Enable remote unlocking of a fully encrypted (dm-crypt/LUKS) Ubuntu 12.10 server via SSH.

remote-unlock-ubuntu-fde.sh

#!/bin/bash

cat << ENDMSG
This script enables you to remotely unlock a fully encrypted (dm-crypt/LUKS) Ubuntu 12.10 server via SSH.

The script must be run as root (via sudo).

Contains bits gratefully taken from
http://hacksr.blogspot.com/2012/05/ssh-unlock-with-fully-encrypted-ubuntu.html and
http://blog.nguyenvq.com/2011/09/13/remote-unlocking-luks-encrypted-lvm-using-dropbear-ssh-in-ubuntu/


Copyright (c) 2013 Peeter P. Mõtsküla <[email protected]>

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
associated documentation files (the "Software"), to deal in the Software without restriction,
including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense,
and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial
portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

ENDMSG

# install openssh-server and dropbear
apt-get install ssh dropbear

# use same host identification with openssh and dropbear
cp /etc/dropbear/dropbear_* /etc/initramfs-tools/etc/dropbear/

# enable root account (initial ramdisk only contains a root user so it has to be activated)
# note: you may want to use public key authentication when logging in as root,
#       and give root a really long and complicated password
passwd root

# disable root login via openssh
sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config

# copy your "real" user's authorized_keys to root (of course you may also opt for a different set)
cp ~/.ssh/authorized_keys /etc/initramfs-tools/root/.ssh/authorized_keys

# create an unlock script to work around plymouth, and make it executable
touch /etc/initramfs-tools/hooks/crypt_unlock.sh
chmod 755 /etc/initramfs-tools/hooks/crypt_unlock.sh
cat << DONE > /etc/initramfs-tools/hooks/crypt_unlock.sh
#!/bin/sh
 
PREREQ="dropbear"
 
prereqs() {
    echo "$PREREQ"
}
 
case "$1" in
    prereqs)
        prereqs
        exit 0
    ;;
esac
 
. "${CONFDIR}/initramfs.conf"
. /usr/share/initramfs-tools/hook-functions
 
if [ "${DROPBEAR}" != "n" ] && [ -r "/etc/crypttab" ] ; then
    cat > "${DESTDIR}/bin/unlock" << EOF
#!/bin/sh
if PATH=/lib/unlock:/bin:/sbin /scripts/local-top/cryptroot; then
    kill \`ps | grep cryptroot | grep -v "grep" | awk '{print \$1}'\`
    exit 0
fi
exit 1
EOF
 
    chmod 755 "${DESTDIR}/bin/unlock"
 
    mkdir -p "${DESTDIR}/lib/unlock"
cat > "${DESTDIR}/lib/unlock/plymouth" << EOF
#!/bin/sh
[ "\$1" == "--ping" ] && exit 1
/bin/plymouth "\$@"
EOF
 
    chmod 755 "${DESTDIR}/lib/unlock/plymouth"
 
    echo Run \"unlock\" to unlock the root partition >> ${DESTDIR}/etc/motd
 
fi
DONE

# update initramfs and reboot
update-initramfs -u
reboot

This was very useful except I run into several challenges using Ubuntu 12.04.2 LTS and here are my fixes (fwiw).

1. Adjust dropbear's hook reference to nss libs :

http://bighippo999.blogspot.ca/2012/05/cp-cannot-stat-liblibnss-no-such-file.html

Replace

/lib/libnss_*

by

/lib/x86_64-linux-gnu/libnss_*

in

/usr/share/initramfs-tools/hooks/dropbear

2. Remember that by default, your network interface will try and get an IP using DHCP.

This might not be suitable, so if needed change

/etc/initramfs-tools/initramfs.conf

to assign a static IP to a specific interface, using the following parameters :

DEVICE=[DEVICE]
IP=[CLIENT_IP]:[SERVER_IP]:[GATEWAY_IP]:[NETMASK]:[HOSTNAME]:[DEVICE]:[AUTOCONF]

You will probably only need to use client_ip, gateway_ip, netmask, hostname and device and leave server_ip empty (use :: for empty params).
http://manpages.ubuntu.com/manpages/lucid/en/man7/live-getty.7.html
https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt

3. There's a bug in Ubuntu in the way ifupdown behaves if you set a static IP.

https://bugs.launchpad.net/ubuntu/+source/ifupdown/+bug/1080975

You'll need to monkeypatch

/usr/share/initramfs-tools/scripts/init-bottom/dropbear

and add the following line right at the very end

ifconfig eth0 0.0.0.0 down

4. A level of escape sequences were missing in the posted script.

Those had the $PREREQ, DESTDIR, CONFDIR interpreted resulting in empty strings in

/etc/initramfs-tools/hooks/crypt_unlock.sh

The new internal script section now becomes :

#!/bin/bash
cat << DONE > /etc/initramfs-tools/hooks/crypt_unlock.sh

#!/bin/sh

PREREQ="dropbear"

prereqs() {
    echo "\$PREREQ"
}

case "\$1" in
    prereqs)
        prereqs
        exit 0
    ;;
esac

. "\${CONFDIR}/initramfs.conf"
. /usr/share/initramfs-tools/hook-functions

if [ "\${DROPBEAR}" != "n" ] && [ -r "/etc/crypttab" ] ; then
    cat > "\${DESTDIR}/bin/unlock" << EOF
#!/bin/sh
if PATH=/lib/unlock:/bin:/sbin /scripts/local-top/cryptroot; then
    kill \\\`ps | grep cryptroot | grep -v "grep" | awk '{print \\\$1}'\\\`
    exit 0
fi
exit 1
EOF

    chmod 755 "\${DESTDIR}/bin/unlock"

    mkdir -p "\${DESTDIR}/lib/unlock"
cat > "\${DESTDIR}/lib/unlock/plymouth" << EOF
#!/bin/sh
[ "\\\$1" == "--ping" ] && exit 1
/bin/plymouth "\\\$@"
EOF

    chmod 755 "\${DESTDIR}/lib/unlock/plymouth"

    echo Run \"unlock\" to unlock the root partition >> \${DESTDIR}/etc/motd

fi
DONE

5. You might want to add an sh pid kill and exit to the script

Such as described there http://blog.nguyenvq.com/blog/2011/09/13/remote-unlocking-luks-encrypted-lvm-using-dropbear-ssh-in-ubuntu/

pid=`ps | grep "/bin/sh" | cut -d " " -f 3`; kill -9 $pid; exit;

6. Other links you might want to consider :

https://bugs.launchpad.net/ubuntu/+source/dropbear/+bug/363958