Remote Unlocking of Encrypted Disks

1. Problem statement. You have an encrypted disk and want to decrypt the disk during boot while not sitting in front of your computer.

Solution is sketched and indicated in dm-crypt/Specialties. Below is a little bit more explanation. For the following you must be root.

2. Required software packages. Install the following packages: dropbear from repo “Community”. Then install the following AUR-packages:

  1. mkinitcpio-netconf
  2. mkinitcpio-utils
  3. mkinitcpio-dropbear

3. Populate root_key. First mkdir /etc/dropbear and populate root_key file with public ssh keys which should be able to log into your machine, similar to authorized_keys for OpenSSH. I.e., you must know the private keys on the corresponding machines you intend to use for unlocking.

4. Set-up networking in Grub. Edit /etc/default/grub and set

GRUB_CMDLINE_LINUX_DEFAULT="cryptdevice=UUID=5a74247e-75e8-4c05-89a7-66454f96f974:cryptssd:allow-discards root=/dev/mapper/cryptssd ip="

Then issue

grub-mkconfig -o /boot/grub/grub.cfg

to re-generate grub.cfg. The specification for “ip=” is given in Mounting the root filesystem via NFS (nfsroot). Its most important parts are:

  1. client-ip: IP address of the client
  2. server-ip: IP address of the NFS server
  3. gateway-ip: IP address of a gateway
  4. netmask: Netmask for local network interface
  5. hostname: Name of the client
  6. device: Name of network device to use
  7. autoconf: Method to use for autoconfiguration

5. Configure mkinitcpio. Finally, the main task. Edit /etc/mkinitcpio.conf and set

HOOKS="base udev block keymap keyboard autodetect modconf netconf dropbear encryptssh filesystems fsck"

Now call

mkinitcpio -p linux

See Arch Wiki mkinitcpio. Output of mkinitcpio looks something like this:

  -> Running build hook: [dropbear]
Key is a ssh-rsa key
Wrote key to '/etc/dropbear/dropbear_rsa_host_key'
Key is a ssh-dss key
Wrote key to '/etc/dropbear/dropbear_dss_host_key'
Key is a ecdsa-sha2-nistp256 key
Wrote key to '/etc/dropbear/dropbear_ecdsa_host_key'
dropbear_rsa_host_key : sha1!! e1:11:51:ce:0b:07:2b:c7:66:37:c0:b9:de:f3:80:56:64:69:cc:fd
dropbear_dss_host_key : sha1!! ca:75:42:85:f9:96:6d:db:fd:15:d1:7a:4a:ee:19:b1:ff:91:14:bb
dropbear_ecdsa_host_key : sha1!! b9:b3:c4:ee:c4:af:21:87:52:39:e8:b6:c2:a3:b7:53:0e:52:f1:85
   -P, --allpresets             Process all preset files in /etc/mkinitcpio.d
   -r, --moduleroot <dir>       Root directory for modules (default: /)
   -S, --skiphooks <hooks>      Skip specified hooks, comma-separated, during build
   -s, --save                   Save build directory. (default: no)
   -d, --generatedir <dir>      Write generated image into <dir>
   -t, --builddir <dir>         Use DIR as the temporary build directory
   -V, --version                Display version information and exit
   -v, --verbose                Verbose output (default: no)
   -z, --compress <program>     Use an alternate compressor on the image
  -> Running build hook: [encryptssh]
  -> Running build hook: [filesystems]
  -> Running build hook: [fsck]
==> Generating module dependencies
==> Creating gzip-compressed initcpio image: /boot/initramfs-linux.img
==> Image generation successful

Content in /etc/dropbear is then

$ ls -l /etc/dropbear
total 16
-rw------- 1 root root  458 Apr  1 13:24 dropbear_dss_host_key
-rw------- 1 root root  140 Apr  1 13:24 dropbear_ecdsa_host_key
-rw------- 1 root root  806 Apr  1 13:24 dropbear_rsa_host_key
-rw------- 1 root root 1572 Apr  1 12:25 root_key

6. Usage. Use ssh root@YourComputer to connect to your previously configured dropbear server and type in the password for the encrypted disk. The connection will then close, and dropbear disappears. By the way, dropbear does not look at your configuration for OpenSSH, so if you block root access via OpenSSH, this is of no concern for dropbear.

7. Limitations. Above set-up just works for unlocking the root-device. If there are other encrypted devices, for example devices given in /etc/crypttab, these cannot be unlocked by above procedure.

8. Further reading. See LUKS encrypted devices remote über Dropbear SSH öffnen (in German), Remote unlocking LUKS encrypted LVM using Dropbear SSH in Ubuntu Server 14.04.1 (with Static IP).


Linux pam and /etc/shells

I learned the hard way that a user in /etc/passwd not having a shell specified in /etc/shells is not able to log-on.

On Ubuntu /etc/shells looks like this:


On Arch it looks like this:


So if you provide a user with shell /usr/bin/bash, he cannot log-in, thanks to

See man shells, man pam_shells, and authentication error with shell=/usr/bin/bash.

Also see Creating User Account With Empty Password on Linux.

Using GnuPG for encryption and decryption

On Ubuntu install with:

apt-get install gnupg

First generate private and public key:

gpg --gen-key

Generating this key can take some time, because it needs enough randomness.

Store your public key in a file:

gpg -a --export

Although it is not necessary to store this public key, you usually will provide this public key to other people, see for example my public key.

Import public keys from other people by

gpg --import

Now encrypt a message for my-friend:

gpg -aesr my-friend your-file

These options have the following effect:

  • -a: create base64 encoded output (“ASCII armored”). This is not necessary, so you can skip this option. If skipped the output is binary.
  • -e: encrypt
  • -s: add signature. This is not necessary. You could drop this option from above.
  • -r: recipient, here your-friend

Decrypting a file is the easiest part. Just type

gpg encrypted-file

Short Review on Film Citizenfour

Yesterday I went to the movie with my family and watched Laura Poitras‘s film Citizenfour. The movie in Frankfurt was completely sold out, many prospects had to be sent home, because there were no more seats available. I just got a ticket because I had a high number on the waiting list. I am surprised that the movie is not shown in the “big” movies, but rather in small and lesser known movies.

Continue reading

On Password Security and Cracking

Six months ago Bruce Schneier posted an article on “Choosing Secure Passwords”. Some of the key points are (mostly copied verbatim from mentioned post):

  1. The best way to explain how to choose a good password is to explain how they are broken.
  2. Password crackers do not brute force all 8 character combinations, but rather they brute force all 6 character passwords, then they check for common passwords.
  3. A typical password consists of a root plus an appendage. The root isn’t necessarily a dictionary word, but it’s usually something pronounceable. An appendage is either a suffix (90% of the time) or a prefix (10% of the time). One cracking program I saw started with a dictionary of about 1,000 common passwords. Continue reading

Setting-Up LUKS/dm-crypt for External USB-Drive

The following commands are used to encrypt the whole USB hard-drive. This hard-drive is assumed to be on /dev/sdc. Create one partition. One can use gparted for this. Then

cryptsetup luksFormat /dev/sdc1

luksFormat is only used once.

To make this encrypted drive available as device on /dev/mapper use

cryptsetup luksOpen /dev/sdc1 SeagatePortable

Continue reading

Cisco 2014 Annual Security Report: Java continues to be most vulnerable of all web exploits

Cisco provides a report on computer security which contains a number of key findings:

  1. Java comprises 91% of all web exploits.
  2. 99% of mobile malware targets Android.
  3. Java is the exploit that criminals choose first, since it delivers the best return on investment.
  4. Continue reading