4

I currently try to achieve full disk encryption using dm-crypt in plain mode without LUKS header with separate /boot on USB stick. Main goal of it is to achieve plausible deniability on Debian Linux distro. For now, I've managed to encrypt partitions using cryptsetup and install /boot partition to separate USB key. It all goes as it should and because header for encryption is not stored in LUKS I need to manually enter it at initramfs screen, but at this step i simply get error that indicates there's no cryptsetup in initramfs (/bin/sh: cryptsetup: not found) while trying to parse the header. In conclusion:

  1. dev/sda encrypted using dm-crypt (/root and /home volumes) with

    cryptsetup --hash=sha512 --cipher=twofish-xts-plain64 create crypt /dev/sda

  2. dev/sdb boot stick with grub

I successfully boot from bootstick, I see Ubuntu splash screen for about 20 seconds which is what I wanted to achieve for plausible deniability and then id drops to initramfs complaining about not being able to find /dev/mapper/root which is also something I wanted to achieve. Problem is that when I want to parse the cryptsetup line which would allow me to enter a password and continue with boot then initramfs complains abotu cryptsetup: not found

I guess this complains is true. My question is how to install cryptsetup into initramfs co it would allow further booting for password prompt. Also, I know that I'm omitting something with adding appropriate entries in /etc/fstab, /etc/crypttab and devices are not found during start up.

I'm very sorry for anything that is not clear here. I'm only average Unix user with some basic knowledge of system but any help will be much appreciated.

This are the guides I've found and used to set up all current config, maybe this will clear things I did not cover in post.

First one is a little outdated and second one is right only for Arch Linux but I've used two of them with newest lubuntu installation with little tweaking.

Improve this question
0

1 Answer 1

Reset to default
3

I'm the author of http://and1equals1.blogspot.com/2009/10/encrypting-your-hdd-with-plausible.html, and have been meaning to update it for some time as I've noticed it doesn't work with more recent distributions. Here's what I've uncovered so far:

On an Ubuntu 14.04 system using LUKS and LVM, there's a file in /usr/share/initramfs/hooks called cryptroot that I believe is supposed to copy /sbin/cryptsetup to the initramfs (via the copy_exec function) when mkinitramfs is called. Querying the dpkg database, that file is part of the cryptsetup package, which is explicitly installed as one of the final steps in my guide before installing grub. I don't fully understand why it's not in the initramfs built on your system then.

I'll look into it as time permits, but here's what I would suggest if you want to continue pursuing this:

  1. Search for the executable in someplace other than $PATH on the initramfs, if you haven't already done so. I think it gets copied to /sbin/ in the initramfs, and I don't know if that's in the path.

  2. During image creation, such as when it's prompting to install grub, switch to a second terminal (Alt-F2), and make sure the /target/usr/share/initramfs/hooks/cryptroot script is there and /target/sbin/cryptsetup is as well.

  3. Figure out the hooks script format well enough to explicitly copy the binary to the initramfs, possibly as a new name (may be better for plausible deniability anyway). Create it and run "update-initramfs -u -v | less" to update the latest kernel's initramfs (search through the output for cryptsetup to verify) and "update-grub" just in case. Make sure your boot stick is in and /boot is mounted when you do this, of course.

  4. You may want to play with removing /usr/share/initramfs/scripts/local-top/cryptroot (like maybe delete it) so that it's not so obvious to someone booting from the boot stick that it's waiting on an encrypted partition. That might make it look more like a simple rescue stick instead.

As I get time, I'll see if I can get this working on Ubuntu 14.04 and create a new post on the blog. I'll add a link here to whatever I do, as it appears by the traffic this generates that you're not the only one searching for something like this...

Improve this answer

You must log in to answer this question.