Technic Dynamic is a source of education focused in the following categories of technology: (Computer - Design - Gadgets - Networking - Security) Link : http://technicdynamic.com
Main » 2012 » February » 8 » Chapter 7 : Booting Into Your New Ubuntu System | 2. Mounting encrypted volumes
0:30 AM
Chapter 7 : Booting Into Your New Ubuntu System | 2. Mounting encrypted volumes
Mounting encrypted volumes
If you created encrypted volumes during the installation and assigned
them mount points, you will be asked to enter the passphrase for each
of these volumes during the boot. The actual procedure differs
slightly between dm-crypt and loop-AES.
dm-crypt
For partitions encrypted using dm-crypt you will be shown the following
prompt during the boot:
Starting early crypto disks... part_crypt(starting)
Enter LUKS passphrase:
In the first line of the prompt, part is the
name of the underlying partition, e.g. sda2 or md0.
You are now probably wondering
for which volume you are actually entering the
passphrase. Does it relate to your /home? Or to
/var? Of course, if you have just one encrypted
volume, this is easy and you can just enter the passphrase you used
when setting up this volume. If you set up more than one encrypted
volume during the installation, the notes you wrote down as the last
step in the section called "Configuring Encrypted Volumes” come in handy. If you did not
make a note of the mapping between
part_crypt and the mount
points before, you can still find it
in /etc/crypttab
and /etc/fstab of your new system.
The prompt may look somewhat different when an encrypted root file system is
mounted. This depends on which initramfs generator was used to generate the
initrd used to boot the system. The example below is for an initrd generated
using initramfs-tools:
No characters (even asterisks) will be shown while entering the passphrase.
If you enter the wrong passphrase, you have two more tries to correct it.
After the third try the boot process will skip this volume and continue to
mount the next filesystem. Please see the section called "Troubleshooting”
for further information.
After entering all passphrases the boot should continue as usual.
loop-AES
For partitions encrypted using loop-AES you will be shown the following
prompt during the boot:
Checking loop-encrypted file systems.
Setting up /dev/loopX (/mountpoint)
Password:
No characters (even asterisks) will be shown while entering the passphrase.
If you enter the wrong passphrase, you have two more tries to correct it.
After the third try the boot process will skip this volume and continue to
mount the next filesystem. Please see the section called "Troubleshooting”
for further information.
After entering all passphrases the boot should continue as usual.
Troubleshooting
If some of the encrypted volumes could not be mounted because a wrong
passphrase was entered, you will have to mount them manually after the
boot. There are several cases.
The first case concerns the root partition. When it is not mounted
correctly, the boot process will halt and you will have to reboot the
computer to try again.
The easiest case is for encrypted volumes holding data like
/home or /srv. You can
simply mount them manually after the boot. For loop-AES this is
a one-step operation:
#mount /mount_pointPassword:
where /mount_point should be replaced by
the particular directory (e.g. /home). The only
difference from an ordinary mount is that you will be asked to enter
the passphrase for this volume.
For dm-crypt this is a bit trickier. First you need to register the
volumes with device mapper by running:
#/etc/init.d/cryptdisks start
This will scan all volumes mentioned
in /etc/crypttab and will create appropriate
devices under the /dev directory after entering
the correct passphrases. (Already registered volumes will be skipped,
so you can repeat this command several times without worrying.) After
successful registration you can simply mount the volumes the usual
way:
#mount /mount_point
If any volume holding noncritical system files could not be mounted
(/usr or /var), the system
should still boot and you should be able to mount the volumes manually
like in the previous case. However, you will also need to (re)start
any services usually running in your default runlevel because it is
very likely that they were not started. The easiest way to achieve
this is by switching to the first runlevel and back by entering
#init 1
at the shell prompt and pressing Control+D when asked for the root password.
