{"id":35652,"date":"2019-10-31T22:05:33","date_gmt":"2019-10-31T19:05:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy\/"},"modified":"2019-10-31T22:05:33","modified_gmt":"2019-10-31T19:05:33","slug":"rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy","title":{"rendered":"Afkodning af LUKS-container under systemboot","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Goddag til alle! Dette indl\u00e6g vil v\u00e6re nyttigt for dem, der bruger LUKS-datakryptering og \u00f8nsker at dekryptere diske under Linux (Debian, Ubuntu) p\u00e5 stadiet for dekryptering af root-partitionen<\/b>. Og s\u00e5dan information kunne jeg ikke finde p\u00e5 internettet.<\/p>\n

For nylig, med stigende antal diske p\u00e5 hylderne, st\u00f8dte jeg p\u00e5 problemet med dekryptering af diske ved hj\u00e6lp af den ganske velkendte metode gennem \/etc\/crypttab. Jeg identificerer personligt flere problemer med brugen af denne metode, nemlig at filen kun kan l\u00e6ses efter indl\u00e6sning (mount) af root-partitionen<\/b>, hvilket har en negativ indvirkning p\u00e5 import af ZFS, is\u00e6r hvis de er lavet af partitioner p\u00e5 *_crypt-enheden, eller mdadm RAID'er, der ogs\u00e5 er lavet af partitioner. Vi ved alle, at man kan bruge parted p\u00e5 LUKS-containere?<\/i> Og ogs\u00e5 problemet med tidlig opstart af andre tjenester, n\u00e5r der ikke er array'er endnu, men bruges<\/b> der allerede skal g\u00f8res noget (jeg arbejder med klynger af Proxmox VE 5.x og ZFS over iSCSI).<\/p>\n

Lidt om ZFS over iSCSI<\/b>iSCSI k\u00f8rer hos mig via LIO, og n\u00e5r iSCSI-targeten starter og ikke kan finde ZVOL-enhederne, fjerner den dem simpelthen fra konfigurationen, hvilket giver g\u00e6stesystemerne problemer med at starte. Enten skal man gendanne en backup json-fil, eller manuelt tilf\u00f8je enheder med identifikatorerne for hver VM, hvilket er frygteligt, n\u00e5r der er mange maskiner og hver konfiguration har mere end 1 disk.<\/p>\n

Og det andet sp\u00f8rgsm\u00e5l, jeg vil overveje, er, hvordan man udf\u00f8rer dekrypteringen (det er et centralt punkt i artiklen). Og vi vil tale om dette nedenfor, kom ind under kat!
\n<\/a><\/noindex>
\nOfte p\u00e5 internettet bruges en n\u00f8glefil (selvf\u00f8lgelig tilf\u00f8jet f\u00f8r dette i slot ved hj\u00e6lp af kommandoen \u2014 cryptsetup luksAddKey), eller i sj\u00e6ldne undtagelser (p\u00e5 russisk-sprogede internetsider er der meget lidt information) \u2014 scriptet decrypt_derived, der ligger i \/lib\/cryptsetup\/script\/ (selvf\u00f8lgelig er der ogs\u00e5 andre metoder, men jeg har brugt netop disse to, som danner grundlaget for artiklen). Jeg sigtede ogs\u00e5 efter fuld autonom opstart efter genstarter, uden nogen ekstra kommandoer i konsollen, s\u00e5 alt startede straks. S\u00e5 hvorfor vente? \u2014 <\/p>\n

Lad os komme i gang!<\/p>\n

Lad os overveje et system, for eksempel Debian, installeret p\u00e5 en crypto-partition sda3_crypt med et dusin diske, der er klar til kryptering og til hvad som helst man \u00f8nsker. Vi har en n\u00f8glefrase (passphrase) til at l\u00e5se sda3_crypt op, og det er fra denne partition, vi vil tage 'hash'en' fra adgangskoden og tilf\u00f8je den til de andre diske. Det hele er ganske enkelt; i konsollen udf\u00f8rer vi:<\/p>\n

\/lib\/cryptsetup\/scripts\/decrypt_derived sda3_crypt | cryptsetup luksFormat \/dev\/sdX<\/code><\/pre>\n
\nhvor X er vores diske, partitioner osv.<\/p>\n
Efter kryptering af diskene med 'hash'en' fra vores n\u00f8glefrase, skal vi finde UUID eller ID \u2014 alt efter hvem der er vant til hvad. Vi henter data fra \/dev\/disk\/by-uuid og by-id henholdsvis.<\/p>\n
N\u00e6ste skridt er at forberede filerne og sm\u00e5 scripts til de n\u00f8dvendige funktioner, lad os begynde:<\/p>\n
cp -p \/usr\/share\/initramfs-tools\/hooks\/cryptroot \/etc\/initramfs-tools\/hooks\/\ncp -p \/usr\/share\/initramfs-tools\/scripts\/local-top\/cryptroot \/etc\/initramfs-tools\/scripts\/local-top\/<\/code><\/pre>\n
\nderefter<\/p>\n
touch \/etc\/initramfs-tools\/hooks\/decrypt && chmod +x \/etc\/initramfs-tools\/hooks\/decrypt<\/code><\/pre>\n
\nIndholdet af ..\/decrypt<\/b><\/p>\n
#!\/bin\/sh\n\ncp -p \/lib\/cryptsetup\/scripts\/decrypt_derived \"$DESTDIR\/bin\/decrypt_derived\"<\/code><\/pre>\n
derefter<\/p>\n
touch \/etc\/initramfs-tools\/hooks\/partcopy && chmod +x \/etc\/initramfs-tools\/hooks\/partcopy<\/code><\/pre>\n
\nIndholdet af ..\/partcopy<\/b><\/p>\n
#!\/bin\/sh\n\ncp -p \/sbin\/partprobe \"$DESTDIR\/bin\/partprobe\"\ncp -p \/lib\/x86_64-linux-gnu\/libparted.so.2 \"$DESTDIR\/lib\/x86_64-linux-gnu\/libparted.so.2\"\ncp -p \/lib\/x86_64-linux-gnu\/libreadline.so.7 \"$DESTDIR\/lib\/x86_64-linux-gnu\/libreadline.so.7\"<\/code><\/pre>\n
endnu lidt<\/p>\n
touch \/etc\/initramfs-tools\/scripts\/local-bottom\/partprobe && chmod +x \/etc\/initramfs-tools\/scripts\/local-bottom\/partprobe<\/code><\/pre>\n
\nIndholdet af ..\/partprobe<\/b><\/p>\n
#!\/bin\/sh\n\n$DESTDIR\/bin\/partprobe<\/code><\/pre>\n
og til sidst, f\u00f8r update-initramfs, skal du redigere filen \/etc\/initramfs-tools\/scripts\/local-top\/cryptroot, startende fra linje ~360, stykke kode som nedenfor<\/p>\n
Original<\/b><\/p>\n
\n                # decrease $count by 1, apparently last try was successful.\n                count=$(( $count - 1 ))\n                \n                message \"cryptsetup ($crypttarget): set up successfully\"\n                break\n<\/code><\/pre>\n
og bringe det til denne form<\/p>\n
Den redigerede<\/b><\/p>\n
\n                # decrease $count by 1, apparently last try was successful.\n                count=$(( $count - 1 ))\n                \n\n                \/bin\/decrypt_derived $crypttarget | cryptsetup luksOpen \/dev\/disk\/by-uuid\/ *CRYPT_MAP*\n                \/bin\/decrypt_derived $crypttarget | cryptsetup luksOpen \/dev\/disk\/by-id\/ *CRYPT_MAP*\n\n                message \"cryptsetup ($crypttarget): set up successfully\"\n                break<\/code><\/pre>\n
Bem\u00e6rk, at du her kan bruge enten UUID eller ID. Det vigtigste er, at de n\u00f8dvendige drivere til HDD\/SSD-enhederne er tilf\u00f8jet til \/etc\/initramfs-tools\/modules. Du kan finde den brugte driver med kommandoen udevadm info -a -n \/dev\/sdX | egrep 'looking|DRIVER'<\/i>.<\/p>\n
Nu hvor vi er f\u00e6rdige og alle filer er p\u00e5 plads, k\u00f8rer vi update-initramfs -u -k all -v<\/i>, i loggen m\u00e5 der ikke v\u00e6re<\/b> fejl i udf\u00f8relsen af vores scripts. Vi genstarter, indtaster n\u00f8glefrase og venter lidt, afh\u00e6ngig af antallet af diske. Herefter vil systemet starte, og i den afsluttende fase af opstarten, nemlig efter 'mounting' af root-partitionen, vil kommandoen partprobe blive udf\u00f8rt \u2014 den vil finde og tilslutte alle oprettede partitioner p\u00e5 LUKS-enhederne, og enhver array, hvad enten det er ZFS eller mdadm, vil blive samlet uden problemer! Og alt dette f\u00f8r indl\u00e6sning<\/b> af de vigtigste tjenester og services, der har brug for disse diske\/arrays.<\/p>\n
update1<\/b>: Hvordan bem\u00e6rkede<\/a><\/noindex> AEP<\/a><\/noindex>, denne metode fungerer kun for LUKS1.
\n
Kilde: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0441\u0435\u043c \u0434\u043e\u0431\u0440\u043e\u0433\u043e \u0434\u043d\u044f, \u043d\u043e\u0447\u0438! \u042d\u0442\u043e\u0442 \u043f\u043e\u0441\u0442 \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u0435\u043d \u0442\u0435\u043c, \u043a\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 LUKS \u0438 \u0445\u043e\u0447\u0435\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c decrypt\u0434\u0435\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0434\u0438\u0441\u043a\u043e\u0432 \u043f\u043e\u0434 Linux (Debian, Ubuntu) \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 root \u0440\u0430\u0437\u0434\u0435\u043b\u0430. \u0418 \u0442\u0430\u043a\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u044f \u043d\u0430\u0439\u0442\u0438 \u043d\u0435 \u0441\u043c\u043e\u0433. \u0421\u043e\u0432\u0441\u0435\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0441 \u0443\u0432\u0435\u043b\u0438\u0447\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u0434\u0438\u0441\u043a\u043e\u0432 \u0432 \u043f\u043e\u043b\u043a\u0430\u0445, \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0441\u044f \u0441 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 \u0434\u0438\u0441\u043a\u043e\u0432 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-35652","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Afkodning af LUKS-container ved systemopstart | ProHoster","description":"God dag eller nat til alle! Dette indl\u00e6g vil v\u00e6re nyttigt for dem, der bruger LUKS-datakryptering og \u00f8nsker at dekryptere diske under Linux (Debian, Ubuntu) i fasen med at dekryptere root-partitionen.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0430 LUKS \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0432 \u043c\u043e\u043c\u0435\u043d\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b | ProHoster","og:description":"\u0412\u0441\u0435\u043c \u0434\u043e\u0431\u0440\u043e\u0433\u043e \u0434\u043d\u044f, \u043d\u043e\u0447\u0438! \u042d\u0442\u043e\u0442 \u043f\u043e\u0441\u0442 \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u0435\u043d \u0442\u0435\u043c, \u043a\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 LUKS \u0438 \u0445\u043e\u0447\u0435\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c decrypt\u0434\u0435\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0434\u0438\u0441\u043a\u043e\u0432 \u043f\u043e\u0434 Linux (Debian, Ubuntu) \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 root \u0440\u0430\u0437\u0434\u0435\u043b\u0430.","og:url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:05:33+00:00","article:modified_time":"2019-10-31T19:05:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35652","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 00:12:43","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:58:29","updated":"2026-01-22 00:12:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/35652","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=35652"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/35652\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=35652"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=35652"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=35652"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}