72 lines
2.7 KiB
Text
72 lines
2.7 KiB
Text
Debugging Cryptsetup issues
|
|
===========================
|
|
|
|
Cryptsetup is responsible for unlocking dm-crypt devices. The cryptsetup Debian
|
|
provide a whole slew of helper scripts that integrate cryptsetup into the
|
|
Debian operating system. The most important ones are the `cryptdisks` init
|
|
script and the `cryptroot` initramfs scripts, both implementing support for the
|
|
`/etc/crypttab` configuration file and for automatic unlocking of encrypted
|
|
devices during the boot process.
|
|
|
|
This page collects information on debugging different features of the Debian
|
|
cryptsetup packages in case of problems.
|
|
|
|
Debug cryptroot initramfs script
|
|
--------------------------------
|
|
|
|
In order to debug the cryptroot initramfs script during initramfs stage, the
|
|
following steps are required:
|
|
|
|
* Boot into the initramfs rescue shell by adding `break=premount` as kernel
|
|
option during boot
|
|
|
|
In grub, this can be done interactively from the grub boot menu: `<E>` to
|
|
edit, and `<Ctrl>+<X>` to boot once you've edited the kernel line.
|
|
|
|
See <https://help.ubuntu.com/community/Grub2/Troubleshooting#Editing_the_GRUB_2_Menu_During_Boot>
|
|
for details.
|
|
|
|
* Append `-x` to the shebang (first line) of cryptroot initramfs script:
|
|
|
|
sed -i -e '1s,^#!/bin/sh,& -x,' /scripts/local-top/cryptroot
|
|
|
|
* Run the cryptroot initramfs script manually, redirecting output to a log file:
|
|
|
|
/scripts/local-top/cryptroot 2>&1 | tee /run/initramfs/cryptroot.debug
|
|
|
|
**Please note:** if the boot process is broken, you might need to mount an
|
|
external storage device (e.g. a USB flash drive) inside the initramfs and
|
|
redirect the output to a log files on this external device.
|
|
|
|
* Continue the boot process (by pressing `<Ctrl>+<D>`) and save a copy of the
|
|
debug log file to `/run/initramfs/cryptroot.debug`. The content of `/run/`
|
|
will be lost after reboot.
|
|
|
|
Sometimes, debugging the initramfs directly can be helpful as well. See
|
|
<https://wiki.debian.org/InitramfsDebug#Saving_debug_information> for details.
|
|
|
|
Gather debugging information in the initramfs rescue shell
|
|
----------------------------------------------------------
|
|
|
|
Useful commands to gather information from initramfs rescue shell:
|
|
|
|
* Check for device-mapper support (these directories/symlinks exist only if
|
|
kernel has device-mapper support):
|
|
|
|
ls -l /sys/class/misc/device-mapper /sys/devices/virtual/misc/device-mapper
|
|
|
|
* Check whether dm-crypt kernel module is loaded:
|
|
|
|
lsmod | grep dm-crypt
|
|
|
|
* Display cryptroot configuration and list loaded kernel modules:
|
|
|
|
cat /cryptroot/crypttab
|
|
lsmod
|
|
|
|
* Gather information about the available block devices:
|
|
|
|
blkid
|
|
ls -l /dev/disk/by-*/
|
|
|
|
-- Jonas Meurer <jonas@freesources.org>, Wed 25 Dec 2019 02:58:00 PM CET
|