Unlock two LUKS devices before booting with clevis/initramfs
0
votes
1
answer
339
views
On Debian, how can I instruct clevis/initramfs to unlock **two** LUKS devices before booting?
I currently have both devices configured to be unlocked through TPM2, which is correctly configured as I can regenerate the bindings without having to provide the volume password.
~# clevis luks regen -d /dev/nvme0n1 -s 1
Regenerating binding (device /dev/nvme0n1, slot 1):
Pin: tpm2, Config: '{"hash":"sha256","key":"ecc","pcr_bank":"sha256","pcr_ids":"REDACTED"}'
Do you want to proceed? [ynYN] y
Binding regenerated successfully
~# clevis luks regen -d /dev/nvme1n1p3 -s 0
Regenerating binding (device /dev/nvme1n1p3, slot 0):
Pin: tpm2, Config: '{"hash":"sha256","key":"ecc","pcr_bank":"sha256","pcr_ids":"REDACTED"}'
Do you want to proceed? [ynYN] y
Binding regenerated successfully
Within the /etc/crypttab
, both devices are listed and the UUID matches the crypto_LUKS
devices in blkid
. Using update-initramfs -u
does not complain about missing references.
nvme0n1_crypt UUID=REDACTED none luks,discard
nvme1n1p3_crypt UUID=REDACTED none luks,discard
However, whenever I boot only the second device nvme1n1p3_crypt
is automatically decrypted without the first device being mentioned at all. After a while, the boot fails with the following message.
Please unlock disk nvme1n1p3_crypt:
cryptsetup: nvme1n1p3_crypt: set up successfully
Gave up waiting for suspend/resume device
Gave up waiting for root file system device. Common problems:
...
(initramfs)
From there, I have to manually open the second device before proceeding.
(initramfs) cryuptsetup luksOpen /dev/nvme0n1 nvme0n1_crypt
Enter passphrase for /dev/nvme0n1: # Provided passphrase
(initramfs) exit
/dev/mapper/lab--vg-root: clean, REDACTED files, REDACTED blocks
The devices are set up as follow:
~# lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
nvme0n1 259:0 0 ----- 0 disk
└─nvme0n1_crypt 252:1 0 ----- 0 crypt
├─lab--vg-data_tmeta 252:4 0 ----- 0 lvm
│ └─lab--vg-data-tpool 252:6 0 ----- 0 lvm
│ ├─lab--vg-data 252:7 0 ----- 1 lvm
│ └─... 252:22 0 ----- 0 lvm
└─lab--vg-data_tdata 252:5 0 ----- 0 lvm
└─lab--vg-data-tpool 252:6 0 ----- 0 lvm
├─lab--vg-data 252:7 0 ----- 1 lvm
└─... 252:22 0 ----- 0 lvm
nvme1n1 259:1 0 ----- 0 disk
├─nvme1n1p1 259:2 0 ----- 0 part /boot/efi
├─nvme1n1p2 259:3 0 ----- 0 part /boot
└─nvme1n1p3 259:4 0 ----- 0 part
└─nvme1n1p3_crypt 252:0 0 ----- 0 crypt
├─lab--vg-root 252:2 0 ----- 0 lvm /
├─lab--vg-swap_1 252:3 0 ----- 0 lvm [SWAP]
├─lab--vg-data_tmeta 252:4 0 ----- 0 lvm
│ └─lab--vg-data-tpool 252:6 0 ----- 0 lvm
│ ├─lab--vg-data 252:7 0 ----- 1 lvm
│ └─... 252:22 0 ----- 0 lvm
└─lab--vg-data_tdata 252:5 0 ----- 0 lvm
└─lab--vg-data-tpool 252:6 0 ----- 0 lvm
├─lab--vg-data 252:7 0 ----- 1 lvm
└─... 252:22 0 ----- 0 lvm
~# uname -a
Linux lab 6.8.12-4-pve #1 SMP PREEMPT_DYNAMIC PMX 6.8.12-4 (2024-11-06T15:04Z) x86_64 GNU/Linux
Asked by Maxime Thiebaut
(1 rep)
Nov 15, 2024, 08:58 AM
Last activity: Nov 16, 2024, 03:06 PM
Last activity: Nov 16, 2024, 03:06 PM