Auto Decrypt Encrypted SD Card on Boot for L5

Hardware Librem 5
1

The L5 has only about 30G of memory. I want to extend it with an SD card. However, I want the SD card to be encrypted (luks container). To this end, inserted an SD card and encrypted it

cryptsetup luksFormat /dev/sda

Then, I copied the /etc/crypttab entry for crypt_root to another line, changed the name to crypt_sd, updated the UUID, and added nofail to the options.

/etc/crypttab contents:
crypt_root UUID=[root uuid here] none luks,discard,keyscript=/usr/share/initramfs-tools/scripts/osk-sdl-keyscript,initramfs
crypt_sd UUID=[sd uuid here] none nofail,luks,discard,keyscript=/usr/share/initramfs-tools/scripts/osk-sdl-keyscript,initramfs

At boot, I get a screen to put in my passphrase for the root partition. I put this in, and then I am presented with ANOTHER password screen, but only for about 0.2 seconds. This screen goes away and I get some tty-esque text output which is asking for a passphrase for about 1 second before it boots normally.

It seems like it decrypts root normally, but doesn’t give me enough time to type the passphrase for the sd card. Then, it boots normally ignoring the failed decrypt.

Has anyone gotten encrypted sd cards to open at boot? If so, How did you do it? Is there something wrong with my crypttab entry above?

Thanks,
Zacchaeus

6 Likes
2

These are some old notes from when I wanted the same. Dated 2017. I Think they still apply:
Reference:


My reduced version:
–Create key
dd if=/dev/urandom of=/etc/luks-keys/disk_secret_key bs=512 count=8
–Add key to luks device (you will need to know a passpharase of the device)
sudo cryptsetup -v luksAddKey /dev/sdb1 /etc/luks-keys/disk_secret_key
–Admire your work (optional)
sudo cryptsetup luksDump /dev/md0?? /dev/sda1??
–Test (optional)
sudo cryptsetup -v luksOpen /dev/sdb1 sdb1_crypt --key-file=/etc/luks-keys/disk_secret_key
sudo cryptsetup -v luksClose sdb1_crypt
–Add to /etc/crypttab
sdb1_crypt UUID=2a2375bf-2262-413c-a6a8-fbeb14659c85 /etc/luks-keys/disk_secret_key luks
–add to fstab
/dev/mapper/sdb1_crypt /media/gerhard/Daten ext4 defaults 0 2
7 Likes
3

Hmm. I don’t like the idea of having a key hanging around on disk, but maybe it is fine since my root is encrypted? I would rather enter a passphrase at boot like with the root drive, but I suppose this will do. Thanks!

3 Likes
4

Help, please :pray:
I did it into terminal but I receive error message: file or directory not existent!

How can I solve it?
Thank you

PS: it’s crazy, for me, to type this message using my iPhone because when I tried to write it using my L5 I wasn’t able to do it :sweat_smile::worried:

1 Like
5

You need to create the directory to write the key to. You could put your key anywhere, but in the example, it is being written to /etc/luks-keys/, so you should make that:

mkdir /ect/luks-keys

Make sure only root can look inside!

chown root /etc/luks-keys
chmod 700 /etc/luks-keys
3 Likes
6

Thank you!! :pray:
Please, I’m trying this step:
“ –Add to /etc/crypttab”
But when I digit: sudo gedit /etc/crypttab
Terminal replies:
Gtk-WARNING … cannot open display: :0
How can I add my “ sdb1_crypt UUID=2a2375bf-2262-413c-a6a8-fbeb14659c85 /etc/luks-keys/disk_secret_key luks” to crypttab?
I don’t know vim command :sweat_smile:
Could you, please, type here the command?
Thank you

1 Like
7

Use nano instead of gedit ?

That will still leave you with: I don’t know nano command

but it is a lot more straightforward for the new user than vi.

I think you will need to replace the UUID with your actual UUID.

2 Likes
9

Dear Purism Community,

Here is an alternative method to create an SD Card that will automatically decrypt on the Librem 5 utilizing GNOME Disks. The application should be preinstalled on the device

Before doing these steps check out this thread. It appears that GNOME may have some issues but let me know if I am wrong:

  1. Shutdown and Insert your SD card into the Librem 5.

It fits alongside your SIM Card in your SIM card tray.

  1. Open GNOME Disks from the application menu.

  2. Select the SD card from the list of storage devices on the left.

  3. Format the SD card by clicking the gear icon and selecting “Format Partition…”

  4. Click the + sign

You will then wanna select “Internal disk for use with Linux systems only” as well as "Password protect volume (LUKS)

It should prompt you for the encryption password.

  1. Set up automatic decryption:
  • Open the “Disks” menu at the top-right of the GNOME Disks application.
  • Go to “Edit Encryption Options.”
  • Swipe to the left “Session Defaults”
  • Check the option “Unlock at system startup”
  • Make sure to fill in the section titled “passphrase” with the associated encryption password

Formatting will erase all existing data.

1 Like
10

… which should always be done with the Librem 5 shut down.

3 Likes
11

PS Note that the above procedure will result in the passphrase for the encrypted SD card being stored in plain text in the root file system. So that is really only acceptable if the root file system itself is encrypted.

(A corollary to that is that “unlock at system startup” should only be used when the contents of the SD card have a confidentiality that is no greater than the confidentiality of the root file system.)

3 Likes
12

I tried this alternative method using GNOME Disks first, and found myself stuck in the boot issue others have had (my apologies, I can no longer find the post) where during boot up, after I type in my main encryption password, it asks for the encryption password for the SD card but doesn’t offer a keyboard and in any case, only does so for a second or two before shutting down again.

1 Like