Mount LUKS root from USB HDD Raspberry 2

Question

I am using a raspberry pi 2 stretch and have a working set up where the root partition is encrypted using luks and can be remotely mounted via entering the password via ssh (dropbear and initramfs). The luks root partition is located on the local SD card. Now I want to move the encrypted luks root partition to an external USB HDD drive and I am failing... I am able to connect via dropbear and enter the password. The dropbear session drops but I can not connect via ssh after that to the actual session. Can anybody spot an issue below?

I copied the root partition from SD-card to USD HDD on a linux machine with both devices connected by the following:

    # copy sd card
    dd if=/dev/sdcard of=/tmp/root.img bs=4M
    e2fsck -f /tmp/root.img
    resize2fs -M /tmp/root.img   

    # create luks partition on usb hdd
    sudo cryptsetup -v -y --cipher aes-cbc-essiv:sha256 --key-size 256 luksFormat /dev/usbhdd
    sudo cryptsetup -v luksOpen /dev/usbhdd crypt

    # copy root partition from sd card to hdd
    sudo dd if=/tmp/root.img of=/dev/mapper/crypt bs=4M
    sudo e2fsck /dev/mapper/crypt
    sudo resize2fs /dev/mapper/crypt

Finally, I attached the usb hdd and sd card back to the raspberry and recreated the initramfs on the raspberry by:

sudo mkinitramfs -o /boot/initramfs.gz

The changed configuration files on boot and root partition look like this:

cmdline.txt on SD-card boot partition:

    dwc_otg.lpm_enable=0 console=serial0,115200 console=tty1 root=/dev/mapper/crypt cryptdevice=/dev/sda1:crypt rootfstype=ext4 elevator=deadline fsck.repair=yes rootwait rootdelay=5

config.txt on SD-card boot partition (added the following lines):

initramfs initramfs.gz followkernel
program_usb_timeout=1

/etc/fstab on SD-card and USB HDD root partition:

    proc            /proc           proc    defaults          0       0
PARTUUID=c406c9b7-01  /boot           vfat    defaults          0       2
/dev/mapper/crypt  /               ext4    defaults,noatime  0       1
# a swapfile is not a swap partition, no line here
#   use  dphys-swapfile swap[on|off]  for that

/etc/crypttab on SD-card and USB HDD root partition:

crypt   /dev/sda1   none    luks

etc/dropbear-initramfs/authorized_keys on SD-card and USB HDD root partition:

command="/scripts/local-top/cryptroot && kill -9 `ps | grep -m 1 'cryptroot' | cut -d ' ' -f 3` && exit"
ecdsa-sha2-nistp256 xxxx xx@xx

etc/cryptsetup-initramfs/conf-hook on SD-card and USB HDD root partition:

CRYPTSETUP=y

In addition I added the following script as etc/kernel/postinst.d/initramfs-rebuild:

#!/bin/sh -e

# Rebuild initramfs.gz after kernel upgrade to include new kernel's modules.
# https://github.com/Robpol86/robpol86.com/blob/master/docs/_static/initramfs-rebuild.sh
# Save as (chmod +x): /etc/kernel/postinst.d/initramfs-rebuild

# Remove splash from cmdline.
if grep -q '\bsplash\b' /boot/cmdline.txt; then
  sed -i 's/ \?splash \?/ /' /boot/cmdline.txt
fi

# Exit if not building kernel for this Raspberry Pi's hardware version.
version="$1"
current_version="$(uname -r)"
case "${current_version}" in
  *-v7+)
    case "${version}" in
      *-v7+) ;;
      *) exit 0
    esac
  ;;
  *+)
    case "${version}" in
      *-v7+) exit 0 ;;
    esac
  ;;
esac

# Exit if rebuild cannot be performed or not needed.
[ -x /usr/sbin/mkinitramfs ] || exit 0
[ -f /boot/initramfs.gz ] || exit 0
lsinitramfs /boot/initramfs.gz |grep -q "/$version$" && exit 0  # Already in initramfs.

# Rebuild.
mkinitramfs -o /boot/initramfs.gz "$version"

Answer 1

.... sry guys... sometimes just writing a post and just starting from scratch helps... it works as described above. Just had to start from preconditions – something was corrupted while playing around making it work.