0

I wish to make use of full disk encryption using Luks on ubuntu 14.04. However, i wish to make use of my own python script to carry out the functionality of generating the decryption key during device boot, which it then sends to lukes to allow it to decrypt.

Ideally I would like "outcome from python script" + "user enters decryption key", which is then passed to lukes to allow the device to decrypt. I can then implement my own functionality in the python to create a 'second factor' to allow the device to decrypt.

I have searched around, but haven't really found the answer to my question. Can you help or provide any advice?

Thank you.

1 Answer 1

2

If you use full disk encryption for your root filesystem then you will have to solve the problem that the Python interpreter is normally not available early at boot. You will need several megabytes of additional unencrypted disk space to store for example /usr/bin/python2.7 and a bunch of essential stuff from /usr/lib/python2.7 and you will have to develop several modifications to your /boot/initrd in order to make this work.

The boot process invokes /scripts/local-top/cryptroot from the initrd root. This normally calls the tool plymouth ask-for-password --prompt. This is used to ask the user for the passphrase before the graphical user interface is started. This passphrase is in turn piped into cryptsetup.

If you still really want to continue with this approach you can/should use a configuration file in the configuration directory /etc/initramfs-tools/ to configure a new value for your own cryptkeyscript instead of hacking the script /usr/share/initramfs-tools/scripts/local-top/cryptroot directly. This will make the installation of OS distribution updates less cumbersome later.

For more information refer to the documentation of the packages initramfs-tools, cryptsetup and plymouth and have a look into the shell script cryptroot I mentioned above.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .