I would like to be able to unlock my desktop with the keyboard and remotely with dropbear.
Both /root and /home are encrypted with luks.
So far I installed dropbear, mkinitcpio-dropbear, mkinitcpio-busybox, mkinitcpio-netconf, mkinitcpio-nfs-utils, mkinitcipio-openswap and mkinitcpio-utils. Acording to the tutorials I found I tried to configure dropbear to start rigth at satartup and made it listen to port 222. As far as I can tell dropbear only starts after I typed the first password (which obviously is to late). And now I’m stuck.
Can someone help me out? (I do deliver the necessary informations, but I’m unsure what is necessary.)
Are there somewhere up to date instructions, that actually work?
And you will be stuck at that point - although it could be interesting what tutorials you used.
Why will you be stuck?
Because your dropbear will need the system to run it - which will only start and run after it is booted - which will never happen without you somehow unlocking the encrypted root at least.
IMO
… it would be a different matter if the system is already up and running
but just the desktop is “locked” somehow
At least a separate unencrypted boot partition with unencrypted kernel/initrd will be needed. Maybe it is easier to just leave the whole root unencrypted.
You just need to decide if you want a systemd based initramfs or a Busybox based initramfs. Of course you can’t use a system that also encrypts the initramfs images. It either needs to be on a unencrypted boot partition or the image needs to be on your ESP.
If you need Wifi it is way more complex, so first do it only over Ethernet.
If you enabled and started any dropbear service you did it wrong. Stop and start over. Also be prepared to manual open and chroot in your install from a live system, it might be necessary if you messed something up.
Thanks, that was one of the pages I used (but I started off with an other one). /boot is unencrypted and I believe the initramfs images are on /boot. Anyway I’m not sure if I got it correctly:
Key:
copy the public ssh key to /etc/dropbear/root_key
Initramfs hooks:
Add netconf dropbear encryptssh hooks before filesystems to /etc/mkinitcpio.conf
Boot loader:
Here I’n not sure the boot loader is /etc/default/grub correct?
If I assign the ip with the router then I can just add ip=dhcp correct?
And the correct line is GRUB_CMDLINE_LINUX_DEFAULT= correct?
What about the port dropbear is listening to, which one is it and can I change it somewhere?
Is that it?
This is good but not the only requirement. On a default Manjaro install, the Root partition will be opened by grub. It is important that the unlock happens later. The notable difference is that you will have multiple tries to put the correct password in. With grub you need to hard reset your system if you try the wrong password.
Make sure to replace encrypt with encryptssh. If you don’t have the encrypt hook, it can’t work.
If you use grub, the correct config file would be /etc/default/grub
Yes.
The user name is root and the port is 22. It can’t be changed with a config file.
However, if it works, you can create your own mkinitcpio-dropbear package with a customized dropbear command. (Or edit the dropbear_hook file and change it, keep in mind that it will be reverted if the package gets updated.)
Thanks for your help. I did not find the time to fiddle with the machine, but two things are still unclear to me:
I have a new manual installation of manjaro. The only customisation is a separate partition for /home. I have 3 tries to get the password correct. And as far as I can tell I type the password after grub (there is a manjaro logo visible and the grub menu i already passed). So I guess that is fine.
I think I have LUKS 1 (I thought manjaro is up to date?) If I understood your link correctly that is good, is it?
Finally I got round fiddelying around with the configuration. Unfortunately it still does not work.
First the machine is not reachable with: ssh -i ~/.ssh/id_dropB root@MY IP -p 22. It does work after I unlocked the machine in question.
And the second funny thing is that I have to type the password twice to unlock the machine with the keyboard. I guess that is the case because I have a second hdd that is unlocked with a keyfile (it did work before I canged mkinitcpio.conf).
How can I find the mistake?
The identity file might not be accessible.
To me it looks like it is in your $HOME directory - while you are trying to connect as root
(which is … not ideal …)
Is such identity file even needed?
Personally, I never allow root logins via ssh - only specific users. They can elevate privileges later, after connection … just as you normally do when logged in locally.
… I also never run it on the standard port 22, except for local testing …
I, for one, am still not clear how you set up your system, so that you can expect to run a ssh or dropbear instance before the initrd, which presumably contains these, will be even started, because Grub might be needed to first unlock the disk to get to the initrd and all the rest.
Or I have missed it …
We haven’t seen inxi -zv8 for example - which could make things more clear.
Finally I figured it out.
Migrating from Ubuntu to Manjaro I added the new LUKS keyfile only to crypttab but forgot to add it to LUKS itself. Interestingly it did still worked as long as I just typed in the password once normaly, it opend all the volumes. Probably changing the initramfs hook from encrypt to encryptssh it stopped working (the password only opend root).