Remote unlock via SSH for encrypted root volume (Ubuntu 14.04.3)

Remote unlock via SSH for encrypted root volume

Ubuntu 14.04.3

Install dropbear SSH server with automated hooks for being included in an initramfs.

apt-get install dropbear

Remove default private/public key for login, clear dss key (would be regenererated otherwise), remove insecure 1024-bit RSA host key and generate a new 2048-bit RSA host key (we'll have to keep the DSA-key, dropbear won't start otherwise - make sure to use RSA when connecting):

rm /etc/initramfs-tools/root/.ssh/id_rsa.{dropbear,pub}
rm /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key
dropbearkey -t rsa -s 2048 -f /etc/initramfs-tools/etc/dropbear/dropbear_rsa_host_key

Add public keys to /etc/initramfs-tools/root/.ssh/authorized_keys.

Make dropbear run on port 222 - edit /usr/share/initramfs-tools/scripts/init-premount/dropbear and change one of the last few lines starting dropbear to:

/sbin/dropbear -p 222

Regenerate initramfs:

update-initramfs -u

Log in

Find the cryptsetup pcommand by running ps |grep cryptsetup. kill makes the boot process continue.

Unlocking then looks like this:

# /sbin/cryptsetup -T 1 --allow-discards luksOpen /dev/disk/by-uuid/<SOME UUID> sda3_crypt
Enter passphrase for /dev/disk/by-uuid/<SOME UUID>:
# kill -9 `pidof plymouth`

Troubleshooting

If you're getting a connection refused when trying to connect, dropbear might fail to start. You can use a rescue shell (add break=premount to the grub line beginning with linux) for debugging. Try to start dropbear with dropbear -F -E (foreground, logging to stderr) and see what happens.

I had one of the key files accidentally empty, which resulted in an error message including bad buf_getptr.

mfrister/remote-unlock.md