Unlocking multiple devices

[Zen Fu]

Hello!

i found a way to unlock multiple devices in Debian so i'll answer my own
question.

The Debian crypttab format allows an option called "keyscript=<path>"[1]
with which "The executable at the indicated path is executed with the
value of the third field as only argument."

And the Debian cryptsetup package provides a script called
"decrypt_keyctl"[2] which is described as:

  A passphrase caching script to be used in `/etc/crypttab` on Debian
  and Ubuntu.  When there are multiple cryptsetup (either plain or LUKS)
  volumes with the same passphrase, it is an unnecessary task to input
  the passphrase more than once.

So adding "initramfs,keyscript=decrypt_keyctl" to each device in
/etc/crypttab works perfectly with Mandos when multiple disks have the
same passphrase.

Note: this is all Debian specific.

Thanks!

[1] https://manpages.debian.org/testing/cryptsetup/crypttab.5.en.html
[2] https://salsa.debian.org/cryptsetup-team/cryptsetup/-/blob/debian/latest/debian/README.keyctl

"Zen Fu" <zen at torproject.org> writes:
> Hello, dear Mandos devs! I have a question about a corner case use of
> Mandos.
>
> Our setup is such that we need to unlock 3 devices which, once
> decrypted, form part of the same LVM VG. All of them need to be unlocked
> before / can be mounted. They all have the same password.
>
> Our issue is that mandos-client runs only once, so only the first volume
> is unlocked and the kernel still needs 2 more password inputs before
> it's able to proceed.
>
> I wonder what's the best way to achieve that in a Debie Trixie box.
>
> I *think* that scripts/init-premount/mandos is not parsing
> /conf/conf.d/cryptroot because that file doesn't exist in the initrd, so
> it only triggers /lib/mandos/mandos-to-cryptroot-unlock once.
>
> Is there a simple way to make mandos-client run 3 times? I think that
> would be enough to solve our issue.
>
> Thanks a lot for the great tool!
>
> PS: i'm not in this list, so please make sure that my email address is
> included in replies.
>
> -- 
> Zen Fu
-- 
Zen Fu