{"id":35652,"date":"2019-10-31T22:05:33","date_gmt":"2019-10-31T19:05:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy\/"},"modified":"2019-10-31T22:05:33","modified_gmt":"2019-10-31T19:05:33","slug":"rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy","title":{"rendered":"Avkodning av LUKS-container vid systemstart","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

God dag, god kv\u00e4ll allihopa! Det h\u00e4r inl\u00e4gget kommer att vara anv\u00e4ndbart f\u00f6r dem som anv\u00e4nder LUKS-datakryptering och vill avkoda diskar under Linux (Debian, Ubuntu) vid avkodningen av root-partitionen<\/b>. Och s\u00e5dan information har jag inte kunnat hitta p\u00e5 internet.<\/p>\n

Nyligen, med det \u00f6kande antalet diskar i hyllorna, st\u00f6tte jag p\u00e5 problemet med avkodning av diskar med hj\u00e4lp av den mer \u00e4n k\u00e4nda metoden genom \/etc\/crypttab. Jag identifierar personligen flera problem med att anv\u00e4nda denna metod, n\u00e4mligen att filen l\u00e4ses endast efter att root-partitionen har laddats (mount)<\/b>, vilket negativt p\u00e5verkar importen av ZFS, s\u00e4rskilt om de har skapats fr\u00e5n partitioner p\u00e5 *_crypt-enheten, eller mdadm RAID som ocks\u00e5 byggdes fr\u00e5n partitioner. Vi vet ju alla att man kan anv\u00e4nda parted p\u00e5 LUKS-containrar?<\/i> Och det finns ocks\u00e5 problemet med tidig start av andra tj\u00e4nster n\u00e4r inte matriserna \u00e4r klara, men anv\u00e4nda<\/b> n\u00e5got redan m\u00e5ste vara klart (jag arbetar med klusterbaserad Proxmox VE 5.x och ZFS \u00f6ver iSCSI).<\/p>\n

Lite om ZFS \u00f6ver iSCSI<\/b>iSCSI fungerar f\u00f6r mig genom LIO, och n\u00e4r iscsi-targeten startar och inte ser ZVOL-enheter, tar den helt enkelt bort dem fr\u00e5n konfigurationen, vilket g\u00f6r det om\u00f6jligt f\u00f6r g\u00e4stsysten att starta. D\u00e4rf\u00f6r antingen \u00e5terst\u00e4llning av JSON-filens s\u00e4kerhetskopia, eller manuell till\u00e4ggning av enheter med identifierarna f\u00f6r varje VM, vilket \u00e4r en mardr\u00f6m n\u00e4r man har tiotals s\u00e5dana maskiner och i konfigurationen av varje mer \u00e4n 1 disk.<\/p>\n

Och den andra fr\u00e5gan som jag kommer att ta upp \u00e4r hur man genomf\u00f6r avkodningen (detta \u00e4r en nyckelpunkt i artikeln). Och om detta kommer vi att diskutera nedan, kom och titta!
\n<\/a><\/noindex>
\nOfast anv\u00e4nds nyckelfiler (naturligtvis f\u00f6rst tillagda i slotten med kommandot \u2014 cryptsetup luksAddKey), eller i s\u00e4llsynta undantag (det finns mycket lite information p\u00e5 ryskspr\u00e5kiga internet) \u2014 skriptet decrypt_derived, som ligger i \/lib\/cryptsetup\/script\/ (sj\u00e4lvklart finns det ocks\u00e5 andra metoder, men jag anv\u00e4nde just dessa tv\u00e5, vilket utg\u00f6r grunden f\u00f6r artikeln). Jag str\u00e4vade ocks\u00e5 efter en helt autonom aktivering efter omstarter, utan n\u00e5gon ytterligare kommandon i konsolen, s\u00e5 att allt skulle \"flyga\" direkt. S\u00e5 varf\u00f6r v\u00e4nta? \u2014 <\/p>\n

L\u00e5t oss b\u00f6rja!<\/p>\n

Vi f\u00f6rest\u00e4ller oss ett system, till exempel Debian, installerat p\u00e5 kryptodelen sda3_crypt och ett dussin diskar redo att krypteras och skapa vad som helst. Vi har en nyckelfras (passphrase) f\u00f6r att l\u00e5sa upp sda3_crypt, och fr\u00e5n denna partition kommer vi att ta \"hashen\" av l\u00f6senordet p\u00e5 det k\u00f6rande (avkrypterade) systemet och l\u00e4gga till det p\u00e5 de andra diskarna. Allt \u00e4r enkelt, vi k\u00f6r f\u00f6ljande i konsolen:<\/p>\n

\/lib\/cryptsetup\/scripts\/decrypt_derived sda3_crypt | cryptsetup luksFormat \/dev\/sdX<\/code><\/pre>\n
\nd\u00e4r X \u00e4r v\u00e5ra diskar, partitioner osv.<\/p>\n
Efter att ha krypterat diskarna med \"hashen\" av v\u00e5r nyckelfras, beh\u00f6ver vi veta UUID eller ID - beroende p\u00e5 vad man \u00e4r van vid. Vi tar uppgifter fr\u00e5n \/dev\/disk\/by-uuid och by-id respektive.<\/p>\n
N\u00e4sta steg \u00e4r att f\u00f6rbereda filer och miniskript f\u00f6r att arbeta med de funktioner vi beh\u00f6ver, l\u00e5t oss b\u00f6rja:<\/p>\n
cp -p \/usr\/share\/initramfs-tools\/hooks\/cryptroot \/etc\/initramfs-tools\/hooks\/\ncp -p \/usr\/share\/initramfs-tools\/scripts\/local-top\/cryptroot \/etc\/initramfs-tools\/scripts\/local-top\/<\/code><\/pre>\n
\nvidare<\/p>\n
touch \/etc\/initramfs-tools\/hooks\/decrypt && chmod +x \/etc\/initramfs-tools\/hooks\/decrypt<\/code><\/pre>\n
\nInneh\u00e5llet i ..\/decrypt<\/b><\/p>\n
#!\/bin\/sh\n\ncp -p \/lib\/cryptsetup\/scripts\/decrypt_derived \"$DESTDIR\/bin\/decrypt_derived\"<\/code><\/pre>\n
vidare<\/p>\n
touch \/etc\/initramfs-tools\/hooks\/partcopy && chmod +x \/etc\/initramfs-tools\/hooks\/partcopy<\/code><\/pre>\n
\nInneh\u00e5llet i ..\/partcopy<\/b><\/p>\n
#!\/bin\/sh\n\ncp -p \/sbin\/partprobe \"$DESTDIR\/bin\/partprobe\"\ncp -p \/lib\/x86_64-linux-gnu\/libparted.so.2 \"$DESTDIR\/lib\/x86_64-linux-gnu\/libparted.so.2\"\ncp -p \/lib\/x86_64-linux-gnu\/libreadline.so.7 \"$DESTDIR\/lib\/x86_64-linux-gnu\/libreadline.so.7\"<\/code><\/pre>\n
lite mer<\/p>\n
touch \/etc\/initramfs-tools\/scripts\/local-bottom\/partprobe && chmod +x \/etc\/initramfs-tools\/scripts\/local-bottom\/partprobe<\/code><\/pre>\n
\nInneh\u00e5llet i ..\/partprobe<\/b><\/p>\n
#!\/bin\/sh\n\n$DESTDIR\/bin\/partprobe<\/code><\/pre>\n
och sist, innan update-initramfs, m\u00e5ste vi redigera filen \/etc\/initramfs-tools\/scripts\/local-top\/cryptroot, med b\u00f6rjan fr\u00e5n rad ~360, koden nedan<\/p>\n
Original<\/b><\/p>\n
\n                # decrease $count by 1, apparently last try was successful.\n                count=$(( $count - 1 ))\n                \n                message \"cryptsetup ($crypttarget): set up successfully\"\n                break\n<\/code><\/pre>\n
och konverterar den till detta format<\/p>\n
Redigerad<\/b><\/p>\n
\n                # decrease $count by 1, apparently last try was successful.\n                count=$(( $count - 1 ))\n                \n\n                \/bin\/decrypt_derived $crypttarget | cryptsetup luksOpen \/dev\/disk\/by-uuid\/ *CRYPT_MAP*\n                \/bin\/decrypt_derived $crypttarget | cryptsetup luksOpen \/dev\/disk\/by-id\/ *CRYPT_MAP*\n\n                message \"cryptsetup ($crypttarget): set up successfully\"\n                break<\/code><\/pre>\n
Observera att vi h\u00e4r kan anv\u00e4nda antingen UUID eller ID. Det viktigaste \u00e4r att de n\u00f6dv\u00e4ndiga drivrutinerna f\u00f6r HDD\/SSD-enheterna \u00e4r tillagda i \/etc\/initramfs-tools\/modules. F\u00f6r att ta reda p\u00e5 vilken drivrutin som anv\u00e4nds kan man anv\u00e4nda kommandot udevadm info -a -n \/dev\/sdX | egrep 'looking|DRIVER'<\/i>.<\/p>\n
Nu n\u00e4r vi \u00e4r klara och alla filer \u00e4r p\u00e5 plats k\u00f6r vi update-initramfs -u -k all -v<\/i>, i loggningen ska det inte finnas<\/b> n\u00e5gra fel i k\u00f6rningen av v\u00e5ra skript. Vi startar om, anger nyckelfrasen och v\u00e4ntar en stund, beroende p\u00e5 antalet diskar. D\u00e4refter startar systemet och i slutskedet av starten, efter \"monteringen\" av root-partitionen, kommer kommandot partprobe att k\u00f6ras \u2014 det kommer att hitta och koppla alla skapade partitioner p\u00e5 LUKS-enheter och alla arrayer, oavsett om det \u00e4r ZFS eller mdadm, kommer att s\u00e4ttas ihop utan problem! Och allt detta innan de grundl\u00e4ggande tj\u00e4nsterna och servrarna som beh\u00f6ver dessa diskar\/arrayer.<\/b> update1<\/p>\n
: Hur<\/b>har jag m\u00e4rkt AEP<\/a><\/noindex> , denna metod fungerar endast f\u00f6r LUKS1.<\/a><\/noindex>Windows, PowerShell och l\u00e5nga s\u00f6kv\u00e4gar
\n
K\u00e4lla: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0441\u0435\u043c \u0434\u043e\u0431\u0440\u043e\u0433\u043e \u0434\u043d\u044f, \u043d\u043e\u0447\u0438! \u042d\u0442\u043e\u0442 \u043f\u043e\u0441\u0442 \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u0435\u043d \u0442\u0435\u043c, \u043a\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 LUKS \u0438 \u0445\u043e\u0447\u0435\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c decrypt\u0434\u0435\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0434\u0438\u0441\u043a\u043e\u0432 \u043f\u043e\u0434 Linux (Debian, Ubuntu) \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 root \u0440\u0430\u0437\u0434\u0435\u043b\u0430. \u0418 \u0442\u0430\u043a\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u044f \u043d\u0430\u0439\u0442\u0438 \u043d\u0435 \u0441\u043c\u043e\u0433. \u0421\u043e\u0432\u0441\u0435\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0441 \u0443\u0432\u0435\u043b\u0438\u0447\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u0434\u0438\u0441\u043a\u043e\u0432 \u0432 \u043f\u043e\u043b\u043a\u0430\u0445, \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0441\u044f \u0441 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u043e\u0439 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 \u0434\u0438\u0441\u043a\u043e\u0432 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-35652","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dekryptering av LUKS-container vid systemstart | ProHoster","description":"God dag, god natt till alla! Detta inl\u00e4gg kommer att vara anv\u00e4ndbart f\u00f6r dem som anv\u00e4nder LUKS-datakryptering och vill dekryptera diskar under Linux (Debian, Ubuntu) n\u00e4r root-partitionen avkodas.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0430 LUKS \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0432 \u043c\u043e\u043c\u0435\u043d\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b | ProHoster","og:description":"\u0412\u0441\u0435\u043c \u0434\u043e\u0431\u0440\u043e\u0433\u043e \u0434\u043d\u044f, \u043d\u043e\u0447\u0438! \u042d\u0442\u043e\u0442 \u043f\u043e\u0441\u0442 \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u0435\u043d \u0442\u0435\u043c, \u043a\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 LUKS \u0438 \u0445\u043e\u0447\u0435\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c decrypt\u0434\u0435\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0434\u0438\u0441\u043a\u043e\u0432 \u043f\u043e\u0434 Linux (Debian, Ubuntu) \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0438 root \u0440\u0430\u0437\u0434\u0435\u043b\u0430.","og:url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/rasshifrovka-luks-kontejnera-v-moment-zagruzki-sistemy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:05:33+00:00","article:modified_time":"2019-10-31T19:05:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35652","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 00:12:43","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:58:29","updated":"2026-01-22 00:12:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/35652","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=35652"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/35652\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=35652"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=35652"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=35652"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}