![无法将 LUKS 密钥添加到加密交换中](https://linux22.com/image/149363/%E6%97%A0%E6%B3%95%E5%B0%86%20LUKS%20%E5%AF%86%E9%92%A5%E6%B7%BB%E5%8A%A0%E5%88%B0%E5%8A%A0%E5%AF%86%E4%BA%A4%E6%8D%A2%E4%B8%AD.png)
由于某种原因,我无法将密钥添加到我的加密交换中。
我的/etc/crypttab
:
swap_crypt /dev/disk/by-partuuid/c4f049d5-ae21-44d6-b753-6e72b7e21770 none luks,swap,discard,keyscript=decrypt_keyctl
root_crypt UUID=26f3c181-e041-47f2-929b-de631a2f1d3f none luks,discard,keyscript=decrypt_keyctl
因此要识别这些磁盘:
# ls -l /dev/disk/by-partuuid/c4f049d5-ae21-44d6-b753-6e72b7e21770
lrwxrwxrwx 1 root root 15 Mar 5 22:34 /dev/disk/by-partuuid/c4f049d5-ae21-44d6-b753-6e72b7e21770 -> ../../nvme0n1p7
# blkid |grep 26f3c181-e041-47f2-929b-de631a2f1d3f
/dev/nvme0n1p8: UUID="26f3c181-e041-47f2-929b-de631a2f1d3f" TYPE="crypto_LUKS" PARTUUID="b178ae44-cf49-4dce-b7b5-293c9c0bb9c7"
所以我知道我的交换已打开/dev/nvme0n1p7
并且我的根已打开/dev/nvme0n1p8
。
现在,当我尝试添加 root 密钥时:
# cryptsetup luksAddKey /dev/nvme0n1p8
Enter any existing passphrase:
然而,对于交换来说,一切正常:
# cryptsetup luksAddKey /dev/nvme0n1p7
它就退出了。更多信息:
# cryptsetup luksAddKey -v --debug /dev/nvme0n1p7
# cryptsetup 2.0.2 processing "cryptsetup luksAddKey -v --debug /dev/nvme0n1p7"
# Running command luksAddKey.
# Locking memory.
# Installing SIGINT/SIGTERM handler.
# Unblocking interruption on signal.
# Allocating context for crypt device /dev/nvme0n1p7.
# Trying to open and read device /dev/nvme0n1p7 with direct-io.
# Initialising device-mapper backend library.
# Trying to load any crypt type from device /dev/nvme0n1p7.
# Crypto backend (gcrypt 1.8.1) initialized in cryptsetup library version 2.0.2.
# Detected kernel Linux 5.0.0-050000-generic x86_64.
# Loading LUKS2 header.
# Opening lock resource file /run/cryptsetup/L_259:7
# Acquiring read lock for device /dev/nvme0n1p7.
# Verifying read lock handle for device /dev/nvme0n1p7.
# Device /dev/nvme0n1p7 READ lock taken.
# Trying to read primary LUKS2 header at offset 0.
# Opening locked device /dev/nvme0n1p7
# Veryfing locked device handle (bdev)
# Trying to read secondary LUKS2 header at offset 8192.
# Opening locked device /dev/nvme0n1p7
# Veryfing locked device handle (bdev)
# Trying to read secondary LUKS2 header at offset 16384.
# Opening locked device /dev/nvme0n1p7
# Veryfing locked device handle (bdev)
# Trying to read secondary LUKS2 header at offset 32768.
# Opening locked device /dev/nvme0n1p7
# Veryfing locked device handle (bdev)
# Trying to read secondary LUKS2 header at offset 65536.
# Opening locked device /dev/nvme0n1p7
# Veryfing locked device handle (bdev)
# Trying to read secondary LUKS2 header at offset 131072.
# Opening locked device /dev/nvme0n1p7
# Veryfing locked device handle (bdev)
# Trying to read secondary LUKS2 header at offset 262144.
# Opening locked device /dev/nvme0n1p7
# Veryfing locked device handle (bdev)
# Trying to read secondary LUKS2 header at offset 524288.
# Opening locked device /dev/nvme0n1p7
# Veryfing locked device handle (bdev)
# Trying to read secondary LUKS2 header at offset 1048576.
# Opening locked device /dev/nvme0n1p7
# Veryfing locked device handle (bdev)
# Trying to read secondary LUKS2 header at offset 2097152.
# Opening locked device /dev/nvme0n1p7
# Veryfing locked device handle (bdev)
# Trying to read secondary LUKS2 header at offset 4194304.
# Opening locked device /dev/nvme0n1p7
# Veryfing locked device handle (bdev)
# LUKS2 header read failed (-22).
# Device /dev/nvme0n1p7 READ lock released.
# Releasing crypt device /dev/nvme0n1p7 context.
# Releasing device-mapper backend.
# Unlocking memory.
Command failed with code -1 (wrong or missing parameters).
知道问题是什么吗?
答案1
如果加密交换不打算用作休眠恢复设备,则通常使用随机生成的密钥进行初始化,该密钥不会永久存储在任何地方。这提供了相当有力的保证,一旦系统正确关闭,任何分析交换区域内容的取证尝试都将毫无用处。
由于一旦加密设备关闭,RAM 中此类非持久密钥的唯一副本将作为正常关闭的一部分被主动清零,因此在完全关闭后从 RAM 内容恢复密钥的任何尝试也将毫无用处。
crypttab
您包含该选项的事实swap
表明该方案可能正在使用:该swap
选项导致在初始化加密后cryptsetup
运行,只有当交换分区的现有内容不可读的乱码时才需要......即用不同的非持久密钥。mkswap
/dev/mapper/swap_crypt
使用systemd
init 系统时,该keyscript=
选项可能会被忽略,并systemd
使用 的 cryptsetup 帮助程序,具体取决于您的 Linux 发行版所做的选择。详情请参阅man systemd-cryptsetup-generator
和。man [email protected]
答案2
所以我最终自己解决了这个问题。对于遇到此问题的任何人,请确保运行时cryptsetup status /dev/mapper/<device>
类型是LUKS1
而不是PLAIN
。 Ubuntu 安装程序默认设置不正确,因此标准 LUKS 命令无法在该设备上运行。由于它是交换,我能够正确地重新创建加密,现在一切顺利。