I am using a raspberry pi 2 stretch and have a working set up where the root partition is encrypted using luks and can be remotely mounted via entering the password via ssh (dropbear and initramfs). The luks root partition is located on the local SD card. Now I want to move the encrypted luks root partition to an external USB HDD drive and I am failing... I am able to connect via dropbear and enter the password. The dropbear session drops but I can not connect via ssh after that to the actual session. Can anybody spot an issue below?
I copied the root partition from SD-card to USD HDD on a linux machine with both devices connected by the following:
# copy sd card
dd if=/dev/sdcard of=/tmp/root.img bs=4M
e2fsck -f /tmp/root.img
resize2fs -M /tmp/root.img
# create luks partition on usb hdd
sudo cryptsetup -v -y --cipher aes-cbc-essiv:sha256 --key-size 256 luksFormat /dev/usbhdd
sudo cryptsetup -v luksOpen /dev/usbhdd crypt
# copy root partition from sd card to hdd
sudo dd if=/tmp/root.img of=/dev/mapper/crypt bs=4M
sudo e2fsck /dev/mapper/crypt
sudo resize2fs /dev/mapper/crypt
Finally, I attached the usb hdd and sd card back to the raspberry and recreated the initramfs on the raspberry by:
sudo mkinitramfs -o /boot/initramfs.gz
The changed configuration files on boot and root partition look like this:
cmdline.txt on SD-card boot partition:
dwc_otg.lpm_enable=0 console=serial0,115200 console=tty1 root=/dev/mapper/crypt cryptdevice=/dev/sda1:crypt rootfstype=ext4 elevator=deadline fsck.repair=yes rootwait rootdelay=5
config.txt on SD-card boot partition (added the following lines):
initramfs initramfs.gz followkernel
program_usb_timeout=1
/etc/fstab on SD-card and USB HDD root partition:
proc /proc proc defaults 0 0
PARTUUID=c406c9b7-01 /boot vfat defaults 0 2
/dev/mapper/crypt / ext4 defaults,noatime 0 1
# a swapfile is not a swap partition, no line here
# use dphys-swapfile swap[on|off] for that
/etc/crypttab on SD-card and USB HDD root partition:
crypt /dev/sda1 none luks
etc/dropbear-initramfs/authorized_keys on SD-card and USB HDD root partition:
command="/scripts/local-top/cryptroot && kill -9 `ps | grep -m 1 'cryptroot' | cut -d ' ' -f 3` && exit"
ecdsa-sha2-nistp256 xxxx xx@xx
etc/cryptsetup-initramfs/conf-hook on SD-card and USB HDD root partition:
CRYPTSETUP=y
In addition I added the following script as etc/kernel/postinst.d/initramfs-rebuild:
#!/bin/sh -e
# Rebuild initramfs.gz after kernel upgrade to include new kernel's modules.
# https://github.com/Robpol86/robpol86.com/blob/master/docs/_static/initramfs-rebuild.sh
# Save as (chmod +x): /etc/kernel/postinst.d/initramfs-rebuild
# Remove splash from cmdline.
if grep -q '\bsplash\b' /boot/cmdline.txt; then
sed -i 's/ \?splash \?/ /' /boot/cmdline.txt
fi
# Exit if not building kernel for this Raspberry Pi's hardware version.
version="$1"
current_version="$(uname -r)"
case "${current_version}" in
*-v7+)
case "${version}" in
*-v7+) ;;
*) exit 0
esac
;;
*+)
case "${version}" in
*-v7+) exit 0 ;;
esac
;;
esac
# Exit if rebuild cannot be performed or not needed.
[ -x /usr/sbin/mkinitramfs ] || exit 0
[ -f /boot/initramfs.gz ] || exit 0
lsinitramfs /boot/initramfs.gz |grep -q "/$version$" && exit 0 # Already in initramfs.
# Rebuild.
mkinitramfs -o /boot/initramfs.gz "$version"
