3

I'm using LVM with Arch Linux. Please find disk structure below.

NAME              MAJ:MIN RM  SIZE RO TYPE  MOUNTPOINT
sda                 8:0    0   50G  0 disk  
|-sda1              8:1    0  512M  0 part  
| `-cryptboot     254:3    0  510M  0 crypt 
|   `-vgboot-boot 254:4    0  508M  0 lvm   /boot
`-sda2              8:2    0 49.5G  0 part  
  `-cryptlvm      254:0    0 49.5G  0 crypt 
    |-vgos-swap   254:1    0    4G  0 lvm   [SWAP]
    `-vgos-root   254:2    0 45.5G  0 lvm   /
sr0                11:0    1  560M  0 rom

When I boot into my system i will get a password prompt for my Boot partition because it is encrypted. But I want to avoid this password prompt and also my boot partition should reside in lvm. Please let me know if anyone done this.

If you see the above diagram my root also reside in lvm. after selecting the kernal it also prompt for password. But it is not a problem.

Improve this question

1 Answer 1

Reset to default
3

You're getting double password prompt because your /boot partition is encrypted. First, GRUB prompts for password because it needs to load the kernel from encrypted /boot. Then kernel prompts for password again to decrypt /.

There are two approaches to this problem:

  1. Don't use encrypted /boot. GRUB won't ask for password. This will allow anyone tinker with kernel and initramfs files. For example one could replace kernel with a malicious one that accesses your encrypted / once you enter the password.

  2. Create an decryption key and add it to a free LUKS slot on /, then embed that key in initramfs. This will let the kernel access / without password.

The setup for #2 is quite complicated, so I'll go with the former approach. I'm typing this from the top of my head, without any testing. Make backups and proceed carefully. I'm not responsible for any data loss and other issues caused by this process.

You'll need a bootable Linux media with cryptsetup and resize2fs. I'd recommend using Ubuntu flash drive. You can also replace the latter with partclone. You'll also need about 500 MB of free disk space to store intermediate decrypted /boot image.

Boot from your Linux media. Access the LVM (honestly, I've never dealt with it, so I have no idea if any additional steps are necessary - there's a possibility that Ubuntu will deal with this automatically). Open the encrypted /boot:

cryptsetup open /dev/<boot> cryptboot

Make an image of unencrypted boot: (to see progress use pv instead of cat)

cat /dev/mapper/cryptboot > /media/ubuntu/<someExternalStorage>/boot.img

Close /boot:

sync
cryptsetup close cryptboot

Write unencrypted /boot to the partition and adjust filesystem size:

cat /media/ubuntu/<someExternalStorage>/boot.img > /dev/<boot>
resize2fs /dev/<boot>

Get UUID of /boot (take a note of it):

blkid /dev/<boot>

Open and mount /, update fstab:

cryptsetup open /dev/<root> cryptroot
mkdir -p /mnt/root
mount /dev/mapper/cryptroot /mnt/root
cd /mnt/root
vi etc/fstab

Adjust the line that mounts /boot to use the new UUID instead of /dev/mapper/... entry. You may also have to remove /boot line from etc/crypttab.

Update initramfs (this one may break in Ubuntu if your main OS is Arch... I'm not sure, so just be careful):

cd /mnt/root
mount -t sysfs sysfs sys
mount -t tmpfs tmp tmp
mount -t proc proc proc
mount --bind /dev dev
mount /dev/<boot> boot
mount --bind /boot/efi boot/efi
chroot
update-initramfs -u -k all
exit

As far as I remember that should suffice. You can also simplify GRUB config by disabling encrypted boot in its configuration files. It can speed up booting slightly, but isn't necessary.

Clean up after yourself:

umount boot/efi boot dev proc tmp sys
cd ..
umount root
cryptsetup close cryptroot
Improve this answer
8
  • Thanks for the reply and very useful information. But I don't want my boot to move out of encrypt partition
    – Vipin
    May 20, 2018 at 14:32
  • 1
    Then you have to go with #2. Here's a guide.
    – gronostaj
    May 20, 2018 at 15:11
  • Thanks for the link. Just one clarification. When we emed the key file in initramfs. This key file help us to unlock the root file system. But /boot is encrypted still we must enter the password every time. There is not way to embed it as a key file?
    – Vipin
    May 20, 2018 at 15:21
  • 1
    You can add the same key to / and /boot. You'll have to enter the password just once so that GRUB can load the kernel and initramfs from /boot. Then kernel will use the keyfile to open / and the same keyfile again to open and mount /boot. LUKS header can hold up to 8 keys/passwords, so opening with password (for GRUB) and with key (for kernel) isn't exclusive.
    – gronostaj
    May 21, 2018 at 7:12
  • Thanks. keyfile will be added inside initramfs if understand correctly. But how it know which partition we should use that key file.
    – Vipin
    May 21, 2018 at 7:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .