2

I encrypted Raspbian using aes-cbc-essiv:sha256 algorithm with 256-bit key using LUKS and configured it to remotely unlocking.

I followed these tutorials:

When I'm trying establish ssh connection with encrypted device, I'm dropped into BusyBox shell and everything work:

hubot@debian:~$ ssh -i ~/.ssh/id_rsa_rpi_dropbear root@192.168.1.3
To unlock root-partition run unlock


BusyBox v1.22.1 (Raspbian 1:1.22.0-9+deb8u1) built-in shell (ash)
Enter 'help' for a list of built-in commands.

~ # unlock
Please unlock disk /dev/mmcblk0p2 (sdcard): 
cryptsetup: sdcard set up successfully
Connection to 192.168.1.3 closed.

However, if I'm trying ssh connect with unlocked device, I'm getting following error on my client PC:

hubot@debian:~$ ssh pi@raspberrypi
ssh: connect to host raspberrypi port 22: Connection refused

When Raspberry Pi boots, I can see following error:

Error: unexpectedly disconnected from boot status daemon

On https://stinkyparkia.wordpress.com/2014/10/14/remote-unlocking-luks-encrypted-lvm-using-dropbear-ssh-in-ubuntu-server-14-04-1-with-static-ipst/ author wrote:

This error doesn’t seem to happen if LUKS passphrase is directly entered at the server console.

but I want to be able remotely log in ssh into unlocked encrypted device. Can anyone help me?

  • After you boot into device with remote password. Can you attempt to manually restart ssh daemon service ssh restart or print the daemon status service ssh status, there is a chance that the socket is still bound when the service starts. – crasic Aug 15 '17 at 22:32
  • @crasic the output from service ssh status: paste.asie.pl/pUci, after restarting ssh service I can log in into ssh. – java-devel Aug 15 '17 at 22:39
  • Aha, well there is your problem, unfortunately the status, as always, is rather uninformative. We do know that the service fails to start. The most likely root cause is that dropbear has the port still bound when it starts systemd and proceeds to boot. See if there are any messages in kernel log dmesg | grep ssh – crasic Aug 15 '17 at 22:47
  • @crasic The output from dmesg: paste.asie.pl/jefg – java-devel Aug 15 '17 at 22:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.