2

I try to setup Ubuntu with full disc encryption on top of Hetzner Cloud. I got everything to work except the network connection in initramfs. Thanks to the UI console its possible to unlock, but I need SSH (dropbear) in init. I successfully using the same configuration on their root servers without any issues.

If I setup dropbear to get the IP by dhcp always resulting in NETWORK IS UNREACHABLE. But it gets the right parameters from the dhcp server. I asked Hetzner Support. They told me they think the dhcp client does not support RFC 3442 Classless Static Routes Option and recommended to add a static route with ip r a 172.31.1.1 dev ens3. Like on this Question I added the route, but always got the same error: NETWORK IS UNREACHABLE. I tested to set the route in different scripts, but nothing changed. I tested Ubuntu 16.04 and 18.04.

I'am happy about any recommends about this. Thanks!

2

had same problem / small discussion with tech support that it cannot be that the initramfs fails only in Hetzner cloud instances like this.

But Hetzner Support repeately states only that their DHCP server are compliant to RFC3442 which announces the default host route to the internal cloud GW. So this must be a problem of the initramfs dhcp client and they couldn't (wouldn't ?) try setup a perhaps possible BootP response e.g. with the right IP=... parameter.

I suggested to update their documentation for this but it seems the "feel free to use our wiki for documentation" ... The (marketing ;) ... ) answer here is then not right:

Hetzner_OL 6 months ago [-]

Thanks for the suggestion about Docker/dbaas. I have passed it on to our development team. We don't usually publish what new products and features we are developing until they are ready, but we will continue to post information about upgrades as they develop.

Regarding the DSGVO: Do you support encryption of the filesystem? ->

Hetzner Cloud servers are fully virtualized. So the customer can even fully encrypt the whole server. --Katie, Marketing, Hetzner Online

I tried finding questions/solutions for this problem but the only match I found today is your question ;)

Your referenced answer for setup the interface is partly correct. But from question it wasn't clear that he also needs a static host route to the gateway so it's missing in the answer.

My quick solution of the problem is to patch manually the needed function like this "dynamically" - you can check all your variables in /run/net-ens3.conf:

root@image-debian-jessie-94 ~ # diff -p /usr/share/initramfs-tools/scripts/functions{.orig,}
*** /usr/share/initramfs-tools/scripts/functions.orig   2018-07-31 12:46:40.911167456 +0200
--- /usr/share/initramfs-tools/scripts/functions        2018-07-31 12:50:30.736742035 +0200
*************** configure_networking()
*** 274,279 ****
--- 274,284 ----
                # ipconfig should have quit after first response
                . /run/net-*.conf
        fi
+
+       # Hack for Hetzner vServer static route enhanced like shown partly in this answer:
+       # https://serverfault.com/questions/909040/static-route-in-initramfs
+       ip route add ${IPV4GATEWAY}/${IPV4NETMASK} dev ${DEVICE}
+       ip route add default via ${IPV4GATEWAY} dev ${DEVICE}
  }

  # Wait for queued kernel/udev events

Tested and worked fine for me. I could setup / snapshot the smallest image.

The encrypted snapshot is ~18 GB compared to 0,5 GB unencrypted but snapshot price is still fine compared to improved security (normally Openstack based systems could/should have a key manager service which can this transparently. ;)

  • To enhance above answer: I found out that the image can be made smaller by run the cloud instance itself in rescue mode and encrypt only the minimal size of 1500 MB - here my basic calls to install script splitted in two parts: SERVER_USER="root" DEBIAN_VER="9" SSH_CALL="sshpass -p ${SERVER_PASS} ssh -akx -i $(ls /srv/pillar/salt-cloud/*.pem | head -n 1) -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o IdentitiesOnly=yes ${SERVER_USER}@${SERVER_IP}" – Reiner030 Feb 27 at 21:13
  • DEBIAN_IMAGE="$(${SSH_CALL} ls /root/.oldroot/nfs/install/../images/Debian-${DEBIAN_VER}*-minimal.tar.gz | sort | tail -1)" ${SSH_CALL} /root/.oldroot/nfs/install/installimage -n ${MINION_ID} -i ${DEBIAN_IMAGE} -p /boot:ext3:512M,lvm:VGcrypt:1536M \ -v VGcrypt:root:/:ext4:1500M \ -b grub -r no -g -d sda -s en -a – Reiner030 Feb 27 at 21:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.