7

I have an old desktop computer that I want to start using as a headless server.

With a monitor and a screen attached, I installed Ubuntu Server edition with encrypted LVM on the machine. After installation I rebooted and, still with the monitor and keyboard attached, filled out the passphrase and was able to login. I was able to login to the server from my laptop. So far so good.

Then I disconnected the monitor and keyboard and rebooted the desktop remotely over ssh from the laptop. Upon rebooting I heard two beeps. When I tried to login again via ssh I got the message:

$ ssh plectrophenax.local

ssh: Could not resolve hostname plectrophenax.local: Name or service not known

When I reattached the monitor to the server, I saw the message

Grub loading

Unlocking the disk /dev/disk/by-uuid/de99e2c0-56d7-473b-f134FF5bd634 (sda1_crypt)

Enter passphrase:

So apparently it was waiting for me to enter my passphrase before it would boot up.

So how do I enter this passphrase remotely?

5 Answers 5

6

You can do so by installing an SSH server into your initramfs. One easy possibility is to use early-ssh. It installs a Dropbear SSH server right into your initramfs. With that server running you can log into your server before the root fs mount and enter the LUKS password.

5

You can't. The passphrase is here precisely to make it impossible.

4
  • 1
    Makes me wonder why they offerd encryption during the installation process if I can't use it. Anyway, how do I remove the encryption so that I can login remotely?
    – BioGeek
    Dec 21, 2009 at 12:41
  • 1
    You can use it. It's meant to be used this way. What is the point of having disk encryption if it is automatically decrypted without any sort of user secret?
    – sybreon
    Dec 21, 2009 at 13:49
  • Encryption is a tool, it's up to you knowing why and when to use it. However, you can unlock the encrypted device, copy its content elsewhere, then reformat the device and copy back. AFAIK this is the only option.
    – wazoox
    Dec 21, 2009 at 22:52
  • 2
    Actually, its possible. Dec 22, 2009 at 22:44
4

You shouldn't have your OS to boot on an encrypted partion. Just encrypt /home, /var/www or whatever else. Make sure you can login as root if you've encrypted /home.

To easily mount your partition but only after boot, add "noauto" to its fstab line in the options column, eg.

/dev/sda2 /home ext3 defaults,noauto 1 1 

Alternatively, if you want to whole server to be on encrypted partion, you could virtualize it with openvz or kvm, and then mount manually the partition, and finally starting the virtual server.

Not so good for uptime though. Why do you want to encrypt a server partition?

3

Well, this question is quite old, but since many others like myself could be still now looking for a good solution to this same problem, here there are 2 of the best ones I've managed to found so far (after spending lots of hours trying out multiple impossible configurations ¬¬):

https://stinkyparkia.wordpress.com/2014/10/14/remote-unlocking-luks-encrypted-lvm-using-dropbear-ssh-in-ubuntu-server-14-04-1-with-static-ipst/

https://github.com/chadoe/luks-triple-unlock/blob/master/install.sh

After configuring the servers that way, one can decrypt the LUKS partition via SSH (using password or rsa-key) or an USB flash drive and let the system boot as usual. Quite useful in my case.

1

You could modify initramfs so it enter the password itself. Like wazoox and sybreon said, this goes against the goal of encrypting the partition.

But if that is what you want, look at the 2nd post here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .