Display MoreHello everyone,
just wanted to share my own experience about encryption on OMV. Debian has had an native way to do this, which is also pretty easy to implement and it does not require any scripts or restarting of services. For everyone who is interested to implement this I would advise to look into the packages dropbear-initramfs and cryptsetup-initramfs. There are several descriptions already available on the internet in connection with debian and luks.
Once installed there is very little to setup to make it work.
- Basically one has to add/or edit their crypttab file under /etc/crypttab and define the mapper / source / key and options for the luks encrypted devices, example (option initramfs is needed if it is not the root-device but some other drive, keygroup1 and keyscript is used for devices with the same passphrase which is cached and reused, so you only have to type it once):
Code# <target name> <source device> <key file> <options> crypt-data-1 UUID=72a93932-28e3-442b-9b1b-2afe6ed75796 keygroup1 luks,keyscript=decrypt_keyctl,initramfs crypt-data-4 UUID=8322791f-ff5b-4300-8f3e-2718ba35b5da keygroup1 luks,keyscript=decrypt_keyctl,initramfs crypt-data-2 UUID=01a86874-f8e7-4ace-bfd3-0da677560bbc keygroup1 luks,keyscript=decrypt_keyctl,initramfs crypt-data-3 UUID=73db3a2a-5d1e-4630-a961-2ec931ab21e0 keygroup1 luks,keyscript=decrypt_keyctl,initramfs crypt-docker UUID=d4d9d343-56b0-43eb-9d42-136e7eff772c keygroup1 luks,keyscript=decrypt_keyctl,initramfs
- Secondly, transfer that into /etc/initramfs-tools/conf.d/cryptroot in the appropriate format, example:
Code# <target name> ,<source device> ,<key file> ,<options> target=crypt-data-1,source=UUID=72a93932-28e3-442b-9b1b-2afe6ed75796,key=keygroup1,luks,keyscript=decrypt_keyctl target=crypt-data-4,source=UUID=8322791f-ff5b-4300-8f3e-2718ba35b5da,key=keygroup1,luks,keyscript=decrypt_keyctl target=crypt-data-2,source=UUID=01a86874-f8e7-4ace-bfd3-0da677560bbc,key=keygroup1,luks,keyscript=decrypt_keyctl target=crypt-data-3,source=UUID=73db3a2a-5d1e-4630-a961-2ec931ab21e0,key=keygroup1,luks,keyscript=decrypt_keyctl target=crypt-docker,source=UUID=d4d9d343-56b0-43eb-9d42-136e7eff772c,key=keygroup1,luks,keyscript=decrypt_keyctl
- Setup dropbear.conf in /etc/dropbear/initramfs/dropbear.conf, also add your client pub-keys to authorized_keys
- Setup initramfs.conf in /etc/initramfs-tools/initramfs.conf (using a DHCP with only one network-device doesn't need any config at all, otherwise you will have to at least define the device, if more than one is present)
- Update/recreate your initramfs and you are done
Basically with every boot a dropbear-sshd session is started, waiting for the admin to connect to it and to execute cryptroot-unlock thus entering the luks-passphrase and decrypting all previously defined luks-devices. After that the system is booted as usual. This is a very convenient way as it is:
- native and clean (works with upgrades)
- works also with mdadm arrays, lvm's and any other native disk-setups which are supported in initramfs
- does not interfere with physical input via keyboard/display on the host (it's still available)
and only needs the admin to ssh into the OMV host (or via attached a keyboard/display) to put in the passphrase before anything can happen.
While I knew of the dropbear setup I didn't know of decrypt_keyctl and keygroups, that's pretty neat! I might add this to my setup eventually as well. As it is it wouldn't make it any more convenient than the script (which I'm fine with). I may even integrate keygroups into the script, will explore that with an AI eventually. Thanks!
