# Getting luks key off of USB stick

## CoderMan

Hi. I've got a 32-bit Gentoo system on a Dell netbook, and I have one hard drive with two partions: /dev/sda1 is the /boot partition and /dev/sda2 is an luks encrypted partition I made with cryptsetup. I was trying to make it possible to gain access to /dev/sda2 without typing in a password, but instead storing the key on a usb stick which I would plug in at boot time.

I found instructions for how to create the new key and then use cryptsetup to add a new key slot, and this seems to have work fine:

 *Quote:*   

> If you want the USB stick to be sufficient to access your data,
> 
> 1. mkfs/mount your USB stick
> 
> 2. generate a key file directly onto the USB stick (for example, a 2048bit key): dd if=/dev/random of=/mnt/usbstick/keyfile bs=1 count=256
> ...

 

However, I am having trouble getting the kernel/initrd to actually be able to read the keyfile off the usb stick during boot. My kernel was built with genkernel, so I looked in the man page:

 *Quote:*   

>        root_key=<...>
> 
>               In  case  your  root  is encrypted with a key, you can use a device
> 
>               like a usb pen to store the key.  This value should be the key path
> ...

 

Here is my normal grub options:

 *Quote:*   

> 
> 
> title Gentoo Linux 2.6.30-r6
> 
> root (hd0,0)
> ...

 

I tried changing the kernel options like so:

 *Quote:*   

> 
> 
> kernel /boot/kernel-genkernel-x86-2.6.30-gentoo-r6 root=/dev/ram0 crypt_root=/dev/sda2 dol\
> 
> vm real_root=/dev/vg0/gentoo root_key=/keyfile root_keydev=/dev/sdc1

 

But when I boot it tells me that it cannot find the keyfile in /dev/sdc1 and asks for a different device. I tried leaving off the root_keydev part to let it figure it out by itself, but same results. One time I dropped into the initrd ash shell to see if I could figure out what device node was being used, but it was not listed as anything! Only /dev/sda1 and /dev/sda2 partitions (from the harddrive) are listed in /dev.

I thought maybe the problem was that the usb stick was formatted in vfat format, so I re-did everything but this time using an ext3 stick instead. But nothing changed.

So, it seems like the problem is that for some reason initrd is not accessing usb devices early enough, but that doesn't quite make sense to me and I'm not sure how to fix the problem.

----------

## Hu

If the device node for sdc1 is not visible, then either your kernel does not recognize the USB device, or you are using a static /dev and it was constructed without the appropriate device node.  The existence of the device node is independent of whether the kernel has the ability to interpret the filesystem on the device.  If you boot via the password, are you able to see sdc1 in the udev managed /dev directory?  If yes, check whether you have a kernel module loaded that supports the USB stick.  If such a module is loaded, you need to arrange for it to load in the initrd, or build it into the kernel.  If no such module exists, then it is likely that the kernel could handle sdc1, but nothing created the device.  If no such node exists in the running system, then you completely lack support for that stick.

----------

## CoderMan

 *Hu wrote:*   

> If the device node for sdc1 is not visible, then either your kernel does not recognize the USB device, or you are using a static /dev and it was constructed without the appropriate device node.  The existence of the device node is independent of whether the kernel has the ability to interpret the filesystem on the device.  If you boot via the password, are you able to see sdc1 in the udev managed /dev directory?  If yes, check whether you have a kernel module loaded that supports the USB stick.  If such a module is loaded, you need to arrange for it to load in the initrd, or build it into the kernel.  If no such module exists, then it is likely that the kernel could handle sdc1, but nothing created the device.  If no such node exists in the running system, then you completely lack support for that stick.

 

Yah, /dev/sdc1 is definitely there after boot up.

But it definitely isn't there when I drop into the initrd filesystem... so if the usb support was built into a module and not statically, that would explain the problem, since all my kernel modules are in the encrypted partition. Guess I'll have to go through my kernel options again to find out.

----------

## Hu

It might be easier to look at lsmod when /dev/sdc1 is present, and remove any modules that seem related.  If the device node vanishes, then you found the module which drives it.

----------

