Automatically decrypt multiple LUKS-encrypted volumes

Posted on 2020-08-27 by Earl C. Ruby III

I’ve written in the past on Adding an external encrypted drive with LVM to Ubuntu Linux and Adding a LUKS-encrypted iSCSI volume to Synology DS414 NAS but I neglected to mention how to automatically decrypt additional volumes.

When installing a fresh copy of Ubuntu one of the options is to install with a LUKS-encrypted Logical Volume Manager Volume Group (LVM VG). This puts your root volume on the encrypted LVM VG. When you power up your machine Ubuntu prompts you to enter the decryption passphrase in order to decrypt the VG and start your computer. Without the passphrase the contents of your hard drive are unreadable.

If you add encrypted external drives and/or additional VGs you will end up with multiple encrypted volumes. Ubuntu will prompt you for the passphrase of each additional encrypted volume when you boot up the machine.

If you don’t want to enter multiple, different passphrases each time you boot, you can store the passphrases for additional volumes on the encrypted root filesystem of your first drive using the /etc/crypttab file. You’ll just be prompted for one passphrase, of the first VG, and that decrypts the passphrases needed to decrypt the additional volumes.

Here’s how it works.

The /etc/crypttab file contains 4 fields per line: the name of the encrypted volume, a UUID identifying the storage device, the name of a file with the decryption passphrase, and encryption options.

nvme0n1p5   UUID=405d8c73-1cf9-4b2c-9b8e-c76b90d27c67 none                        luks,discard
datastorage UUID=f2d73ac8-1ef1-4735-9dd4-9e778fc9e781 /root/.luks-datastorage     luks,discard
external1   UUID=0140476b-dd0b-4aab-b7d4-2f5fa14d1a0c /root/.luks-backupexternal1 luks
external2   UUID=610a67d4-c4f6-4b73-a824-a437971e8d24 /root/.luks-backupexternal2 luks
iscsi       UUID=b106b749-f4ab-44be-8962-6ff867dc074e /root/.luks-backupiscsi     luks

The first volume, nvme0n1p5, is the encrypted boot volume. It contains the root filesystem and the /root home directory. The third field is “none” which means that Ubuntu will prompt you for a decryption passphrase in order to unlock and decrypt the drive.

The remaining volumes have files defined that contain the decryption passphrase for each volume. Those files are hidden files in the /root home directory. Once the nvme0n1p5 volume is decrypted and mounted, the remaining volumes are automatically decrypted using the passphrases stored in the hidden files.

The end result is that all of your drives are encrypted, but you only have to enter one passphrase to unlock all of your drives.

Hope you find this useful.

Adding a LUKS-encrypted iSCSI volume to Synology DS414 NAS and Ubuntu 15.04

Posted on 2015-08-23 by Earl C. Ruby III

I have an Ubuntu 15.04 “Vivid” workstation already set up with LUKS full disk encryption, and I have a Synology DS414 NAS with 12TB raw storage on my home network. I wanted to add a disk volume on the Synology DS414 that I could mount on the Ubuntu server, but NFS doesn’t support “at rest” encrypted file systems, and using EncFS over NFS seemed like the wrong way to go about it, so I decided to try setting up an iSCSI volume and encrypting it with LUKS. Using this type of setup, all data is encrypted both “on the wire” and “at rest”.

Log into the Synology Admin Panel and select Main Menu > Storage Manager:

Add an iSCSI LUN
- Set Thin Provisioning = No
- Advanced LUN Features = No
- Make the volume as big as you need
Add an iSCSI Target
- Use CHAP authentication
- Write down the login name and password you choose

On your Ubuntu box switch over to a root prompt:

sudo /bin/bash

Install the open-iscsi drivers. (Since I’m already running LUKS on my Ubuntu box I don’t need to install LUKS.)

apt-get install open-iscsi

Edit the conf file

vi /etc/iscsi/iscsid.conf

Edit these lines:

node.startup = automatic
node.session.auth.username = [CHAP user name on Synology box]
node.session.auth.password = [CHAP password on Synology box]

Restart the open-iscsi service:

service open-iscsi restart
service open-iscsi status

Start open-iscsi at boot time:

systemctl enable open-iscsi

Now find the name of the iSCSI target on the Synology box:

iscsiadm -m discovery -t st -p $SYNOLOGY_IP
iscsiadm -m node

The target name should look something like “iqn.2000-01.com.synology:boxname.target-1.62332311”

Still on the Ubuntu workstation, log into the iSCSI target:

iscsiadm -m node --targetname "$TARGET_NAME" --portal "$SYNOLOGY_IP:3260" --login

Look for new devices:

fdisk -l

At this point fdisk should show you a new block device which is the iSCSI disk volume on the Synology box. In my case it was /dev/sdd.

Partition the device. I made one big /dev/sdd1 partition, type 8e (Linux LVM):

fdisk /dev/sdd

Set up the device as a LUKS-encrypted device:

cryptsetup --verbose --verify-passphrase luksFormat /dev/sdd1

Open the LUKS volume:

cryptsetup luksOpen /dev/sdd1 backupiscsi

Create a physical volume from the LUKS volume:

pvcreate /dev/mapper/backupiscsi

Add that to a new volume group:

vgcreate ibackup /dev/mapper/backupiscsi

Create a logical volume within the volume group:

lvcreate -L 1800GB -n backupvol /dev/ibackup

Put a file system on the logical volume:

mkfs.ext4 /dev/ibackup/backupvol

Add the logical volume to /etc/fstab to mount it on startup:

# Synology iSCSI target LUN-1
/dev/ibackup/backupvol /mnt/backup ext4 defaults,nofail,nobootwait 0 6

Get the UUID of the iSCSI drive:

ls -l /dev/disk/by-uuid | grep sdd1

Add the UUID to /etc/crypttab to be automatically prompted for the decrypt passphrase when you boot up Ubuntu:

backupiscsi UUID=693568ca-9334-4c19-8b01-881f2247ae0d none luks

If you found this interesting, you might want to check out my article Adding an external encrypted drive with LVM to Ubuntu Linux.

Hope you found this useful.

Adding an external encrypted drive with LVM to Ubuntu Linux

Posted on 2010-02-10 by Earl C. Ruby III

I recently added an external eSATA drive to my home computer so I could back up critical data from my home network to one drive. I bought a Western Digital 1TB “green” drive and a Thermaltake external hard drive enclosure with eSATA and USB connectors.

Since my internal hard drives are encrypted it didn’t make sense to back up all of that data to an unencrypted external drive. I’d read Uwe Hermann’s excellent how-to article on disk encryption, but he didn’t cover setting up an LVM partition, which I always use so I can change drive volume sizes on the fly.

This is what I did to set up an external encrypted drive with LVM on an Ubuntu system:

Open a terminal
Get a root prompt:
```
sudo /bin/bash
```
Watch the system log:
```
tail -f /var/log/messages
```
Attach the external drive. The system log tells me that it was detected as /dev/sdc.
Check the drive for bad blocks (takes a couple of hours):
```
badblocks -c 10240 -s -w -t random -v /dev/sdc
```
Write random data to the entire drive. This step takes all night, but it ensures that never-written drive space can’t be differentiated from encrypted data if someone ever tries to crack the drive. (If you’re going to do this, you might as well do it right.)
```
shred -v -n 1 /dev/sdc
```

Create one big LVM partition on the drive using fdisk. Set up one big primary partition /dev/sdc1, set the tag to system id “8e” LVM, and write the changes to disk:

> fdisk /dev/sdc                                                                                                                                              
Device contains neither a valid DOS partition table, nor Sun, SGI or OSF disklabel                                                                                                  
Building a new DOS disklabel with disk identifier 0xa6846916.                                                                                                                       
Changes will remain in memory only, until you decide to write them.                                                                                                                 
After that, of course, the previous content won't be recoverable.                                                                                                                   


The number of cylinders for this disk is set to 121575.
There is nothing wrong with that, but this is larger than 1024,
and could in certain setups cause problems with:               
1) software that runs at boot time (e.g., old versions of LILO)
2) booting and partitioning software from other OSs                                                                                                                                 
   (e.g., DOS FDISK, OS/2 FDISK)                                                                                                                                                    
Warning: invalid flag 0x0000 of partition table 4 will be corrected by w(rite)                                                                                                      
                                                                                                                                                                                    
Command (m for help): p                                                                                                                                            
                                                                                                                                                                                    
Disk /dev/sdc: 999.9 GB, 999989182464 bytes                                                                                                                                         
255 heads, 63 sectors/track, 121575 cylinders                                                                                                                                       
Units = cylinders of 16065 * 512 = 8225280 bytes                                                                                                                                    
Disk identifier: 0xa6846916                                                                                                                                                         
                                                                                                                                                                                    
   Device Boot      Start         End      Blocks   Id  System                                                                                                                      
                                                                                                                                                                                    
Command (m for help): n                                                                                                                                            
Command action                                                                                                                                                                      
   e   extended                                                                                                                                                                     
   p   primary partition (1-4)                                                                                                                                                      
p                                                                                                                                                                  
Partition number (1-4): 1                                                                                                                                          
First cylinder (1-121575, default 1): [ENTER]                                                                                                                      
Using default value 1
Last cylinder, +cylinders or +size{K,M,G} (1-121575, default 121575): [ENTER]
Using default value 121575

Command (m for help): t
Selected partition 1
Hex code (type L to list codes): 8e
Changed system type of partition 1 to 8e (Linux LVM)

Command (m for help): p

Disk /dev/sdc: 999.9 GB, 999989182464 bytes
255 heads, 63 sectors/track, 121575 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0xa6846916

   Device Boot      Start         End      Blocks   Id  System
/dev/sdc1               1      121575   976551156   8e  Linux LVM

Command (m for help): w
The partition table has been altered!

Calling ioctl() to re-read partition table.
Syncing disks.

Use cryptsetup to encrypt the drive:

cryptsetup --verbose --verify-passphrase luksFormat /dev/sdc1

Unlock the drive:

cryptsetup luksOpen /dev/sdc1 backupexternal

Create the LVM physical volume:
```
pvcreate /dev/mapper/backupexternal
```

Create the LVM volume group:

vgcreate xbackup /dev/mapper/backupexternal

Create a logical volume within the volume group:
```
lvcreate -L 500G -n backupvol /dev/xbackup
```
At this point you have a device named /dev/xbackup/backupvol, so create a filesystem on the logical volume:
```
mkfs.ext4 /dev/xbackup/backupvol
```

Mount the volume:

mount /dev/xbackup/backupvol /mnt/backup

To get the volume to mount automatically at boot time add this line to your /etc/fstab file:
```
/dev/xbackup/backupvol      /mnt/backup     ext4    defaults        0 5
```
To be prompted for the decryption key / passphrase at boot time first get the drive’s UUID:
```
ls -l /dev/disk/by-uuid
```
(In my example I use the UUID for /dev/sdc1)

Then add this line to the /etc/crypttab file:

backupexternal UUID=[the UUID of the drive] none luks

That’s it. You now have an external, encrypted hard drive with LVM installed. You’ve created one 500GB volume that uses half the disk, leaving 500GB free for other volumes, or for expanding the first volume.

Hope you find this useful.