<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Teddy, thank you — the change you suggested works. No problem now; both partitions are unlocked in quick succession with password from server.<div class=""><br class=""></div><div class="">I added a number of echo commands into the loop in mandos-to-cryptroot-unlock to watch what was happening, as follows:</div><div class=""><br class=""></div><div class=""><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">echo "mandos mk: starting cryptroot-unlock attempts" >&2</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">while command -v cryptroot-unlock >/dev/null 2>&1; do</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> echo "mandos mk: start a new plugin-runner to get a password" >&2</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> /lib/mandos/plugin-runner > "$passfile" &</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> echo $! > /run/mandos-plugin-runner.pid</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> echo "mandos mk: waiting for plugin-runner..." >&2</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> wait %% || break</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> echo "mandos mk: plugin-runner completed" >&2</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier; min-height: 13px;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""></span><br class=""></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> # Try this password ten times (or ten seconds)</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> for loop in 1 2 3 4 5 6 7 8 9 10; do</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>echo "mandos mk: trying cryptroot-unlock #$loop" >&2</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>if [ -e /run/mandos-keep-running ]; then</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><span class="Apple-tab-span" style="white-space:pre"> </span> # Mike K 2020-05-17: On advice from Teddy Hogeborn, remove</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><span class="Apple-tab-span" style="white-space:pre"> </span> # the break since it stops providing password after a single successful attempt</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><span class="Apple-tab-span" style="white-space:pre"> </span> #cryptroot-unlock < "$passfile" >/dev/null 2>&1 && break 2</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><span class="Apple-tab-span" style="white-space:pre"> </span> cryptroot-unlock < "$passfile" >/dev/null 2>&1</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><span class="Apple-tab-span" style="white-space:pre"> </span> echo " cryptroot-unlock #$loop exited with $?" >&2</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><span class="Apple-tab-span" style="white-space:pre"> </span> sleep 1</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>else</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><span class="Apple-tab-span" style="white-space:pre"> </span> echo " /run/mandos-keep-running is gone; break" >&2</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><span class="Apple-tab-span" style="white-space:pre"> </span> break 2</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>fi</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> done</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> echo "mandos mk: finished" >&2</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">done</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">echo "mandos mk: finished, or plugin-runner failed" >&2</span></div></div><div class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><br class=""></span></div><div class=""><span style="font-variant-ligatures: no-common-ligatures" class="">/var/log/boot.log shows:</span></div><div class=""><br class=""></div><div class=""><div style="margin: 0px; font-stretch: normal; line-height: normal;" class=""><span style="font-family: Courier; font-size: 11px; font-variant-ligatures: no-common-ligatures;" class="">mandos mk: starting </span><span style="font-variant-ligatures: no-common-ligatures;" class=""><font face="Courier" class=""><span style="font-size: 11px;" class="">cryptroot-unlock attempts</span></font></span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">mandos mk: start a new plugin-runner to get a password</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">mandos mk: waiting for plugin-runner...</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Reading all physical volumes. This may take a while...</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">IP-Config: eno1 hardware address xx:xx:xx:xx:xx:xx mtu 1500</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> /dev/sdi: open failed: No medium found</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">IP-Config: eno1 guessed broadcast address xxx.xxx.xxx.xxx</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">IP-Config: eno1 complete:</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> address: xxx.xxx.xxx.xxx broadcast: xxx.xxx.xxx.255 netmask: 255.255.255.0 </span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> gateway: 0.0.0.0 dns0 : 0.0.0.0 dns1 : 0.0.0.0 </span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> host : xxxxxxxxxx </span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> rootserver: 0.0.0.0 rootpath: </span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> filename : </span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> Found volume group "tm" using metadata type lvm2</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> /dev/sdi: open failed: No medium found</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> 5 logical volume(s) in volume group "tm" now active</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">mandos mk: plugin-runner completed</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">mandos mk: trying cryptroot-unlock #1</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> cryptroot-unlock #1 exited with 0</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">mandos mk: trying cryptroot-unlock #2</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> cryptroot-unlock #2 exited with 0</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">mandos mk: trying cryptroot-unlock #3</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> /run/mandos-keep-running is gone; break</span></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Courier;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">mandos mk: finished, or plugin-runner failed</span></div><div class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><br class=""></span></div><div class=""><span style="font-variant-ligatures: no-common-ligatures" class="">Many thanks!</span></div><div class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><br class=""></span></div><div class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>-Mike</span></div><div><br class=""><blockquote type="cite" class=""><div class="">On May 17, 2020, at 6:33 AM, Teddy Hogeborn <<a href="mailto:teddy@recompile.se" class="">teddy@recompile.se</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Mike Klein <<a href="mailto:mike@kleinnet.com" class="">mike@kleinnet.com</a>> writes:<br class=""><br class=""><blockquote type="cite" class=""><blockquote type="cite" class="">In the case of an initramfs image created by initramfs-tools(7), the<br class="">Mandos client (actually the plugin-runner(8mandos) which in turn<br class="">runs the Mandos client) is started at boot and kept running<br class="">(re-started if it exits) until the root disk has been mounted.<br class="">Every time a password is recieved by the Mandos client, it is sent<br class="">as input to the "cryptroot-unlock" program (a part of the<br class="">"cryptsetup-initramfs" package, documented by<br class="">/usr/share/doc/cryptsetup-run/README.Debian.gz). That program, as<br class="">documented, keeps accepting passwords until all devices are<br class="">unlocked. Therefore, using the same password for multiple devices<br class="">should work, in theory.<br class=""><br class="">If you are having problems with this, debug by adding --debug and/or<br class="">--options-for=mandos-client:--debug to the<br class="">"/etc/mandos/plugin-runner.conf" file, rebuild the initramfs with<br class="">"update-initramfs -k all -u", and reboot.<br class=""></blockquote><br class="">Thank you, Teddy. I finally got time to work on this again. I am<br class="">replying to your email as I haven’t found a way to reply on the<br class="">archive site. I’m going to attach a log file from setting --debug for<br class="">mandos-client.<br class=""><br class="">The dual-drive automatic unlock is not working. From what I can gather:<br class=""><br class="">1) plugin-runner runs early in the cryptsetup process and it actually<br class="">contacts the server and gets the correct passphrase<br class="">2) However, it appears that cryptsetup ignores the output and asks for<br class="">interactive entry of the passphrase for both file systems to be<br class="">unlocked<br class=""></blockquote><br class="">The initramfs-tools boot system always asks for passphrase on the<br class="">console; a password could still be provided by mandos-client in the<br class="">background even though a password prompt is visible and active.<br class=""><br class=""><blockquote type="cite" class="">3) The debug log shows that mandos-client has exited and this is still<br class="">on the screen when I see the prompt for the passphrase for the first<br class="">file system<br class=""></blockquote><br class="">This is probably normal. As seen in the script<br class="">/usr/lib/$ARCH/mandos/mandos-to-cryptroot-unlock, the Mandos<br class="">plugin-runner is run once, and the password obtained thereby is passed<br class="">to the cryptroot-unlock executable ten times in a row, after which the<br class="">password is discarded and new password is obtained. This continues<br class="">until the initramfs boot process has progressed far enough that the root<br class="">file system has been mounted.<br class=""><br class="">However, I now see that my initial description of this procedure was<br class="">incorrect; if the password is passed *successfully* to cryptroot-unlock,<br class="">the whole procedure stops, and will therefore not unlock more than one<br class="">device. If you want to keep using initramfs-tools, you could try<br class="">editing the mandos-to-cryptroot-unlock script to remove the "&& break 2"<br class="">at the end of line 72, and rebuild the initramfs image.<br class=""><br class=""><blockquote type="cite" class="">I’m attaching the debug output, with decrypted passphrase removed. The<br class="">debug output scrolls by on the screen before I see the passphrase<br class="">prompt, but it could be that the prompt occurs early and scrolls off<br class="">the screen quickly and then is printed again.<br class=""></blockquote><br class="">This debug output only tells us two useful things:<br class=""><br class="">1. A password was successfully obtained.<br class="">2. A password was only requested once.<br class=""><br class=""><blockquote type="cite" class="">I am using initramfs-tools.<br class=""></blockquote><br class="">You could try using dracut; this, as I explained previously, uses<br class="">competely different password delivery mechanisms, both of which should,<br class="">theoretically, work with multiple encrypted devices.<br class=""><br class=""><blockquote type="cite" class="">I also agree that ZFS should be underneath and encryption on top, and<br class="">this is the long term intent, but this is not available until ZFS<br class="">implements native encryption, which also provides other features<br class="">e.g. snapshots are encrypted so sending and saving snapshots offsite<br class="">is encrypted throughout. If the dual-unlock does not work, I will<br class="">probably go back to LUKS over software RAID1.<br class=""></blockquote><br class="">/Teddy Hogeborn<br class=""><br class="">-- <br class="">The Mandos Project<br class=""><a href="https://www.recompile.se/mandos" class="">https://www.recompile.se/mandos</a><br class="">_______________________________________________<br class="">Mandos-Dev mailing list<br class="">Mandos-Dev@recompile.se<br class="">https://mail.recompile.se/cgi-bin/mailman/listinfo/mandos-dev<br class=""></div></div></blockquote></div><br class=""></div></body></html>