Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've followed these steps to set up an encrypted USB hard disk on Lubuntu 13.10, and these to unlock it with a keyfile instead of a passphrase. I now have a disk /dev/disk/by-uuid/32f692ec-e22c-49d3-b6cf-f90e605a5b48 which is the raw encrypted device, /dev/backup/backup which is the plaintext disk, and /mnt/backup where the filesystem is mounted. The disk is an ordinary SATA hard disk connected by a USB3 adaptor.

I have no trouble using or mounting the disk; the problem comes in trying to mount it automatically at boot. I added it to my fstab and crypttab as the article suggests:

$ cat /etc/fstab
# /etc/fstab: static file system information.
#
# Use 'blkid' to print the universally unique identifier for a
# device; this may be used with UUID= as a more robust way to name devices
# that works even if disks are added and removed. See fstab(5).
#
# <file system> <mount point>   <type>  <options>       <dump>  <pass>
/dev/mapper/sda2_crypt /               ext4    errors=remount-ro 0       1
# /boot was on /dev/sda1 during installation
UUID=8afa992c-9174-4a70-b9a0-1ac25b42dbaf /boot           ext2    defaults        0       2
/dev/mapper/sdb2_crypt /home           ext4    defaults        0       2
/dev/mapper/sdb1_crypt /var            ext4    defaults        0       2
/dev/backup/backup     /mnt/backup     ext4    defaults        0       3

$ cat /etc/crypttab
sda2_crypt UUID=6450d0e6-539b-4fa0-a9e1-f06edfbb5ba9 none luks
sdb1_crypt UUID=f30e6efe-8e58-42b6-aed0-dc7999510744 /root/keyfile luks
sdb2_crypt UUID=17f1f107-8f05-4dbd-8172-4d595411d874 /root/keyfile luks
backup     UUID=32f692ec-e22c-49d3-b6cf-f90e605a5b48 /root/keyfile luks

(Maybe "backup" is not the right name in /etc/crypttab? I don't have /dev/sda2_crypt.)

With this, it just hangs at boot saying "the disk for /mnt/backup is not ready or not present".

I figured maybe the disk isn't ready by then, so I tried mounting it in /etc/rc.local instead:

$ cat /etc/rc.local 
#!/bin/sh -e
#
# rc.local
#
# This script is executed at the end of each multiuser runlevel.
# Make sure that the script will "exit 0" on success or any other
# value on error.
#
# In order to enable or disable this script just change the execution
# bits.
#
# By default this script does nothing.

logger Mounting backup disk...
ls -l /dev/disk/by-uuid/ > /home/rena/disk-uuid.txt
stat /root/keyfile >> /home/rena/disk-uuid.txt
whoami >> /home/rena/disk-uuid.txt
cryptsetup --verbose --key-file=/root/keyfile luksOpen /dev/disk/by-uuid/32f692ec-e22c-49d3-b6cf-f90e605a5b48 backup
logger Unlocked OK.
mount /dev/backup/backup /mnt/backup/
logger Mounted OK.

exit 0

I can see from the syslog output that it unlocks OK, but never mounts. It appears the whole rc.local script just died when it reaches that line. I can also see from the ls, stat and whoami that the disk is indeed present in the listing, the keyfile is accessible, and the script is running as root. So I don't know why mounting would fail.

The strangest part is if I remove all of this from rc,local, and just enter the commands in a terminal after bootup:

sudo cryptsetup --verbose --key-file=/root/keyfile luksOpen /dev/disk/by-uuid/32f692ec-e22c-49d3-b6cf-f90e605a5b48 backup
sudo mount /dev/backup/backup /mnt/backup/

It mounts fine. So why does it fail in rc.local and in fstab/crypttab?

share|improve this question
    
I wonder if "/bin" is absent from the path where the script is running. Maybe try /bin/mount .... rather then just "mount" – davidgo Dec 8 '13 at 7:26
    
Just wondering: doesn't mounting it automatically at boot with a cryptographic key kind of defeats the whole purpose of having an encrypted disk? Aren't you, so to say, just offering it on a silver platter to an intruder? – MariusMatutiae Dec 8 '13 at 7:28
    
@davidgo: "ls" works, though. – Rena Dec 8 '13 at 12:45
    
@MariusMatutiae: the keyfile is stored on a partition which itself is encrypted. I still have to enter the passphrase at bootup (but only once). – Rena Dec 8 '13 at 12:46
    
Ok, makes sense. Did you follow @davidgo's suggestion? It seems an excellent suggestion to me. – MariusMatutiae Dec 8 '13 at 14:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.