I'm trying to unlock a headless server running an encrypted version of Ubuntu 14.04. It is a clean 14.04.2 install with all updates as of writing.
I went thtrough the standard shenanigans with dropbear
and busybox
, i.e.:
# INSTALL
sudo apt-get install dropbear busybox # on server
# ENABLE AND CONFIGURE IP
sudo sed -i 's/NO_START=1/NO_START=0/g' /etc/default/dropber
sudo sed -i 's/BUSYBOX=y/BUSYBOX=y\nDROPBEAR=y\n/g' \
/etc/iniramfs/iniramfs.conf
sudo sed -i 's/DEVICE=.+/DEVICE=etho0/g' \
/etc/iniramfs/initramfs.conf
sudo sed -i 's/IP=.+/IP=IP=192.168.0.11:::255.255.255.0::eth1:off' \
/etc/initramfs/initramfs.conf
sudo update-initramfs
# COPY DROPBEAR SSH KEY
# WRONG: sudo cp /etc/dropbear/dropbear_*_host_key /tmp
sudo cp /etc/initramfs-tools/root/.ssh/id_rsa /tmp # BETTER!
sudo chown $USER:$USER /tmp/id_rsa
scp server:/tmp/id_rsa ~/.ssh/id_rsa_dropbear_server # on client
sudo reboot # on server
# CONNECT TO SERVER
ssh -vv -i ~/.ssh/id_rsa_dropbear_server \
-o 'UserKnownHostsFile=~/.ssh/known_hosts.initramfs' \
[email protected] # on client
So I copied the auto-generated ssh-key and did a minimal configuration of dropbear. To my surprise two three things are malfunctioning:
- The system ignores the IP settings. I found in my router's "connected devices" site, that the server has the ip
192.168.0.27
despite my configuration. So I tried the listed wrong IP with:ssh -vv -i ~/.ssh/dropbear_dss_host_key -o 'UserKnownHostsFile=~/.ssh/known_hosts.initramfs' [email protected]
. That connects to dropbear but: - Dropbear ignores all public keys other than its own in
/etc/initramfs-tools/root/.ssh/authorized_keys
(tested with dss - maybe also rsa).
Solved:Dropbear wants a passphrase for the key, which I do not have. So I tried an empty passphrase. With which dropbear drops to password authentication and wants the root password, that is not set. - Custom hook scripts seem to be partially ignored. These are scripts that worked in older install!
Here is the whole ssh session.
I added my usual public key file to dropbear's known hosts in the server's /etc/initramfs-tools/root/.ssh/authorized_keys
and tried to ssh with my usual key. That didn't work.
I added the line GRUB_CMDLINE_LINUX_DEFAULT="ip=192.168.0.11::192.168.0.1:255.255.255.0::eth0:none"
to the server's /etc/default/grup
and updated grup. That was meant to fix the IP issue. But that didn't work either.
I'm now thoroughly annoyed and at the end of my patience. Where did I go wrong? Also, is the syntax for the IP settings right because one guide says ::eth0:off
and the next says ::etho:none
?
Edit
There is someone with what seems to be the same problem on 15.04.
Edit 2
I can now connect to the server. Turns out, I had copied the wrong private key to use with dropbear. The error has been corrected in my script above. But adding keys still doesn't work (i.e. to dropbear's authorized_keys
file). There's word you need to convert the public keys, that you want to add to /etc/initramfs-tools/root/.ssh/authorized_keys
to dropbear's format, but I don't want to spend time searching how. I only tried dss
public keys. Maybe dropbear just likes rsa
better?
Also I noticed, that custom hook scripts don't seem to work. They are not included in the initramfs' directories but lsinitramfs -l /boot/initrd.img-3.16.0-43-generic
lists them as part of the image. The IP settings are still ignored as well. Even if I add GRUB_CMDLINE_LINUX_DEFAULT="ip=192.168.0.11::192.168.0.1:255.255.255.0::eth0:none"
to the grubconfig in /etc/default/grub
and update everything.
Edit 3
So it seems that /usr/lib/dropbear/dropbearconvert INPUTFORMAT OUTPUTFORMAT INFILE OUTFILE
is the program to convert keys. The FORMAT parameter can be either openssh
or dropbear
. But it doesn't seem that's the answer on how to add keys to the servers /etc/initramfs-tools/root/.ssh/authorized_keys
. The existing key there already is in openssh's public key file format. So adding other openssh-format keys shouldn't be a problem. Yet it is.