrd file (zcat initrd | cpio -idmv) (best done in some tempdir) and look at whether or not it knows where to mount which swap partition or drive. (i.e. aside from mkinitrd and whatever else generates an initrd or initramfs image; look at what is actually generated as opposed to 'what the config files say will be generated')

Well, I'm using btrfs, so lvm would be a bit too many layers of abstraction. So I have an encrypted SWAP.
But you mentioning lvm volumes led me on the right track. The resume= paramater has to point to the decrypted partition, not the block device. I made this issue before during my Artix install. Good thing I always take thorough notes.
As the documentation for Dracut is a bit lacking, I'll upload the configs tomorrow. Maybe someone can profit from it and not waste as much time fooling around as me.

dosensuppe · 04-16-2023, 01:15 AM

SOLUTION: HERE'S HOW I GOT SLACKWARE FDE WORKING WITH DRACUT

generate keyfile
dd bs=512 count=4 if=/dev/urandom of=/crypto_keyfile.luks
chmod 000 /crypto_keyfile.luks
add key to encrypted root partition
cryptsetup luksAddKey /dev/sda1 /crypto_keyfile.luks
add key to encrypted swap partition
cryptsetup luksAddKey /dev/sda2 /crypto_keyfile.luks

install Dracut
ftp://slackware.uk/slint/x86_64/slin...source/dracut/

lsblk -o FSTYPE,SIZE,LABEL

/etc/dracut.conf.d/ | https://www.mankier.com/7/dracut.cmd...on-crypto_LUKS

cmdline.conf (kernel options - propably some reduntant options that don't need to be specified, but for some reason the luks.uuid definetely NEEDS to be set for the INITRAMFS to find the drive. Why, with grub already having those set, it still needs to be specified, is beyond me.)
kernel_cmdline="
rd.luks.uuid=xxxxx(Blockdevice von ROOT)
rd.luks.uuid=xxxxx(Blockdevice von SWAP)
resume=UUID=xxxxx(Mapper device von entschlüssltem SWAP)
root=UUID=xxxxxx(Mapper device von entschlüssltem ROOT)
rd.luks.allow-discards
rootfstype=btrfs "

include-elements.conf
install_items+=" /etc/crypttab /crypto_keyfile.bin "
add_dracutmodules+=" btrfs crypt dm "
omit_dracutmodules+=" network cifs nfs brltty "
compress="zstd"

CRYPTTAB
/etc/crypttab
cryptroot /dev/disk/by-uuid/xxxxx(Blockdevice) /crypto_keyfile.bin luks
cryptswap /dev/disk/by-uuid/xxxx(Blockdevice) /crypto_keyfile.bin luks

dracut -f --regenerate-all

GRUB
/etc/default/grub
GRUB_CMDLINE_LINUX="cryptdevice=UUID=uuid_von_root(Blockdevice):cryptroot resume=UUID=uuid_von_swap(entschlüsseltes Mapper device)"
GRUB_ENABLE_CRYPTODISK=y

grub-install --target=i386-pc /dev/sda
grub-mkconfig -o /boot/grub/grub.cfg

dosensuppe · 04-16-2023, 01:20 AM

Sure, some things are propably redundant. But I'll leave it at that.
Don't know why I had to define the kernel options twice.
Without specifying the block UUIDs of both to be encrypted disks in cmdline.conf it just wouldn't boot.
Usually the grub kernel options should suffice.

dosensuppe · 04-16-2023, 02:11 AM

Just one question: I have read that dracut automatically includes the microcode inside the initramfs. Will it suffice if I just install the intel microcode slackbuild and dracut will do the rest?

dosensuppe · 04-20-2023, 03:31 PM

UPDATE:
Unfortunate for us, using an encrypted boot:
https://mjg59.dreamwidth.org/

Quote:

if you're using an encrypted /boot, stop (proceeding with the header conversion) now - very recent versions of grub2 support LUKS2, but they don't support argon2id, and this will render your system unbootable.

Unfortunately having an unencrypted boot also poses a risk to tampering with our system. One has to wager what is more important to ones security.

Let's hope grub2 will support argon2 anytime soon. Fortunately LUKS headers can be easily converted as is the topic of the article. Thanks to Didier Spaier for mentioning that.