I encrypted Raspbian using
aes-cbc-essiv:sha256 algorithm with 256-bit key using LUKS and configured it to remotely unlocking.
I followed these tutorials:
- https://learn.adafruit.com/resizing-raspberry-pi-boot-partition/edit-partitions (for know how to extend boot partition),
- https://robpol86.com/raspberry_pi_luks.html (for know how to prepare LUKS encrypted Raspbian),
- http://paxswill.com/blog/2013/11/04/encrypted-raspberry-pi/ (for know how to prepare Dropbear and its keys),
- https://sowhatisthesolution.wordpress.com/2016/03/20/unlock-luks-via-ssh-in-debian/ (for know how to establish internet connection during initramfs boot),
- https://stinkyparkia.wordpress.com/2014/10/14/remote-unlocking-luks-encrypted-lvm-using-dropbear-ssh-in-ubuntu-server-14-04-1-with-static-ipst/ (for copy and paste
When I'm trying establish ssh connection with encrypted device, I'm dropped into BusyBox shell and everything work:
hubot@debian:~$ ssh -i ~/.ssh/id_rsa_rpi_dropbear email@example.com To unlock root-partition run unlock BusyBox v1.22.1 (Raspbian 1:1.22.0-9+deb8u1) built-in shell (ash) Enter 'help' for a list of built-in commands. ~ # unlock Please unlock disk /dev/mmcblk0p2 (sdcard): cryptsetup: sdcard set up successfully Connection to 192.168.1.3 closed.
However, if I'm trying ssh connect with unlocked device, I'm getting following error on my client PC:
hubot@debian:~$ ssh pi@raspberrypi ssh: connect to host raspberrypi port 22: Connection refused
When Raspberry Pi boots, I can see following error:
Error: unexpectedly disconnected from boot status daemon
This error doesn’t seem to happen if LUKS passphrase is directly entered at the server console.
but I want to be able remotely log in ssh into unlocked encrypted device. Can anyone help me?