Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Provide LUKS passphrase via SSH non-interactively #85

Open
pschmitt opened this issue Mar 12, 2021 · 4 comments
Open

Provide LUKS passphrase via SSH non-interactively #85

pschmitt opened this issue Mar 12, 2021 · 4 comments

Comments

@pschmitt
Copy link

Heyhey thanks for making this great piece of tech :)

I've been trying to use ansible to auto-unlock a system.
Is there a way to do so?

So far I've tried echo "passPhrasexxx" | ssh [email protected] but that doesn't work.
Am I missing something obvious I can do instead?

@pschmitt
Copy link
Author

pschmitt commented Mar 12, 2021

Been digging around a bit. The best I could come up with (that works) is the following:

ssh [email protected] /usr/bin/cryptsetup luksOpen /dev/sda2 root - <<< "secretPassPhrase69420"

while ! ssh [email protected] /usr/bin/test -e /dev/mapper/root
do
  sleep 1
done

ssh [email protected] /usr/bin/systemctl restart [email protected]

EDIT: The test part is probably not necessary ie:

ssh [email protected] /usr/bin/cryptsetup luksOpen /dev/sda2 root - <<< "secretPassPhrase69420"
ssh [email protected] /usr/bin/systemctl restart [email protected]

@Andrei-Pozolotin
Copy link
Collaborator

@pschmitt Philipp:
looks like you have a solution already
is there anything you need more than that?

@pschmitt
Copy link
Author

While the commands I posted above do kinda work they are not exactly general enough to scale (you'd need to know the root device name or uuid - which leads to another ssh call).

Ideally for my use case the unlock and boot of the system would be achievable within a single ssh call, similarly to what can done with dracut-sshd where you can do echo Password | ssh example.com.

Long story short: what I am asking for is another script_entry value or something similar that would just read the passphrase from stdin and attempt the unlock non-interactively.

@Andrei-Pozolotin
Copy link
Collaborator

another script_entry value or something similar that would just read the passphrase from stdin

I see. please send a PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants