Unlocking Rootfs encryption over SSH

Package information

If you have followed Rootfs encryption and would like to unlock the root device remotely you can using Dropbear.

This document assumes you have configured encryption using Dracut with Systemd and booting using Grub.

Installation

Emerge

Install dropbear

root #emerge --ask net-misc/dropbear

Configure dropbear

Generate the dropbear server host keys

root #dropbear -R

Edit /etc/dropbear/authorized_keys with the SSH public key(s) you will use to access the machine.

Dracut module

Create the module directory

root #mkdir /usr/lib/dracut/modules.d/50dropbear

Create the script which starts dropbear replace 2222 with your port of choice.

FILE /usr/lib/dracut/modules.d/50dropbear/dropbear-init.sh

#!/bin/sh 
echo"Starting Dropbear SSH server..."
dropbear-E-s-j-k-p2222&

Create the script used to unlock the disks.

FILE /usr/lib/dracut/modules.d/50dropbear/unlock.sh

#!/bin/sh
forfin$(systemctllist-units|awk'/systemd.*activating/ {print 2ドル}')
do
systemctlstart"$f"
done

Create the script which will configure the module.

FILE /usr/lib/dracut/modules.d/50dropbear/module-setup.sh

#!/bin/sh 

check(){
return0
}
depends(){
echo"network"
}
install(){
instdropbear
inst/etc/dropbear/authorized_keys/root/.ssh/authorized_keys
inst/etc/dropbear/dropbear_ecdsa_host_key/etc/dropbear/dropbear_ecdsa_host_key
inst/etc/dropbear/dropbear_ed25519_host_key/etc/dropbear/dropbear_ed25519_host_key
inst/etc/dropbear/dropbear_rsa_host_key/etc/dropbear/dropbear_rsa_host_key
inst/usr/lib/dracut/modules.d/50dropbear/unlock.sh/bin/unlock
inst_hookinitqueue50"$moddir/dropbear-init.sh"
}

Allow executing the scripts

root #

chmod u+x /usr/lib/dracut/modules.d/50dropbear/dropbear-init.sh /usr/lib/dracut/modules.d/50dropbear/unlock.sh /usr/lib/dracut/modules.d/50dropbear/module-setup.sh

Updated the initramfs

root #dracut --force

Grub

Edit /etc/default/grub and configure the network parameters, this assumes you've already added rd.luks.uuid

FILE /etd/default/grub

GRUB_CMDLINE_LINUX_DEFAULT="rd.luks.uuid=fbb4fc25-3fa7-4ff7-aeca-b867be758f80 rd.neednet=1 ip=single-dhcp

Update the grub config

root #grub-mkconfig -o /boot/grub/grub.cfg

Usage

SSH into the machine

user $ ssh -p 2222 root@xxx.xxx.xxx.xxx

Then unlock the drive

root #unlock

-sh-5.2# unlock 
🔐 Please enter passphrase for disk DISK (luks-fbb4fc25-3fa7-4ff7-aeca-b867be758f80): (press TAB for no echo)

Dropbear will automatically close the connection once the passphrase is accepted.