Sample Header Ad - 728x90

Desperate and sleepless, after days of attemps still can't auto-unlock LUKS with TPM, I want to cry, what am I doing wrong?

0 votes
0 answers
142 views
Firstly, greetings and I hope you the reader is doing well. I have spent the last five days barely sleeping. I have been doing search engine research on many IT sites including Stack Exchange and also using ChatGPT and Gemini chatbots to guide me through this task, and I have so far been unsuccessful in resolving the issue. What am I trying to resolve, you might ask me? I installed Debian on this particular machine... I did a plain, unencrypted install. There are three disks in this server: - 1x NVMe drive, 1TB capacity, for /EFI /boot and / partitions, as well as swap space - 2x WD Red Pro 16TB drives, which are mirrored in a RAID1 LVM, where the /home partition resides, this was until recently also unencrypted Then, one of the 16TB Red Pro HDDs failed, causing the RAID1 array to degrade. I got the drive RMAd, received the replacement, placed it in the machine, and re-added to the RAID, it took a couple of days to sync but it did. Now the status is healthy. I was running Debian 12. I decided to wipe the NVMe and recreate the Server based on Ubuntu instead (I know it's a derivative). Before I added the replacement disk to sync, I encrypted the original disk with LUKS using the following command:
cryptsetup reencrypt --encrypt /dev/mapper/RAID-Home --reduce-device-size 32M --cipher aes-xts-plain64 --key-size 512
I also made sure to slightly shrink the partition size to fit the LUKS header. The process completed, disk 1 of 2 in the RAID is encrypted. Once the other disk was added and synced, I now have two encrypted disks, presumable 1:1 replica so the LUKS header and keys will be the same. Output of lsblk -fs:
Luks-33d0787e-jjjjj-jjjj-jjjj-jjjjjjjjjjj btrfs                                                       76f96749-7254-xxxxx-xxxx-xxxxxxx                  
└─RAID-Home                               crypto_LUKS       2                                         33d0787e-079e-yyyy-yyyy-yyyyyyyyyyyyu                  
  └─md0                                   LVM2_member       LVM2 001                                  O7T2lP-kQqv-zzzzz-zzzz-zzzz-zzzz-zzzzzz                
    ├─sda                                 linux_raid_member 1.2              ubuntu:raid_home         e9a3119b-e8b7-qqqq-qqqq-qqqqqqqqq                  
    └─sdb                                 linux_raid_member 1.2              ubuntu:raid_home         e9a3119b-e8b7-bbbbbb-bbbb-bbbbbbbbbbb                  
nvme0n1p1                                 vfat              FAT32                                     aaaa-aaaa                               479.9M     1% /boot/efi
└─nvme0n1                                                                                                                                                   
nvme0n1p2                                                                                                                                                   
└─nvme0n1                                                                                                                                                   
nvme0n1p3                                 swap              1                                         6b700b82-cccc-cccc-cccc-cccccccc                  [SWAP]
└─nvme0n1                                                                                                                                                   
nvme0n1p4                                 ext4              1.0                                       e7180d61-dddd-ddddd-dddd-dddddddd    791.3G     5% /var/snap/firefox/common/host-hunspell
│                                                                                                                                                           /
└─nvme0n1
My /etc/crypttab is:
#HomeDecrypted /dev/mapper/RAID-Home tpm2-device=auto,none,luks,discard
luks-33d0787e-jjjjj-jjjj-jjjj-jjjjjjjjjjj UUID=33d0787e-jjjjj-jjjj-jjjj-jjjjjjjjjjj tpm2-device=auto,none,luks,discard
And /etc/fstab:
#Home folder
# before encryption UUID=76f96749-nnnn-nnnn-nnnn-nnnnnnnnnnn  /home           btrfs    defaults        0       2
#after encryption:
/dev/mapper/HomeDecrypted   /home   btrfs   defaults,x-systemd.requires=systemd-cryptsetup@HomeDecrypted.service,x-systemd.after=systemd-cryptsetup@HomeDecrypted.service   0   0
This above is only the "latest" iteration of my attempts. I have tried all sorts of approaches recommended on the web and ChatGPT/Gemini with varying degrees of failure. I am literaly exhausted at this point. I want to learn where I'm going wrong and how to fix it. My goal: leave the system partitions (/EFI, /boot, /, and swap) in the NVMe drive untouched, while automatically mounting the /home partition with TPM upon reboot, because if there is a power cut that lasts longer than the UPS can maintain the system running, then it's set in the BIOS to automatically power on after power loss, this means the services would resume even if I am not presently able to type the LUKS passphrase manually on the boot screen. Please teach me how to fix, with instructions on whatever I need to do, but also explanation as to why and what it does. Thanks! I desperately need to sleep and I have no more energy :( I really need help to resolve this. PS-should be clear that obfuscated some data like partition IDs, for privacy reasons. PS2-if you require further information from my system (such as specific apt packages) then please tell me which commands I need to run and I'll edit this question and provide the output accordingly. Thanks in advance for your help!
Asked by P Williams (9 rep)
Feb 15, 2025, 07:37 PM