2 ## raspberry pi with full disk encryption and remote unlock
4 I wanted to have a raspberry pi running raspbian on an encrypted filesystem (everything except /boot) and I wanted to be able to unlock the encryption via ssh.
7 http://paxswill.com/blog/2013/11/04/encrypted-raspberry-pi/
8 https://unix.stackexchange.com/questions/5017/ssh-to-decrypt-encrypted-lvm-during-headless-server-boot/79203#79203
11 # raspbian default install
12 dd if=2016-02-09-raspbian-jessie-lite.img | pv | sudo dd of=/dev/sdX bs=4M
13 # resize partitions so that there is more space on /boot (180MB) and some free space on / (gksudo gparted)
14 # put sd into raspi, start raspi
15 ssh pi@raspi-ip # pw: raspberry
18 sudo raspi-config # do not expand filesystem, reboot
19 sudo apt-get install busybox cryptsetup dropbear
20 sudo mkinitramfs -v -o /boot/initramfs.gz # creates keys and directories for dropbear
21 sudo vi /etc/initramfs-tools/initramfs.conf # add DROPBEAR=y and CRYPTSETUP=y, does not enforce including cryptsetup!?
22 sudo vi /usr/share/initramfs-tools/hooks/cryptroot # enforce setup="yes" so that cryptsetup is included in initramfs
23 sudo vi /etc/initramfs-tools/root/.ssh/authorized_keys # add your ssh-pubkeys
24 sudo vi /usr/share/initramfs-tools/scripts/local-top/ # Fix https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/595648/comments/5 like described in the link by editing this by hand. Starting at line 288 comment out the first branch of the if.
25 sudo mkinitramfs -v -o /boot/initramfs.gz # again so that the settings are applied, check output for dropbear and cryptsetup
26 sudo vi /boot/config.txt # add: initramfs initramfs.gz followkernel
27 sudo reboot # test reboot
29 # insert sd into another computer
30 sudo dd if=/dev/sdX2 bs=4M | pv | dd of=raspi-plain-root.img bs=4M
31 /sbin/e2fsck -f raspi-plain-root.img
32 /sbin/resize2fs -M raspi-plain-root.img
33 # resize second partition to its maximum (gksudo gparted)
34 sudo cryptsetup luksFormat -c aes-xts-plain64 -s 256 -h sha256 -y /dev/sdX2
35 sudo cryptsetup -v luksOpen /dev/sdX2 raspi_crypt
36 dd if=raspi-plain-root.img bs=4M | pv | sudo dd of=/dev/mapper/raspi_crypt bs=4M
37 sudo e2fsck /dev/mapper/raspi_crypt
38 sudo resize2fs /dev/mapper/raspi_crypt
39 sudo e2fsck /dev/mapper/raspi_crypt
41 sudo mount /dev/mapper/raspi_crypt /tmp/piroot/
42 sudo mount /dev/sdX1 /tmp/piroot/boot/
43 sudo vim /tmp/piroot/boot/cmdline.txt # Change root=/dev/mmcblk0p2 to root=/dev/mapper/raspi_crypt and add cryptdevice=/dev/mmcblk0p2:raspi_crypt and add ip=:::::eth0:dhcp
44 sudo vim /tmp/piroot/etc/fstab # change /dev/mmcblk0p2 to /dev/mapper/raspi_crypt
45 sudo vim /tmp/piroot/etc/crypttab # add raspi_crypt /dev/mmcblk0p2 none luks
46 sudo umount /tmp/piroot/boot/ /tmp/piroot/
47 sudo cryptsetup luksClose raspi_crypt
48 # reboot raspi with lan
49 ssh root@raspi-ip -o "UserKnownHostsFile=~/.ssh/known_hosts-raspi-dropbear"
50 /sbin/cryptsetup -v luksOpen /dev/mmcblk0p2 raspi_crypt
51 ps -eo pid,ppid,comm,args # kill sh that was startet by init (1); exit -> pi boots
53 sudo mkinitramfs -v -o /boot/initramfs.gz # check for cryptsetup
55 ssh root@raspi-ip -o "UserKnownHostsFile=~/.ssh/known_hosts-raspi-dropbear"
56 /lib/cryptsetup/askpass "enter luks password: " > /lib/cryptsetup/passfifo # exit, wait for the raspi to boot completely
57 ssh pi@raspi-ip # this is the "normal" openssh-server, we are done :-)
58 # after every change of the kernel (kernelupdate) the initramfs has to be recreated, in my case I had to specify the new kernel version, it can be found in this directory (e.g. 4.1.19+): /lib/modules
59 sudo mkinitramfs -v -o /boot/initramfs.gz <kernelversion>