8

I have been trying to get Raspbian Jessie, installed from the image to boot with an encrypted root partition.

I was successful in following the guide here.

When I boot the Pi, it drops to an initramfs prompt, then I unlock the partition with

# cryptsetup luksOpen /dev/mmcblk0p2 sdcard
# exit

and it boots into Debian. Great!

However, there are some issues. When I try to update the initramfs file with:

# sudo mkinitramfs -o /boot/initramfs.gz

in Debian, the Pi doesn't successfully reboot to the initramfs prompt. It just hangs with a blinking cursor after showing the pixel logo. When I restore to my backed-up boot image, I get the initramfs prompt again and can boot from the encrypted root.

The second issue is that I did not properly configure dropbear; it appears to be configured to use DHCP. This means that when I log in it gets a random IP address. I need to update the configuration to a fixed IP address so that I can log into the Pi headless after a reboot, but without the ability to update the initramfs I don't know how to fix this.

Given that I can't even get an initramfs prompt after the update, I'm really not sure how to even start solving this problem, so any hints would be great. I'll provide whatever information that will be helpful to solving this issue.

  • 1
    I vaguely recall hearing a while back that systemd, the default init system going forward from the current "Jessie" version of Debian and thus Raspbian which is derived from it once had problems with encrypted file-systems. I'm guessing that at least some part of the issues were resolved but in your particular case you might wish to consider switching back to the sysV initwhich is what that 2013 article would be expecting (it mentions the "Wheezy" version of Raspbian which is the previous version which would have had a default init of the sysV one)... – SlySven Jan 6 '17 at 19:07
  • 1
    It seems unlikely to be a problem related to systemd; I run several different standard Debian 8 systems with encrypted root partitions without problems. My suspicion is that the code to prompt for the encryption passphrase either isn't there or isn't compatible with whatever's putting up the splash screen logo. (I get a text mode prompt for the passphrase during the system boot.) When I get a chance, I'll compare the startup scripts on my Pi and on one of my Debian laptops. – Curt J. Sampson Apr 5 '17 at 16:07
  • Regarding the DHCP. Lock it directly on your router. Not on the devices. It could be a pain in the arse otherwise. – kuzeyron Sep 10 '17 at 17:56
0

Disable any splash screen and check the output during boot time. In the cmdline.txt (in /boot/cmdline.txt) make sure you have rootwait logo.nologo nosplash.

There must have been a problem with your update or the initramfs. Make sure you include the proper modules into it by pointing to the target kernel version like so: sudo mkinitramfs -o /boot/initramfs.gz -k -v 4.14.78-v7+ This will target the kernel module of that specific version installed, and grab all modules fro /lib/modules/ properly.

If there is a mismatch, there could be problems with loading the right kernel modules. Also check your initramfs-tools.conf and hooks / scripts.

Regarding the IP, you can have a fixed IP with he "IP=" kernel boot parameter. But it would be best to configure that on the DHCP server, which is most likely your router.

-1

Try to revert firmware back and then try again:

To revert give the github commit hash.

To upgrade/downgrade to a specific firmware revision, specify its Git hash (from the https://github.com/Hexxeh/rpi-firmware repository) as follows:

sudo rpi-update fab7796df0cf29f9563b507a59ce5b17d93e0390


And to try upgrading again use:

sudo apt-get update && sudo apt-get upgrade
sudo shutdown -r now

Then after that process finishes update to the next rpi-update:

sudo BRANCH=next rpi-update
sudo shutdown -r now

After that you should be able to fallow the instructions here

make sure to skip the first 2 code blockes as I just modified those and gave the working one above!

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.