Re: Unlocking LUKS with a USB drive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 22.08.2013 06:37, odiegit@xxxxxxx wrote:
> 
> Hello. I am using Fedora 19 and would like to be able to unlock the LUKS
> root partition on my hard drive using a two factor authentication of
> both a passphrase and a sector stored on a USB flash drive.
> Accomplishing this requires modifying the boot process to read a USB device.
> 
> This post <http://forums.fedoraforum.org/showthread.php?t=241942>
> <http://forums.fedoraforum.org/showthread.php?t=241942%3E>; also
> available on <http://www.gaztronics.net/howtos/luks.php>
> <http://www.gaztronics.net/howtos/luks.php%3E>; gives information on
> accomplishing the unlock step using a USB key, but it does not work for
> Fedora 19. I also found a bug filed which appears to be related
> <https://bugzilla.redhat.com/show_bug.cgi?id=459485>
> <https://bugzilla.redhat.com/show_bug.cgi?id=459485%3E>.
> 
> The problem I am having is that the boot process's unlocking of the LUKS
> container is no longer carried out by
> /usr/lib/dracut/modules.d/90crypt/cryptroot-ask.sh as it was in past
> versions of Fedora. I deleted the entire contents of that file and
> Fedora was still able to boot properly and asked me the password to the
> LUKS partition. My question then is, what scripts carry out the LUKS
> unlock step in the boot process of Fedora 19? And can they be modified
> directly like cryptroot-ask.sh was?
> 
> Thank you,
> Odie5533
> 
> 

Now, unlocking of LUKS partitions is handled by systemd
(src/cryptsetup/*) but as you already know it doesn't work. I don't know
if it's a bug or not implements yet feature but it worked with dracut
and doesn't work with systemd.

There is a temporary workaroud that enables key based unlocking. You
have to edit /etc/dracut.conf and add omit_dracutmodules+=" systemd ".
Then regenerate initramfs.

For two factor unlocking you may have to modify systemd or dracut.


Mateusz Marzantowicz
-- 
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org




[Index of Archives]     [Older Fedora Users]     [Fedora Announce]     [Fedora Package Announce]     [EPEL Announce]     [EPEL Devel]     [Fedora Magazine]     [Fedora Summer Coding]     [Fedora Laptop]     [Fedora Cloud]     [Fedora Advisory Board]     [Fedora Education]     [Fedora Security]     [Fedora Scitech]     [Fedora Robotics]     [Fedora Infrastructure]     [Fedora Websites]     [Anaconda Devel]     [Fedora Devel Java]     [Fedora Desktop]     [Fedora Fonts]     [Fedora Marketing]     [Fedora Management Tools]     [Fedora Mentors]     [Fedora Package Review]     [Fedora R Devel]     [Fedora PHP Devel]     [Kickstart]     [Fedora Music]     [Fedora Packaging]     [Fedora SELinux]     [Fedora Legal]     [Fedora Kernel]     [Fedora OCaml]     [Coolkey]     [Virtualization Tools]     [ET Management Tools]     [Yum Users]     [Yosemite News]     [Gnome Users]     [KDE Users]     [Fedora Art]     [Fedora Docs]     [Fedora Sparc]     [Libvirt Users]     [Fedora ARM]

  Powered by Linux