{"id":956,"date":"2025-02-21T04:00:56","date_gmt":"2025-02-21T01:00:56","guid":{"rendered":"https:\/\/itgen.itbumper.com\/?page_id=956"},"modified":"2025-02-26T11:22:58","modified_gmt":"2025-02-26T08:22:58","slug":"0038_ubuntu-server-22-04-lts-with-remote-luks-unlock","status":"publish","type":"page","link":"https:\/\/itgen.itbumper.com\/?page_id=956","title":{"rendered":"0038_Ubuntu Server 22.04 LTS with remote LUKS Unlock"},"content":{"rendered":"

The best way to secure your data using LUKS is to deploy a new OS. <\/p>\n

I used Ubuntu Server 22.04 because 24.04 crashed when encrypting a LUKS partition step. <\/p>\n

I will describe<\/span> in full<\/span> one<\/span> of<\/span> the installation<\/span> options<\/span> that<\/span> I<\/span> use<\/span>.<\/span> The first<\/span> thing<\/span> we<\/span> will see<\/span> is a<\/span> window<\/span> with<\/span> a suggestion<\/span> for installing<\/span> the Ubuntu<\/span> Server<\/span>.<\/p>\n

You can<\/span> press<\/span> Enter,<\/span> and<\/span> without<\/span> waiting<\/span> 30<\/span> seconds<\/span>,<\/span> the installation<\/span> process<\/span> will begin<\/span>.<\/span><\/p>\n\n

\n
\"\"<\/figure><\/div>\n\n
\n
\"\"<\/figure><\/div>\n\n

After<\/span> that, you need<\/span> to select<\/span> a language. After<\/span> selecting<\/span> it,<\/span> a<\/span> window<\/span> will open with<\/span> a suggestion<\/span> to continue<\/span> without<\/span> updating<\/span>.<\/span> I<\/span> prefer<\/span> immediately switching to an SSH connection and continuing the MobaXterm installation.<\/span> Using<\/span> the TAB<\/span> key<\/span>,<\/span> select<\/span> Help<\/span> and<\/span> select<\/span> the Enter<\/span> Shell<\/span> option<\/span>.<\/span> Changing<\/span> the password<\/span> for<\/span> the user called “installer”.<\/span><\/p>\n\n

\n
\"\"<\/figure><\/div>\n\n
\npasswd installer\n<\/pre><\/div>\n\n
\n
\"\"<\/figure><\/div>\n\n
I enter<\/span> the password<\/span> twice<\/span>,<\/span> use the “ip<\/span> a<\/strong> ” command<\/span> to find<\/span> out the current<\/span> MAC<\/span> and<\/span> IP<\/span> address<\/span>, and<\/span> if<\/span> necessary<\/span>, I make<\/span> a MAC<\/span>\/<\/span>IP<\/span> bundle<\/span> in<\/span> DHCP<\/span> and<\/span> exit with the exit<\/span> command.<\/span><\/p>\n
Launching an SSH session by using the command “ssh installer@192.168.10.15<\/strong><\/em>“, I confirm the connection. Now,<\/span> the installation<\/span> process<\/span> is in my<\/span> console<\/span>.<\/span><\/p>\n\n
\n
\"\"<\/figure><\/div>\n\n
We get to the disk configuration section, and it’s partitions and select the physical disk correctly. Select the LUKS option and enter the disk encryption password if there are several of them<\/span>.<\/span> During<\/span> installation<\/span>,<\/span> choose<\/span> a simple<\/span> password<\/span> like 123455678<\/span><\/strong><\/em>.<\/span> When<\/span> the system<\/span> is<\/span> ready<\/span>,<\/span> we will change<\/span> the password<\/span> to<\/span> a good<\/span> one.<\/span><\/p>\n\n
\n
\"\"<\/figure><\/div>\n\n
It will turn<\/span> out something<\/span> similar<\/span> to<\/span> this:<\/span><\/p>\n\n
\n
\"\"<\/figure><\/div>\n\n
We confirm<\/span> that<\/span> we<\/span> are sure<\/span><\/p>\n\n
\n
\"\"<\/figure><\/div>\n\n
We enter<\/span> the necessary<\/span> data<\/span> and<\/span> continue<\/span><\/p>\n\n
\n
\"\"<\/figure><\/div>\n\n
\n
When installing Ubuntu Server with disk encryption using LUKS, the following algorithm is used by default:<\/em><\/p>\n
Encryption algorithm: AES-XTS-plain64<\/em><\/strong>
Key size:<\/strong> 512 bits (for AES-XTS, the actual key is 256 bits for encryption and 256 bits for tweaking)<\/em>
The hash function for the key: sha256<\/em><\/strong>
PDF (Password-Based Key Derivation Function):<\/strong> argon2id (starting with newer versions, pbkdf2 was previously used)<\/em>
The number of iterations:<\/strong> dynamically determined during installation for optimal balance between performance and security.<\/em><\/p>\n
\n
We indicate that we want to install an SSH server and take the public key from GitHub or Launchpad, if available; if not, leave “none.” In my case, I have a public key on GitHub, and I immediately refuse to use SSH password access.
If the public key is found, it must be checked and confirmed. Next, we watch the system installation process; after finishing, select the Reboot Now option, after which the session will end.<\/p>\n\n
\n
\"\"<\/figure><\/div>\n\n
The installation process<\/span> will stop<\/span> and<\/span> prompt<\/span> you to enter<\/span> a password<\/span> to<\/span> decrypt<\/span> the disk, and the installation process will continue. After that, we reconnect via SSH and are back on the server.<\/span><\/p>\n\n
\n
\"\"<\/figure><\/div>\n\n
The decryption<\/span> password<\/span> is entered<\/span> before<\/span> the system<\/span> boots<\/span>,<\/span> so<\/span> you must go<\/span> to<\/span> it<\/span> and<\/span> type<\/span> it<\/span> on<\/span> the keyboard<\/span> or<\/span> do<\/span> it<\/span> remotely<\/span> through<\/span> the virtual<\/span> machine<\/span> manager<\/span> or<\/span> BMC<\/span>,<\/span> if<\/span> available.<\/span> Another<\/span> solution<\/span> would<\/span> be to use<\/span> a simple<\/span> SSH<\/span> server<\/span> that<\/span> starts<\/span> at<\/span> the time<\/span> of initramfs<\/span><\/strong> initialization<\/span>,<\/span> with<\/span> which you can<\/span> enter<\/span> the LUKS<\/span> password<\/span> remotely<\/span> and<\/span> decrypt<\/span> the disk<\/span> so<\/span> that the system<\/span> can<\/span> boot<\/span>.<\/span><\/p>\n\n
\nsudo apt update && sudo apt install upgrade -y\nsudo apt install dropbear-initramfs -y\n<\/pre><\/div>\n\n
Making<\/span> changes<\/span> to<\/span> the configuration<\/span> file<\/span> \/<\/span>etc<\/span>\/<\/span>dropbear<\/span>\/<\/span>initramfs<\/span>\/<\/span>dropbear<\/span>.<\/span>conf<\/span><\/em><\/strong> and<\/span> adding<\/span> the option<\/span> DROPBEAR_OPTIONS=”-I 60 -s”<\/span><\/strong><\/p>\n
-I 60 tells dropbear to terminate any connection that is idle for 60 seconds <\/span><\/em><\/p>\n
-s – disables password logins.<\/span><\/em><\/p>\n
 For more<\/span> options<\/span>, see<\/span> man<\/span> dropbear<\/span> 8<\/span><\/em><\/p>\n\n
\n
\"\"<\/figure><\/div>\n\n
To<\/span> assign<\/span> a static<\/span> IP<\/span> address<\/span>,<\/span> you need<\/span> to register<\/span> it<\/span> in<\/span> the \/<\/span>etc<\/span>\/<\/span>initramfs<\/span>–<\/span>tools<\/span>\/<\/span>initramfs<\/span>.<\/span>conf<\/span> file<\/span><\/strong>. <\/em><\/p>\n
IP<\/span>=<\/span><<\/span>local<\/span>–<\/span>ip<\/span>><\/span>:<\/span>:<\/span><<\/span>gateway<\/span>–<\/span>ip<\/span>><\/span>:<\/span><<\/span>subnet<\/span>–<\/span>mask<\/span>><\/span> <\/em><\/p>\n
or<\/span><\/p>\n
IP<\/span>=<\/span><<\/span>local<\/span>–<\/span>ip<\/span>><\/span>:<\/span>:<\/span><<\/span>gateway<\/span>–<\/span>ip<\/span>><\/span>:<\/span><<\/span>subnet<\/span>–<\/span>mask<\/span>><\/span>::<<\/span>interface<\/span>><\/span><\/em> ,<\/span> if<\/span> there are several<\/span> interfaces<\/span>.<\/span><\/p>\n\n
\n
\"\"<\/figure><\/div>\n\n
Now<\/span> you need<\/span> to enter<\/span> your<\/span> public<\/span> key<\/span> into<\/span> the file \/etc\/dropbear\/initramfs\/authorized_keys <\/strong><\/em><\/span>,<\/span> if<\/span> not<\/span>,<\/span> generate<\/span> it first<\/span>.<\/span>  After<\/span> making<\/span> the changes<\/span>,<\/span> you need<\/span> to update<\/span> the loader<\/span>.<\/span><\/p>\n\n
\nsudo update-initramfs -u\n<\/pre><\/div>\n\n
After<\/span> restarting<\/span> the server<\/span><\/p>\n\n
\nsudo reboot now\n<\/pre><\/div>\n\n
We perform<\/span> an ssh<\/span> connection<\/span> for<\/span> the root<\/span><\/strong>,<\/span> and immediately<\/span> send<\/span> the cryptroot–<\/span>unlock<\/span> command<\/span> to the<\/span> terminal<\/span>.<\/span> It is necessary<\/span> to use<\/span> the –<\/span>i<\/span> option<\/span> to<\/span> specify<\/span> the path<\/span> and<\/span> name<\/span> of the public<\/span> key; I<\/span> have it<\/span> pulled<\/span> up automatically<\/span>.<\/span><\/p>\n\n
\nssh -t root@192.168.10.15 'cryptroot-unlock' \n<\/pre><\/div>\n\n
Enter<\/span> the password–><\/span>Enter. If ok, then an SSH session will close automatically.<\/span><\/p>\n\n\n
\"\"<\/figure>\n\n\n
The system<\/span> will boot<\/span> up,<\/span> and then<\/span> we connect<\/span> with<\/span> the key<\/span> by<\/span> username<\/span>.<\/span><\/p>\n\n
\n
\"\"<\/figure><\/div>\n\n
Looking<\/span> at the disk<\/span> partitions<\/span> and<\/span> checking<\/span> the parameters<\/span> of the existing<\/span> LUKS<\/span> volume<\/span>.\u00a0<\/p>\n
\/<\/span>dev<\/span>\/<\/span>sda3<\/span> <\/strong>is<\/span> a<\/span> device<\/span> with<\/span> a LUKS<\/span> partition<\/span><\/p>\n
The<\/span> occupied<\/span> and<\/span> free<\/span> slots<\/span> will be<\/span> displayed<\/span> in the Key<\/span> Slots<\/span><\/strong> section<\/span>.<\/span><\/p>\n\n
\nlsblk \nsudo cryptsetup luksDump \/dev\/sda3\n<\/pre><\/div>\n\n
\n
\"\"<\/figure><\/div>\n\n
It’s time to change the encryption key; for convenience, I specified the key 12345678<\/strong> during installation.
I generate the actual 256-bit (32-byte) key with the command:<\/p>\n\n
\nopenssl rand -hex 32\u00a0\n<\/pre><\/div>\n\n
\n
\"\"<\/figure><\/div>\n\n
It will issue a key type: 4f9de22c93de069cd483fc674df7f17d8453df23b8687e2305ff7dc16e7e3600
or<\/p>\n
like this, where there are various symbols<\/p>\n\n
\nopenssl rand -base64 32\n<\/pre><\/div>\n\n
It will issue a key like: T9rMPN52sU322UcWmcZcWdPouJWpFw1tpAhA6\/KKfmY=<\/p>\n
If copying the contents from the terminal to the clipboard causes problems, the key can be saved to a file by adding >\/root\/luks-disk.key<\/strong> <\/em>at the end and immediately protecting the key file with the command:<\/p>\n\n
\nsudo chmod 400 \/root\/luks-disk.key\n<\/pre><\/div>\n\n
\u00a0<\/p>\n
\n
Important<\/span>:<\/span><\/strong> <\/em><\/span><\/p>\n
When<\/span> transferring<\/span> keys<\/span> with<\/span> different<\/span> characters<\/span>, it is better<\/span> to use<\/span> files<\/span> to<\/span> avoid<\/span> problems<\/span> with<\/span> interpretation<\/span>.<\/span> I immediately<\/span> write it<\/span> down<\/span> in<\/span> KeePass<\/span><\/strong> so<\/span> it doesn‘t<\/span> get<\/span> lost<\/span>.<\/span><\/em><\/p>\n
\n
\u00a0<\/p>\n\n\n
Adding a new key<\/strong><\/p>\n\n\n\n
If the clipboard in the terminal is working fine, then use the command:<\/p>\n\n\n
\nsudo cryptsetup luksAddKey \/dev\/sda3\n<\/pre><\/div>\n\n\n
If not, you can read it from the key file.<\/p>\n\n\n
\nsudo cryptsetup luksAddKey \/dev\/sda3 <\/root\/luks-disk.key\n<\/pre><\/div>\n\n
The system will ask you to enter the encryption key; enter the one you installed,\u00a012345678,\u00a0<\/strong><\/em>and the new key twice.<\/span><\/p>\n
Checking<\/strong><\/span><\/p>\n\n
\nsudo cryptsetup luksDump \/dev\/sda3\n<\/pre><\/div>\n\n\n
\"\"<\/figure>\n\n\n
Two key slots are already occupied, so it’s okay.<\/p>\n
\u00a0<\/p>\n
Deleting the old, simple encryption key<\/strong><\/span><\/p>\n\n
\nsudo cryptsetup luksRemoveKey \/dev\/sda3\n<\/pre><\/div>\n\n
and enter the key that needs to be deleted, in our case 12345678.<\/p>\n
\u00a0<\/p>\n
Checking it out again<\/strong><\/span><\/p>\n\n
\nsudo cryptsetup luksDump \/dev\/sda3\n<\/pre><\/div>\n\n
Only one slot is occupied, which means that the deletion was successful.<\/p>\n\n\n
\"\"<\/figure>\n\n\n
\u00a0<\/p>\n
You can check the operation with the command:<\/strong><\/span><\/p>\n\n
\nsudo cryptsetup open \/dev\/sda3 my_secure_volume, then enter the password\nor\nsudo cryptsetup open \/dev\/sda3 my_secure_volume --key-file \/root\/luks-disk.key\n<\/pre><\/div>\n\n
The system will give an error that the disk has already been mounted, it’s not a big deal, the new key has been checked.<\/p>\n
If the key file is no longer needed, delete it with the command:<\/p>\n\n
\nshred -u \/root\/luks-disk.key\n<\/pre><\/div>\n\n


<\/p>\n
\n
Important<\/span>:<\/strong> <\/em><\/span><\/p>\n
Backup<\/span> access<\/span>:<\/span> Always<\/span> leave<\/span> one<\/span> secure<\/span> key<\/span> or<\/span> password<\/span> in<\/span> case<\/span> of failure<\/span>.<\/span> Security<\/span>:<\/span> When<\/span> using<\/span> key<\/span> files<\/span>, ensure\u00a0they<\/span> are stored<\/span> in<\/span> a safe<\/span> directory<\/span>.<\/span> PBKDF<\/span> settings<\/span>:<\/span> LUKS2<\/span> uses<\/span> argon2id<\/span> by<\/span> default<\/span> in<\/span> new<\/span> versions<\/span> of Ubuntu<\/span>\u00a0but<\/span> can<\/span> be reconfigured<\/span>.<\/span> That‘s<\/span> it. The<\/span>\u00a0system<\/span> is ready<\/span>.<\/span><\/em><\/p>\n
\n
What<\/span> should I do<\/span> to increase<\/span> the size<\/span> of the QEMU<\/span>–<\/span>KVM<\/span> virtual<\/span> disk<\/span>?<\/strong><\/p>\n
1. Check the current status of\u00a0<\/em>partitions by using the command\u00a0\u00a0<\/p>\n\n
\nlsblk\nlsblk-e7\n<\/pre><\/div>\n\n
\n
\"\"<\/figure><\/div>\n\n
2. Turn off the virtual machine and run the command in the hypervisor host<\/p>\n\n
\nqemu-img resize \/path\/to\/vm-disk.qcow2 +10G\n<\/pre><\/div>\n\n
This will add 10 GB to the VM’s hard disk file.\u00a0<\/p>\n\n
\n
\"\"<\/figure><\/div>\n\n
3<\/span>.<\/span> Launch<\/span> the virtual<\/span> machine<\/span><\/p>\n
4.<\/span> Connect<\/span> via<\/span> SSH and<\/span> decrypt<\/span> the disk<\/span><\/p>\n
5.<\/span> We connect<\/span> via<\/span> SSH to<\/span> the system<\/span><\/p>\n
6. We check the disk capacity. In the example, the sda<\/strong> <\/em>disk became 20G<\/p>\n\n
\n
\"\"<\/figure><\/div>\n\n
7. Run the program to work with disk partitions with the command<\/p>\n\n
\nsudo parted \/dev\/sda\n<\/pre><\/div>\n\n
8. We enter the print<\/strong><\/em> command and say fix the problem; we answer Fix<\/em><\/strong>. We see what has become 20G.<\/p>\n\n\n
\"\"<\/figure>\n\n\n
9. We need to increase the size of the\u00a0sda3<\/strong><\/em>\u00a0partition (in our case, it goes under number 3<\/em>), on which the encrypted disk partition is based, giving it all the free space, i.e. 10G<\/strong>, for this, we write the command:<\/p>\n\n
\nresize part 3 100%\n<\/pre><\/div>\n\n
\n
\"\"<\/figure><\/div>\n\n
10. Exit the program:\u00a0<\/p>\n\n
\nquit\n<\/pre><\/div>\n\n
11. Update the partition table:\u00a0<\/p>\n\n
\nsudo partprobe\n<\/pre><\/div>\n\n
12. Expand the LUKS section –> enter the disk encryption key.<\/p>\n\n
\nsudo cryptsetup resize dm_crypt-0\n<\/pre><\/div>\n\n
13. Expanding LVM, first we look at the current state, use commands:<\/p>\n\n
\nsudo pvdisplay\nsudo vgdisplay\nsudo lvdisplay\n<\/pre><\/div>\n\n
\n
\"\"<\/figure><\/div>\n\n\n
14. Expand PV:\u00a0<\/p>\n\n\n
\nsudo pvresize \/dev\/mapper\/dm_crypt-0\n<\/pre><\/div>\n\n\n
15. Expand VL:\u00a0<\/p>\n\n\n
\nsudo lvextend -l +100%FREE \/dev\/ubuntu-vg\/ubuntu-lv\n<\/pre><\/div>\n\n
16. Checking:<\/p>\n\n\n
sudo pvdisplay<\/strong><\/em>
sudo vgdisplay<\/strong><\/em>
sudo lvdisplay<\/strong><\/em><\/p>\n\n\n
\n
\"\"<\/figure><\/div>\n\n\n
17<\/span>.<\/span> Expanding<\/span> the file<\/span> system<\/span>,<\/span> I<\/span> have ext4<\/span>:<\/span>\u00a0<\/p>\n\n\n
\nsudo resize2fs \/dev\/ubuntu-vg\/ubuntu-lv\n<\/pre><\/div>\n\n
18. Checking:\u00a0<\/span><\/p>\n\n
\n\u00a0lsblk -e7 && df -h\n<\/pre><\/div>\n\n
\n
\"\"<\/figure><\/div>\n\n
Done!<\/p>\n
If you’re interested in benchmarking (performance test) LUKS\/cryptsetup, use the command:<\/p>\n\n
\nsudo cryptsetup benchmark\n<\/pre><\/div>\n\n
\n
\"\"<\/figure><\/div>\n\n","protected":false},"excerpt":{"rendered":"
The best way to secure your data using LUKS is to deploy a new OS.  I used Ubuntu Server 22.04 because 24.04 crashed when encrypting a LUKS partition step.  I will describe in full one of the installation options that I use. The first thing we will see is a window with a suggestion for … Continue reading “0038_Ubuntu Server 22.04 LTS with remote LUKS Unlock”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"categories":[],"tags":[],"_links":{"self":[{"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=\/wp\/v2\/pages\/956"}],"collection":[{"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=956"}],"version-history":[{"count":16,"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=\/wp\/v2\/pages\/956\/revisions"}],"predecessor-version":[{"id":1031,"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=\/wp\/v2\/pages\/956\/revisions\/1031"}],"wp:attachment":[{"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=956"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=956"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itgen.itbumper.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=956"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}