* Re: luks testing and source deb pkg
2011-11-02 17:59 ` Lukas Anzinger
@ 2011-11-02 18:12 ` Vladimir 'φ-coder/phcoder' Serbinenko
2011-11-02 18:31 ` James M. Leddy
2011-11-03 9:38 ` Lukas Anzinger
2 siblings, 0 replies; 10+ messages in thread
From: Vladimir 'φ-coder/phcoder' Serbinenko @ 2011-11-02 18:12 UTC (permalink / raw)
To: grub-devel
[-- Attachment #1: Type: text/plain, Size: 2630 bytes --]
On 02.11.2011 18:59, Lukas Anzinger wrote:
> Hi,
>
> I'm currently also trying to use to the luks code from trunk by using
> a modified Debian package and the latest source from the Bazaar
> repository.
>
> However after entering the password, the grub menu doesn't show up and
> it states that the password is incorrect. I used 12345 which is
> obviously very hard to misspell repeatedly. I then tried to insert the
> master password from the LUKS partition directly into the source code
> and luckily succeeded with that! I'll post the snippet and my
> modifications to the package tomorrow if someone is interested. Since
> there is practically no information about this in the internet, I'll
> probably write a tutorial on how to do a full system encryption
> "TrueCrypt style" (i.e. with an encrypted /boot partition).
>
Could you make a small 1MiB example image, compress and send it to me?
> So my question is, James, how did you create your encrypted partition
> and what file system did you use?
>
> I always use "cryptsetup luksFormat /dev/sda1" (on Debian Sid) which
> uses aes-cbc-essiv as a default value AFAIK and ext3.
>
> Could you also append your tared "debian" folder which generates the
> grub package(s)?
>
> Regards,
>
> Lukas
>
> On Tue, Nov 1, 2011 at 23:56, James M. Leddy <james.leddy@canonical.com> wrote:
>> Hi,
>>
>> I've successfully tested the luks code in ubuntu using a modified grub2
>> package. You can test yourself if you're already using crypted root and
>> separate /boot by rsying the /boot dev to the root filesyste, removing the
>> /etc/fstab entry, and running:
>>
>> # GRUB_CRYPTODISK_ENABLE=y grub-install --debug --modules=configfile
>> --modules=gcry_sha1 --modules=gcry_sha256 --modules=fshelp
>> --modules=biosdisk --modules=part_msdos --modules=linux --modules=ext2
>> --modules=help --modules=minicmd --modules=crypto --modules=cryptodisk
>> --modules=gcry_rijndael --modules=luks /dev/sda
>> # GRUB_CRYPTODISK_ENABLE=y update-grub
>>
>>
>> The merged source is available here:
>>
>> https://code.launchpad.net/~jm-leddy/+junk/grub-luks
>>
>> just do a :
>>
>> $ bzr branch lp:~jm-leddy/+junk/grub-luks
>> $ cd grub-luks
>> $ bzr builddeb
>>
>> _______________________________________________
>> Grub-devel mailing list
>> Grub-devel@gnu.org
>> https://lists.gnu.org/mailman/listinfo/grub-devel
>>
> _______________________________________________
> Grub-devel mailing list
> Grub-devel@gnu.org
> https://lists.gnu.org/mailman/listinfo/grub-devel
--
Regards
Vladimir 'φ-coder/phcoder' Serbinenko
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 294 bytes --]
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: luks testing and source deb pkg
2011-11-02 17:59 ` Lukas Anzinger
2011-11-02 18:12 ` Vladimir 'φ-coder/phcoder' Serbinenko
@ 2011-11-02 18:31 ` James M. Leddy
2011-11-03 6:47 ` Lukas Anzinger
2011-11-03 9:38 ` Lukas Anzinger
2 siblings, 1 reply; 10+ messages in thread
From: James M. Leddy @ 2011-11-02 18:31 UTC (permalink / raw)
To: grub-devel
On 11/02/2011 01:59 PM, Lukas Anzinger wrote:
> Hi,
>
> I'm currently also trying to use to the luks code from trunk by using
> a modified Debian package and the latest source from the Bazaar
> repository.
Please let me know where I can find this tree so that I can test myself.
Additionally, if you know if it should "just work" to just install the
Debian version to Ubuntu, please let me know. I'm a recent convert from
Fedora so a lot of this is new to me.
>
> However after entering the password, the grub menu doesn't show up and
> it states that the password is incorrect. I used 12345 which is
> obviously very hard to misspell repeatedly. I then tried to insert the
> master password from the LUKS partition directly into the source code
> and luckily succeeded with that! I'll post the snippet and my
> modifications to the package tomorrow if someone is interested. Since
> there is practically no information about this in the internet, I'll
> probably write a tutorial on how to do a full system encryption
> "TrueCrypt style" (i.e. with an encrypted /boot partition).
Expect one from me as well @ jmleddy.wordpress.com
>
> So my question is, James, how did you create your encrypted partition
> and what file system did you use?
>
> I always use "cryptsetup luksFormat /dev/sda1" (on Debian Sid) which
> uses aes-cbc-essiv as a default value AFAIK and ext3.
That's exactly what I did, except with ext4. The file system shouldn't
matter in evaluating the password. From dmsetup table:
aes-cbc-essiv:sha256
> Could you also append your tared "debian" folder which generates the
> grub package(s)?
Sure thing when I have a little more time.
>
> Regards,
>
> Lukas
>
> On Tue, Nov 1, 2011 at 23:56, James M. Leddy<james.leddy@canonical.com> wrote:
>> Hi,
>>
>> I've successfully tested the luks code in ubuntu using a modified grub2
>> package. You can test yourself if you're already using crypted root and
>> separate /boot by rsying the /boot dev to the root filesyste, removing the
>> /etc/fstab entry, and running:
>>
>> # GRUB_CRYPTODISK_ENABLE=y grub-install --debug --modules=configfile
>> --modules=gcry_sha1 --modules=gcry_sha256 --modules=fshelp
>> --modules=biosdisk --modules=part_msdos --modules=linux --modules=ext2
>> --modules=help --modules=minicmd --modules=crypto --modules=cryptodisk
>> --modules=gcry_rijndael --modules=luks /dev/sda
>> # GRUB_CRYPTODISK_ENABLE=y update-grub
>>
>>
>> The merged source is available here:
>>
>> https://code.launchpad.net/~jm-leddy/+junk/grub-luks
>>
>> just do a :
>>
>> $ bzr branch lp:~jm-leddy/+junk/grub-luks
>> $ cd grub-luks
>> $ bzr builddeb
>>
>> _______________________________________________
>> Grub-devel mailing list
>> Grub-devel@gnu.org
>> https://lists.gnu.org/mailman/listinfo/grub-devel
>>
>
> _______________________________________________
> Grub-devel mailing list
> Grub-devel@gnu.org
> https://lists.gnu.org/mailman/listinfo/grub-devel
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: luks testing and source deb pkg
2011-11-02 18:31 ` James M. Leddy
@ 2011-11-03 6:47 ` Lukas Anzinger
2011-11-03 10:55 ` Vladimir 'φ-coder/phcoder' Serbinenko
0 siblings, 1 reply; 10+ messages in thread
From: Lukas Anzinger @ 2011-11-03 6:47 UTC (permalink / raw)
To: The development of GNU GRUB
[-- Attachment #1: Type: text/plain, Size: 1854 bytes --]
I attached the contents of my debian folder which I used to build
proper packages out of revision 3520 from trunk. It's only tested on
x86 and the efi parts have been *removed* from the Debian package.
This is due to a bug in the grub build system (?) which I reported
here (http://lists.gnu.org/archive/html/grub-devel/2011-10/msg00048.html).
I didn't investigate any further since I don't need it. I removed some
patches that have already been applied to upstream (i.e. trunk) and
some patches that would need further work.
Before you can create the packages, you have to sync the translations
to the "po" directory of grub. Just read the README in the "po"
directory. After installation you have to add
"GRUB_CRYPTODISK_ENABLE=y" to /etc/default/grub.
# grub-install --debug
# update-grub
Make sure that the contents of your fstab file is correct and
everything is encrypted!
On Wed, Nov 2, 2011 at 19:31, James M. Leddy <james.leddy@ubuntu.com> wrote:
> Please let me know where I can find this tree so that I can test myself.
> Additionally, if you know if it should "just work" to just install the
> Debian version to Ubuntu, please let me know. I'm a recent convert from
> Fedora so a lot of this is new to me.
You could try, however, I would never do it on a production system but
rather in an VM.
2011/11/2 Vladimir 'φ-coder/phcoder' Serbinenko <phcoder@gmail.com>:
> Could you make a small 1MiB example image, compress and send it to me?
Do you mean the core.img created from the latest revision without any
modifications?
On Tue, Nov 1, 2011 at 23:56, James M. Leddy <james.leddy@canonical.com> wrote:
> $ bzr branch lp:~jm-leddy/+junk/grub-luks
Seems to me that you used the luks branch from grub. luks has already
been integrated into trunk there is no need to do that.
Regards,
Lukas
[-- Attachment #2: grub2-3520-debian.tgz --]
[-- Type: application/x-gzip, Size: 298217 bytes --]
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: luks testing and source deb pkg
2011-11-02 17:59 ` Lukas Anzinger
2011-11-02 18:12 ` Vladimir 'φ-coder/phcoder' Serbinenko
2011-11-02 18:31 ` James M. Leddy
@ 2011-11-03 9:38 ` Lukas Anzinger
2011-11-03 9:42 ` Lukas Anzinger
2011-11-03 10:56 ` Vladimir 'φ-coder/phcoder' Serbinenko
2 siblings, 2 replies; 10+ messages in thread
From: Lukas Anzinger @ 2011-11-03 9:38 UTC (permalink / raw)
To: The development of GNU GRUB
On Wed, Nov 2, 2011 at 18:59, Lukas Anzinger <l.anzinger@gmail.com> wrote:
> However after entering the password, the grub menu doesn't show up and
> it states that the password is incorrect. I used 12345 which is
> obviously very hard to misspell repeatedly.
It seems that the function grub_getpassword() has problems with
numbers coming from the numpad. I added some debugging printfs to the
luks code and found out that the passphrase variable always contained
an empty string.
I then investigated the problem further and found out that it also
happens if I place the password 12345 in the grub.cfg:
##
set superuser="foo"
password foo 12345
##
I can only edit a boot entry if I enter 12345 *NOT* via the num pad.
This seems to be a bug in grub_password_get() or one of the functions
it calls, like grub_getkey().
Regards,
Lukas
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: luks testing and source deb pkg
2011-11-03 9:38 ` Lukas Anzinger
@ 2011-11-03 9:42 ` Lukas Anzinger
2011-11-03 10:56 ` Vladimir 'φ-coder/phcoder' Serbinenko
1 sibling, 0 replies; 10+ messages in thread
From: Lukas Anzinger @ 2011-11-03 9:42 UTC (permalink / raw)
To: The development of GNU GRUB
Works for me now, if I disable num lock and enable it afterwards.
Strange problem, VirtualBox could als be at fault, though.
On Thu, Nov 3, 2011 at 10:38, Lukas Anzinger <l.anzinger@gmail.com> wrote:
> On Wed, Nov 2, 2011 at 18:59, Lukas Anzinger <l.anzinger@gmail.com> wrote:
> I can only edit a boot entry if I enter 12345 *NOT* via the num pad.
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: luks testing and source deb pkg
2011-11-03 9:38 ` Lukas Anzinger
2011-11-03 9:42 ` Lukas Anzinger
@ 2011-11-03 10:56 ` Vladimir 'φ-coder/phcoder' Serbinenko
2011-11-03 11:11 ` Lukas Anzinger
1 sibling, 1 reply; 10+ messages in thread
From: Vladimir 'φ-coder/phcoder' Serbinenko @ 2011-11-03 10:56 UTC (permalink / raw)
To: grub-devel
[-- Attachment #1: Type: text/plain, Size: 1196 bytes --]
On 03.11.2011 10:38, Lukas Anzinger wrote:
> On Wed, Nov 2, 2011 at 18:59, Lukas Anzinger <l.anzinger@gmail.com> wrote:
>> However after entering the password, the grub menu doesn't show up and
>> it states that the password is incorrect. I used 12345 which is
>> obviously very hard to misspell repeatedly.
> It seems that the function grub_getpassword() has problems with
> numbers coming from the numpad. I added some debugging printfs to the
> luks code and found out that the passphrase variable always contained
> an empty string.
>
> I then investigated the problem further and found out that it also
> happens if I place the password 12345 in the grub.cfg:
>
> ##
> set superuser="foo"
> password foo 12345
> ##
>
> I can only edit a boot entry if I enter 12345 *NOT* via the num pad.
>
Stupid question: numlock?
> This seems to be a bug in grub_password_get() or one of the functions
> it calls, like grub_getkey().
>
> Regards,
>
> Lukas
>
> _______________________________________________
> Grub-devel mailing list
> Grub-devel@gnu.org
> https://lists.gnu.org/mailman/listinfo/grub-devel
>
--
Regards
Vladimir 'φ-coder/phcoder' Serbinenko
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 294 bytes --]
^ permalink raw reply [flat|nested] 10+ messages in thread