Unlocking LUKS with a USB drive

[Mateusz Marzantowicz]

On 22.08.2013 06:37, odiegit at aol.com wrote:
> 
> Hello. I am using Fedora 19 and would like to be able to unlock the LUKS
> root partition on my hard drive using a two factor authentication of
> both a passphrase and a sector stored on a USB flash drive.
> Accomplishing this requires modifying the boot process to read a USB device.
> 
> This post <http://forums.fedoraforum.org/showthread.php?t=241942>
> <http://forums.fedoraforum.org/showthread.php?t=241942%3E>; also
> available on <http://www.gaztronics.net/howtos/luks.php>
> <http://www.gaztronics.net/howtos/luks.php%3E>; gives information on
> accomplishing the unlock step using a USB key, but it does not work for
> Fedora 19. I also found a bug filed which appears to be related
> <https://bugzilla.redhat.com/show_bug.cgi?id=459485>
> <https://bugzilla.redhat.com/show_bug.cgi?id=459485%3E>.
> 
> The problem I am having is that the boot process's unlocking of the LUKS
> container is no longer carried out by
> /usr/lib/dracut/modules.d/90crypt/cryptroot-ask.sh as it was in past
> versions of Fedora. I deleted the entire contents of that file and
> Fedora was still able to boot properly and asked me the password to the
> LUKS partition. My question then is, what scripts carry out the LUKS
> unlock step in the boot process of Fedora 19? And can they be modified
> directly like cryptroot-ask.sh was?
> 
> Thank you,
> Odie5533
> 
> 

Now, unlocking of LUKS partitions is handled by systemd
(src/cryptsetup/*) but as you already know it doesn't work. I don't know
if it's a bug or not implements yet feature but it worked with dracut
and doesn't work with systemd.

There is a temporary workaroud that enables key based unlocking. You
have to edit /etc/dracut.conf and add omit_dracutmodules+=" systemd ".
Then regenerate initramfs.

For two factor unlocking you may have to modify systemd or dracut.


Mateusz Marzantowicz