LUKS disk encryption plugin

  • # /etc/fstab: static file system information.

    # <file system> <mount point> <type> <options> <dump> <pass>

    # / was on /dev/sda1 during installation

    UUID=53f4854f-fe0e-4c7c-9e4f-234a07deeb02 / ext4 errors=remount-ro 0 1

    # swap was on /dev/sda5 during installation

    UUID=df34ec30-1e76-4864-8127-7471b742b817 none swap sw 0 0

    # >>> [openmediavault]

    /dev/disk/by-label/storage /srv/dev-disk-by-label-storage ext4 defaults,nofail,user_xattr,noexec,usrjquota=aquota.user,grpjquota=aquota.group,jqfmt=vfsv0,acl 0 2

    # <<< [openmediavault]

  • I posted a workaround for the moment here


    https://github.com/OpenMediaVa…35#issuecomment-628359318


    People new to omv not comfortable editing xml, just edit /etc/fstab as long as you're not adding disks or shares to nfs, fstab should stay the same


    I also posted there what was is the actual problem. I think we can fix the issue with code in the plugin but for the moment btrfs will be left out due to the fact the old code that Ian Grant left there might not be valid in current btrfs-tools, the main problem is btrfs multi devices.


    edit: Don't use this


  • I would like to use LUKS BUT in the same time to use btrfs as filesystem, since i want to be ready for OMV next release. What would you suggest i should do in this case? I am now setting up my new OMV build, so still investigating software possibilities....

  • I would like to use LUKS BUT in the same time to use btrfs as filesystem, since i want to be ready for OMV next release

    I am not so sure btrfs will be left as the only choice for omv. that hasn't been decided. The next major release is just gonna be redoing the frontend in angular.


    Don't know what to tell you maybe someone with btrfs-luks expertise can contribute some code, basically some scripts check on how to handle multidevice btrfs.


    Because I don't how what would happen if i try to mount a btrfs member without all the devices ready

  • I am not so sure btrfs will be left as the only choice for omv. that hasn't been decided. The next major release is just gonna be redoing the frontend in angular.


    Don't know what to tell you maybe someone with btrfs-luks expertise can contribute some code, basically some scripts check on how to handle multidevice btrfs.


    Because I don't how what would happen if i try to mount a btrfs member without all the devices ready

    Sorry for the offtopic, however it seems that mergerfs + snapraid + luks on btrfs seems overedundant for the time being.


    Better stick with mergerfs + snapraid + luks on ext4 that seems to be the norm...

  • Hi

    After a new installation I have the same issue with boot after unlock and mount encrypted hard drivers.

    I used this guide here https://michaelxander.com/diy-nas/

    One year ago the installtion was perfect working.

    Now I reinstalled it 3 times, because I thought I did something wrong.

    Thanks to the guides it goes fast. And the same mistake appears again and again.


    [Time] Time out waiting for device /dev/disk/by-label/data01

    [Depend] Dependency failed for File System Check on/dev/disk/by-label/data01

    [Depend] Dependency failed for /srv/dev-disk-by-label-data01


    And the system is waiting before even network configuration was active.

    Any Idea how I can solve this?


    sorry for my bad english

  • Hi


    Okey I was not able to solved this by my one so I fall back to OMV 4

    After some trouble with network drivers (new main-board) it was relative easy to install and configure openmediavault with luks encryption snapraid and MergeFS.

    I love this software.

    thanks for your time...

  • The plugin encrypts a disk. Then you create a filesystem on it. So, as far as I know you cannot encrypt a pool with data. Not sure if you can create a pool of filesystems on encrypted drives, but you test it in a virtual machine.


    Edit: just tried it in a VM. You can encrypt the drives, unlock the drives, create file systems, mount them and build a pool.

  • The plugin encrypts a disk. Then you create a filesystem on it. So, as far as I know you cannot encrypt a pool with data. Not sure if you can create a pool of filesystems on encrypted drives, but you test it in a virtual machine.


    Edit: just tried it in a VM. You can encrypt the drives, unlock the drives, create file systems, mount them and build a pool.


    Thank you! :thumbup:

  • I was having a read through this whole thread because I am considering encrypt two HC2s. Two things are still very unclear to me:


    1) What is best practice if I do want to boot from the HDD in a separate partition?


    2) What's the performance with an Odroid HC2? Does it get significantly hotter because of CPU usage? Is the speed bearable for usage as a media folder that should also host a large photo collection with Lightroom?

  • 1) What is best practice if I do want to boot from the HDD in a separate partition?


    2) What's the performance with an Odroid HC2? Does it get significantly hotter because of CPU usage? Is the speed bearable for usage as a media folder that should also host a large photo collection with Lightroom?

    1) Why would you want this?

    My devices boot from SD-Cards, a XU4 also from EMMC

    2)

    - 4.6 MBytes/s when copying. 1 GByte in ~ 4 minutes transferred.

    - temperature insignificant during file transfer

    - sometimes I use my NAS ODROIDs to display fotos on my TVs, I would not use it for heavy editing (possible though)

    On my ODROIDs I run syncthing to keep files/directories synced between all my devices, foto editing is done locally and immediately synced after editing -> I do not care about the speed since it is done in the background anyway

  • Thanks for the heads up.

    1) Yes, I will stick to the SD-Card as boot device so the while HDD / SDD is encrypted

    2) and yes, the performance as file storage is absolutely fine. If I do video editing, I will use the external HDD connected to Thunderbolt / USB anyway.

  • sorry i have been absent since reporting the mount issue back in March.


    I came back to see what might have updated or instructions on fixing it because I noticed its been acting differently.


    before when I noticed it wouldn't mount a drive when unlocking a drive, I noticed that if I unlocked a drive before the system finished booting up it would mount it. however that has recently changed. it doesn't matter when I unlock the drive it won't mount.


    I'm not sure if this will be useful, but I am running OMV 5.5.16-1 (fully updated), the drive is a RAID 6 formatted in ext4


    if there is any other information you need or anything you want me to try please let me know.

  • Could really do with some advice on an issue I’m having:


    Overview:

    My encrypted device is now missing from the encryption tab of the webui. How can I access the data on the drive?


    Details:

    I had an external disk set up with LUKS encryption. I wanted to add a backup so I connected another external drive and encrypted it too. I then realised that USB Backup isn't set up to work as standard with encrypted backup drives so I erased the second disk to start setting it up as a non-encrypted backup instead. However, there are now no devices showing in the storage/encryption tab.


    How can I access my original encrypted disk?


    I'm not that familiar with LUKS, so could really do with some advice. I know what I set as the cipher setting when I created the encrypted device and I know the passphrase, but without it showing in the encryption tab I'm not sure where to start.


    More information: I have now also realised that although my disk is present in the Disks tab, it doesn't show in the Device dropdown of the "Create encrypted device" dialog. Additionally, in filesystems, the filesystem status is "Missing".


    Any help would be greatly appreciated.

  • Other posts for reference:

    LUKS Automount no longer working on new hardware

    RE: LUKS + KeyFile + AutoMount? [SOLVED]

    I moved my omv setup from an intel server to a new hp small form factor pc, now 3 of my data drives will not auto mount anymore.


    My current fstab is:

    In addition I have crypttab setup for auto unlocking:

    Code
    # <target name> <source device> <key file> <options>
    #System disks - DO NOT EDIT
    sda2_crypt UUID=e07a2c60-9fb4-4ff6-85b1-e2ad4c767ebf none luks,swap,discard
    sda3_crypt UUID=716b232a-f44a-4f46-a276-4e563856c0c6 none luks,discard
    #Data disks
    data1 UUID=1dfccdef-7d88-4d5e-9f42-59bd36020c37 /root/keyfile.key luks
    data2 UUID=298a0d0f-52ce-48f8-817f-d75d293a4836 /root/keyfile.key luks
    data3 UUID=134a1f5e-46b1-422a-b08d-ccc8476340b9 /root/keyfile.key luks
    data4 UUID=b9eb750a-5c20-4673-b652-e7e7915cb470 /root/keyfile.key luks

    This always worked before on the old server.

    Now syslog shows:

    Code
    Dec 15 17:39:03 omv-server monit[996]: Filesystem '/srv/dev-disk-by-label-data1' not mounted
    Dec 15 17:39:03 omv-server monit[996]: 'filesystem_srv_dev-disk-by-label-data1' unable to read filesystem '/srv/dev-disk-by-label-data1' state
    Dec 15 17:39:03 omv-server monit[996]: 'filesystem_srv_dev-disk-by-label-data1' trying to restart
    Dec 15 17:39:03 omv-server monit[996]: 'mountpoint_srv_dev-disk-by-label-data1' status failed (1) -- /srv/dev-disk-by-label-data1 is not a mountpoint

    Repeating for each drive. Every time OMV starts it shows "a start job is running for /dev/disk/" cycling through the uuid and label of each drive for 90 seconds before it fails. the data1 partition on the system drive still works for some reason I don't understand.

    Now OMV doesn't load because of an issue with trying to load mergerfs while the drives aren't mounted, so i tried to remove the unionfs from the omv config manually, now it shows a bunch of errors and the file systems and luks tabs arent loading in the web interface.


    Couldn't extract an UUID from the provided path '/dev/disk/by-label/data2'.


    Failed to execute command 'export PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; export LANG=C.UTF-8; omv-salt deploy run --no-color quota 2>&1' with exit code '1': omv-server: Data failed to compile: ---------- Rendering SLS 'base:omv.deploy.quota.default' failed: while constructing a mapping in "<unicode string>", line 42, column 1 found conflicting ID 'quota_off_no_quotas_' in "<unicode string>", line 69, column 1


    So essentially the entire omv system is now broken, and I even tried creating a new omv install on a flash drive, and it still won't auto mount the data drives. At this point I'm better off just running a media server off Windows 10 but cant convert my ext4 drives back to ntfs. This is too much troubleshooting for a simple media server with basic encryption.


    I don't understand how just using a different motherboard has caused automounting to stop working.

Participate now!

Don’t have an account yet? Register yourself now and be a part of our community!