Sample Header Ad - 728x90

LUKS password correct, but not accepted

3 votes
1 answer
888 views
I am attempting to install Kali on a laptop, which should normally be straightforward. However, on this particular device, the Kali installer errors upon writing the partition changes to disk for some reason. I was previously able to get around this issue by partitioning the drive manually via fdisk. Kali was running great. However, I was lacking disk encryption. So, I wiped the drive and set out to partition and configure Kali manually, with LUKS encryption. I found an article for this which I was able to follow with only a few deviations https://devconnected.com/how-to-encrypt-root-filesystem-on-linux/ The partition scheme I ended up with is as follows Disk /dev/sda: 465.76 GiB, 500107862016 bytes, 976773168 sectors Disk model: WDC WD5000LPVX-7 Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 4096 bytes I/O size (minimum/optimal): 4096 bytes / 4096 bytes Disklabel type: gpt Disk identifier: C6EB1185-05CF-4E8D-ABAC-1376C75628F8 Device Start End Sectors Size Type /dev/sda1 2048 1953791 1951744 953M Linux filesystem /dev/sda2 1953792 3907583 1953792 954M EFI System /dev/sda3 3907584 976773119 972865536 463.9G Linux filesystem With sda1 as /boot (needed due to BIOS legacy boot things), sda2 as /boot/efi and sda3 as my root encrypted filesystem. This scheme worked for an unencrypted Kali install, so all I needed was to setup LUKS. Using cryptsetup as detailed in the article I have the following for sda $ lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS sda 8:0 0 465.8G 0 disk ├─sda1 8:1 0 953M 0 part ├─sda2 8:2 0 954M 0 part └─sda3 8:3 0 463.9G 0 part └─crypto 254:0 0 463.9G 0 crypt ├─cryptVG-swap 254:1 0 2G 0 lvm └─cryptVG-root 254:2 0 461.9G 0 lvm I am running Kali on a live USB to setup my laptop hard drive, and the article details moving an existing OS install over to an encrypted install. I can't rsync the live medium files and have the OS work like an actual (not live) install, so I simply used Kali's installer to write the install to a USB as if it were a hard drive (unsure why the installer writes partitions fine to a USB yet not my disk, but w/e). I was then able to mount both and rsync the USB's root file system to my encrypted disk. This seemed to work like a charm. I was also able to reinstall grub as detailed without major issues, after a small change in that section. Basically I used --rbind when mounting /dev before chrooting to avoid a sudo error, and I also needed to mount/bind proc before chrooting too. After chrooting successfully I still got an error stating that the hostname "kali" couldn't be resolved anytime I ran sudo, but it didn't seem to impact the commands I was running so I ignored it. My grub setup ended up as follows: UUIDs $ lsblk -f NAME FSTYPE FSVER LABEL UUID FSAVAIL FSUSE% MOUNTPOINTS sda ├─sda1 │ vfat FAT32 9080-831D ├─sda2 │ vfat FAT32 345D-5BB8 └─sda3 crypto 2 f0b2bee7-9566-4178-9a3a-6ffee87482df └─crypto LVM2_m LVM2 6t1L5r-GdTD-Fda4-A3D7-OjMI-DiI9-mKM76J ├─cryptVG-swap │ swap 1 9d7471b5-cd00-477b-a599-48517194122c └─cryptVG-root ext4 1.0 740ca216-99a9-46ee-a2c2-fa2dbde2ccb7 417.1G 3% /mnt /etc/fstab $ cat /mnt/etc/fstab # # root UUID=740ca216-99a9-46ee-a2c2-fa2dbde2ccb7 / ext4 errors=remount-ro 0 1 # efi UUID=345D-5BB8 /boot/efi vfat umask=0077 0 1 # swap UUID=9d7471b5-cd00-477b-a599-48517194122c none swap sw 0 0 /etc/crypttab $ cat /mnt/etc/crypttab # crypt UUID=f0b2bee7-9566-4178-9a3a-6ffee87482df none luks Based on these configs it *seems* like I should be able to boot into the OS fine. I have the UUIDs correct as far as I can tell and I have grub stage 1 installed fine because it prompts me for a password to unlock the device. However, while I am able to unlock /dev/sda3 with my password using cryptsetup luksOpen /dev/sda3 crypto, using this same password on the boot screen gives me an incorrect password error. Upon booting into sda I see Enter passphrase for hd0,gpt3 (f0b2bee7-9566-4178-9a3a-6ffee87482df): And upon entering the correct password it immediately prints error: Invalid passphrase error: no such cryptodisk found error: disk `lvmid/kJKtcZ-eQPE-zpEE-r5hz-MWlz-WdzV-hg2lMF/GAVDs1-caOS-pBlM-bQsb-MDyN-2LdM-nyQveG' not found grub rescue> **Why can grub not unlock my LUKS drive while cryptsetup can? How can I fix grub so it can?** *I understand this is technically an XY problem but I have tried solving X (Kali installer failure) without success as it seems no one else has my issue, and I am so close to solving Y at this point I don't think it matters. Plus I want to learn more about grub.* Edit: luksDump info $ sudo cryptsetup luksDump /dev/sda3 LUKS header information Version: 2 Epoch: 3 Metadata area: 16384 [bytes] Keyslots area: 16744448 [bytes] UUID: f0b2bee7-9566-4178-9a3a-6ffee87482df Label: (no label) Subsystem: (no subsystem) Flags: (no flags) Data segments: 0: crypt offset: 16777216 [bytes] length: (whole device) cipher: aes-xts-plain64 sector: 4096 [bytes] Keyslots: 0: luks2 Key: 512 bits Priority: normal Cipher: aes-xts-plain64 Cipher key: 512 bits PBKDF: argon2id Time cost: 4 Memory: 1048576 Threads: 4 Salt: 73 ... 12 AF stripes: 4000 AF hash: sha256 Area offset:32768 [bytes] Area length:258048 [bytes] Digest ID: 0 Tokens: Digests: 0: pbkdf2 Hash: sha256 Iterations: 77101 Salt: c2 ... 80 Digest: c7 ... 43
Asked by ExecutionByFork (531 rep)
Dec 15, 2023, 04:40 AM
Last activity: Jan 22, 2025, 06:26 PM