LUKS password correct, but not accepted
3
votes
1
answer
888
views
I am attempting to install Kali on a laptop, which should normally be straightforward. However, on this particular device, the Kali installer errors upon writing the partition changes to disk for some reason. I was previously able to get around this issue by partitioning the drive manually via
fdisk
. Kali was running great. However, I was lacking disk encryption. So, I wiped the drive and set out to partition and configure Kali manually, with LUKS encryption.
I found an article for this which I was able to follow with only a few deviations
https://devconnected.com/how-to-encrypt-root-filesystem-on-linux/
The partition scheme I ended up with is as follows
Disk /dev/sda: 465.76 GiB, 500107862016 bytes, 976773168 sectors
Disk model: WDC WD5000LPVX-7
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disklabel type: gpt
Disk identifier: C6EB1185-05CF-4E8D-ABAC-1376C75628F8
Device Start End Sectors Size Type
/dev/sda1 2048 1953791 1951744 953M Linux filesystem
/dev/sda2 1953792 3907583 1953792 954M EFI System
/dev/sda3 3907584 976773119 972865536 463.9G Linux filesystem
With sda1
as /boot
(needed due to BIOS legacy boot things), sda2
as /boot/efi
and sda3
as my root encrypted filesystem. This scheme worked for an unencrypted Kali install, so all I needed was to setup LUKS.
Using cryptsetup
as detailed in the article I have the following for sda
$ lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
sda 8:0 0 465.8G 0 disk
├─sda1 8:1 0 953M 0 part
├─sda2 8:2 0 954M 0 part
└─sda3 8:3 0 463.9G 0 part
└─crypto 254:0 0 463.9G 0 crypt
├─cryptVG-swap 254:1 0 2G 0 lvm
└─cryptVG-root 254:2 0 461.9G 0 lvm
I am running Kali on a live USB to setup my laptop hard drive, and the article details moving an existing OS install over to an encrypted install. I can't rsync
the live medium files and have the OS work like an actual (not live) install, so I simply used Kali's installer to write the install to a USB as if it were a hard drive (unsure why the installer writes partitions fine to a USB yet not my disk, but w/e). I was then able to mount both and rsync the USB's root file system to my encrypted disk. This seemed to work like a charm.
I was also able to reinstall grub as detailed without major issues, after a small change in that section. Basically I used --rbind
when mounting /dev
before chrooting to avoid a sudo error, and I also needed to mount/bind proc before chrooting too. After chrooting successfully I still got an error stating that the hostname "kali" couldn't be resolved anytime I ran sudo, but it didn't seem to impact the commands I was running so I ignored it.
My grub setup ended up as follows:
UUIDs
$ lsblk -f
NAME FSTYPE FSVER LABEL UUID FSAVAIL FSUSE% MOUNTPOINTS
sda
├─sda1
│ vfat FAT32 9080-831D
├─sda2
│ vfat FAT32 345D-5BB8
└─sda3
crypto 2 f0b2bee7-9566-4178-9a3a-6ffee87482df
└─crypto
LVM2_m LVM2 6t1L5r-GdTD-Fda4-A3D7-OjMI-DiI9-mKM76J
├─cryptVG-swap
│ swap 1 9d7471b5-cd00-477b-a599-48517194122c
└─cryptVG-root
ext4 1.0 740ca216-99a9-46ee-a2c2-fa2dbde2ccb7 417.1G 3% /mnt
/etc/fstab
$ cat /mnt/etc/fstab
#
# root
UUID=740ca216-99a9-46ee-a2c2-fa2dbde2ccb7 / ext4 errors=remount-ro 0 1
# efi
UUID=345D-5BB8 /boot/efi vfat umask=0077 0 1
# swap
UUID=9d7471b5-cd00-477b-a599-48517194122c none swap sw 0 0
/etc/crypttab
$ cat /mnt/etc/crypttab
#
crypt UUID=f0b2bee7-9566-4178-9a3a-6ffee87482df none luks
Based on these configs it *seems* like I should be able to boot into the OS fine. I have the UUIDs correct as far as I can tell and I have grub stage 1 installed fine because it prompts me for a password to unlock the device. However, while I am able to unlock /dev/sda3
with my password using cryptsetup luksOpen /dev/sda3 crypto
, using this same password on the boot screen gives me an incorrect password error.
Upon booting into sda
I see
Enter passphrase for hd0,gpt3 (f0b2bee7-9566-4178-9a3a-6ffee87482df):
And upon entering the correct password it immediately prints
error: Invalid passphrase
error: no such cryptodisk found
error: disk `lvmid/kJKtcZ-eQPE-zpEE-r5hz-MWlz-WdzV-hg2lMF/GAVDs1-caOS-pBlM-bQsb-MDyN-2LdM-nyQveG' not found
grub rescue>
**Why can grub not unlock my LUKS drive while cryptsetup can? How can I fix grub so it can?**
*I understand this is technically an XY problem but I have tried solving X (Kali installer failure) without success as it seems no one else has my issue, and I am so close to solving Y at this point I don't think it matters. Plus I want to learn more about grub.*
Edit: luksDump info
$ sudo cryptsetup luksDump /dev/sda3
LUKS header information
Version: 2
Epoch: 3
Metadata area: 16384 [bytes]
Keyslots area: 16744448 [bytes]
UUID: f0b2bee7-9566-4178-9a3a-6ffee87482df
Label: (no label)
Subsystem: (no subsystem)
Flags: (no flags)
Data segments:
0: crypt
offset: 16777216 [bytes]
length: (whole device)
cipher: aes-xts-plain64
sector: 4096 [bytes]
Keyslots:
0: luks2
Key: 512 bits
Priority: normal
Cipher: aes-xts-plain64
Cipher key: 512 bits
PBKDF: argon2id
Time cost: 4
Memory: 1048576
Threads: 4
Salt: 73 ... 12
AF stripes: 4000
AF hash: sha256
Area offset:32768 [bytes]
Area length:258048 [bytes]
Digest ID: 0
Tokens:
Digests:
0: pbkdf2
Hash: sha256
Iterations: 77101
Salt: c2 ... 80
Digest: c7 ... 43
Asked by ExecutionByFork
(531 rep)
Dec 15, 2023, 04:40 AM
Last activity: Jan 22, 2025, 06:26 PM
Last activity: Jan 22, 2025, 06:26 PM