Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've followed these steps to set up an encrypted USB hard disk on Lubuntu 13.10, and these to unlock it with a keyfile instead of a passphrase. I now have a disk /dev/disk/by-uuid/32f692ec-e22c-49d3-b6cf-f90e605a5b48 which is the raw encrypted device, /dev/backup/backup which is the plaintext disk, and /mnt/backup where the filesystem is mounted. The disk is an ordinary SATA hard disk connected by a USB3 adaptor.

I have no trouble using or mounting the disk; the problem comes in trying to mount it automatically at boot. I added it to my fstab and crypttab as the article suggests:

$ cat /etc/fstab
# /etc/fstab: static file system information.
#
# Use 'blkid' to print the universally unique identifier for a
# device; this may be used with UUID= as a more robust way to name devices
# that works even if disks are added and removed. See fstab(5).
#
# <file system> <mount point>   <type>  <options>       <dump>  <pass>
/dev/mapper/sda2_crypt /               ext4    errors=remount-ro 0       1
# /boot was on /dev/sda1 during installation
UUID=8afa992c-9174-4a70-b9a0-1ac25b42dbaf /boot           ext2    defaults        0       2
/dev/mapper/sdb2_crypt /home           ext4    defaults        0       2
/dev/mapper/sdb1_crypt /var            ext4    defaults        0       2
/dev/backup/backup     /mnt/backup     ext4    defaults        0       3

$ cat /etc/crypttab
sda2_crypt UUID=6450d0e6-539b-4fa0-a9e1-f06edfbb5ba9 none luks
sdb1_crypt UUID=f30e6efe-8e58-42b6-aed0-dc7999510744 /root/keyfile luks
sdb2_crypt UUID=17f1f107-8f05-4dbd-8172-4d595411d874 /root/keyfile luks
backup     UUID=32f692ec-e22c-49d3-b6cf-f90e605a5b48 /root/keyfile luks

(Maybe "backup" is not the right name in /etc/crypttab? I don't have /dev/sda2_crypt.)

With this, it just hangs at boot saying "the disk for /mnt/backup is not ready or not present".

I figured maybe the disk isn't ready by then, so I tried mounting it in /etc/rc.local instead:

$ cat /etc/rc.local 
#!/bin/sh -e
#
# rc.local
#
# This script is executed at the end of each multiuser runlevel.
# Make sure that the script will "exit 0" on success or any other
# value on error.
#
# In order to enable or disable this script just change the execution
# bits.
#
# By default this script does nothing.

logger Mounting backup disk...
ls -l /dev/disk/by-uuid/ > /home/rena/disk-uuid.txt
stat /root/keyfile >> /home/rena/disk-uuid.txt
whoami >> /home/rena/disk-uuid.txt
cryptsetup --verbose --key-file=/root/keyfile luksOpen /dev/disk/by-uuid/32f692ec-e22c-49d3-b6cf-f90e605a5b48 backup
logger Unlocked OK.
mount /dev/backup/backup /mnt/backup/
logger Mounted OK.

exit 0

I can see from the syslog output that it unlocks OK, but never mounts. It appears the whole rc.local script just died when it reaches that line. I can also see from the ls, stat and whoami that the disk is indeed present in the listing, the keyfile is accessible, and the script is running as root. So I don't know why mounting would fail.

The strangest part is if I remove all of this from rc,local, and just enter the commands in a terminal after bootup:

sudo cryptsetup --verbose --key-file=/root/keyfile luksOpen /dev/disk/by-uuid/32f692ec-e22c-49d3-b6cf-f90e605a5b48 backup
sudo mount /dev/backup/backup /mnt/backup/

It mounts fine. So why does it fail in rc.local and in fstab/crypttab?

share|improve this question
    
I wonder if "/bin" is absent from the path where the script is running. Maybe try /bin/mount .... rather then just "mount" –  davidgo Dec 8 '13 at 7:26
    
Just wondering: doesn't mounting it automatically at boot with a cryptographic key kind of defeats the whole purpose of having an encrypted disk? Aren't you, so to say, just offering it on a silver platter to an intruder? –  MariusMatutiae Dec 8 '13 at 7:28
    
@davidgo: "ls" works, though. –  Rena Dec 8 '13 at 12:45
    
@MariusMatutiae: the keyfile is stored on a partition which itself is encrypted. I still have to enter the passphrase at bootup (but only once). –  Rena Dec 8 '13 at 12:46
    
Ok, makes sense. Did you follow @davidgo's suggestion? It seems an excellent suggestion to me. –  MariusMatutiae Dec 8 '13 at 14:51
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.