I've followed these steps to set up an encrypted USB hard disk on Lubuntu 13.10, and these to unlock it with a keyfile instead of a passphrase. I now have a disk /dev/disk/by-uuid/32f692ec-e22c-49d3-b6cf-f90e605a5b48 which is the raw encrypted device, /dev/backup/backup which is the plaintext disk, and /mnt/backup where the filesystem is mounted. The disk is an ordinary SATA hard disk connected by a USB3 adaptor.
I have no trouble using or mounting the disk; the problem comes in trying to mount it automatically at boot. I added it to my fstab and crypttab as the article suggests:
$ cat /etc/fstab # /etc/fstab: static file system information. # # Use 'blkid' to print the universally unique identifier for a # device; this may be used with UUID= as a more robust way to name devices # that works even if disks are added and removed. See fstab(5). # # <file system> <mount point> <type> <options> <dump> <pass> /dev/mapper/sda2_crypt / ext4 errors=remount-ro 0 1 # /boot was on /dev/sda1 during installation UUID=8afa992c-9174-4a70-b9a0-1ac25b42dbaf /boot ext2 defaults 0 2 /dev/mapper/sdb2_crypt /home ext4 defaults 0 2 /dev/mapper/sdb1_crypt /var ext4 defaults 0 2 /dev/backup/backup /mnt/backup ext4 defaults 0 3 $ cat /etc/crypttab sda2_crypt UUID=6450d0e6-539b-4fa0-a9e1-f06edfbb5ba9 none luks sdb1_crypt UUID=f30e6efe-8e58-42b6-aed0-dc7999510744 /root/keyfile luks sdb2_crypt UUID=17f1f107-8f05-4dbd-8172-4d595411d874 /root/keyfile luks backup UUID=32f692ec-e22c-49d3-b6cf-f90e605a5b48 /root/keyfile luks
(Maybe "backup" is not the right name in /etc/crypttab? I don't have /dev/sda2_crypt.)
With this, it just hangs at boot saying "the disk for /mnt/backup is not ready or not present".
I figured maybe the disk isn't ready by then, so I tried mounting it in /etc/rc.local instead:
$ cat /etc/rc.local #!/bin/sh -e # # rc.local # # This script is executed at the end of each multiuser runlevel. # Make sure that the script will "exit 0" on success or any other # value on error. # # In order to enable or disable this script just change the execution # bits. # # By default this script does nothing. logger Mounting backup disk... ls -l /dev/disk/by-uuid/ > /home/rena/disk-uuid.txt stat /root/keyfile >> /home/rena/disk-uuid.txt whoami >> /home/rena/disk-uuid.txt cryptsetup --verbose --key-file=/root/keyfile luksOpen /dev/disk/by-uuid/32f692ec-e22c-49d3-b6cf-f90e605a5b48 backup logger Unlocked OK. mount /dev/backup/backup /mnt/backup/ logger Mounted OK. exit 0
I can see from the syslog output that it unlocks OK, but never mounts. It appears the whole rc.local script just died when it reaches that line. I can also see from the ls, stat and whoami that the disk is indeed present in the listing, the keyfile is accessible, and the script is running as root. So I don't know why mounting would fail.
The strangest part is if I remove all of this from rc,local, and just enter the commands in a terminal after bootup:
sudo cryptsetup --verbose --key-file=/root/keyfile luksOpen /dev/disk/by-uuid/32f692ec-e22c-49d3-b6cf-f90e605a5b48 backup sudo mount /dev/backup/backup /mnt/backup/
It mounts fine. So why does it fail in rc.local and in fstab/crypttab?