Re: [dm-crypt] Bug Report to Ubuntu regarding dangerous installer

Re: [dm-crypt] Bug Report to Ubuntu regarding dangerous installer

[Arno Wagner]

There is a bug report about this already in the Ubuntu bug
tracking system here, whih was upgraded to "critical" as
result of my bug report. 

http://launchpad.net/bugs/420080

It should get looked at for 11.04 now and hopefully be fixed.
The only thing really needed is a detection of existing 
LUKS headers and a strong warning that you will kill them
by proceeding.

For my side this closes the discussion. Any clunky 
cryptsetup-integrated backup is not a clean option, as
"luksHeaderBackup" works just fine and avoids numerous
possible problems with the other solutions proposed here.
It just has to be used. 

Arno
-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier 

[dm-crypt] yet another "lost my partition" message

[Hugo Melo]

[-- Attachment #1: Type: text/plain, Size: 495 bytes --]

Hi everyone,
I've just lost my home partition trying to reinstall ubuntu.
On the installation process, trying to configure my encrypted home
partition, I thought it was going to mount my partition but it was asking
for the new key.
After that I rebooted and didn't make any other changes to my partition.
It seems the partitioner used "cryptsetup luksFormat". Do you think I can
still restore my partition?
I used the same passphrase configured for my home.
Thanks on any light
-- 
-- Hugo Melo

[-- Attachment #2: Type: text/html, Size: 562 bytes --]

Re: [dm-crypt] yet another "lost my partition" message

[Cristian KLEIN]

Hello list,

> I've just lost my home partition trying to reinstall ubuntu.
> On the installation process, trying to configure my encrypted home
> partition, I thought it was going to mount my partition but it was asking
> for the new key.
> After that I rebooted and didn't make any other changes to my partition.
> It seems the partitioner used "cryptsetup luksFormat". Do you think I can
> still restore my partition?
> I used the same passphrase configured for my home.

This is *exactly* what I did yesterday. I thought I was tired or
something, but seeing that it happened to somebody else too, I start
thinking that the installer's interface sucks ... badly!

I assume there is no way to recover the original file system. Ubuntu has
most likely overwritten the LUKS header where the pretious salt is being
stored. The unencrypted disk most likely looks like random data now.
According to the FAQ [1], you can still resort to the dm-crypt
mailing-list to get over the five stages of grief.

A posteriori, I cannot help wonder why such pretious information isn't
kept redundantly. Surely LUKS could have stored the header in 10 random
sectors with an easy-to-grep "HERE I AM" banner. Wouldn't this allow
users to recover the master-key (and part of the file-system) without
compromising security?

Cristi.

P.S. Could anybody donate 2^256 CPU-seconds?
P.S.2. What stage of grief am I in? :D

[1] http://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions

[dm-crypt] Bug Report to Ubuntu regarding dangerous installer

[Arno Wagner]

Dear all,

I just sent the email below to ubuntu-bugsquad@lists.ubuntu.com.
I did not find another way to report a bug without installing
Ubuntu (which am an not about to do). If somebody knows a better
way or has Ubuntu installed and can file this directly for the
installer package, please feel free.

I hope this communicates the problem adequately.

Arno

---

Subject: Ubuntu installer kills LUKS partitions without warning


Hi,

first, I don't have Ubuntu and I don't plan on using it.
As I did not find another way that allows me to report
a serious issue without subscribing to something, I use
this venue.


Please forward this to the Ubuntu installer development team.


The dm-crypt mailing list (archive here:
http://dir.gmane.org/gmane.linux.kernel.device-mapper.dm-crypt)
has had several reports that the Ubuntu installer creates 
new LUKS partitions (encrypted partitions) on top of exisiting 
ones without giving adequate warning and at the same time
giving the impression that the existing LUKS partition would be 
activated. The rather clear warning and verification question 
asked by the cryptsetup tool seems to get disabled with the 
"--batch-mode" option.

This causes irreversible loss of all data! Nothing
(in the cryptographically strong sense) can be done
to get the data back!

Checking for an existing LUKS partition is easy,
it has the magic string 'L','U','K','S, 0xBA, 0xBe  
at the beginning. It seems this is not checked for, 
or no additional warning or only inadequate additional 
warning is given if a pre-exisiting LUKS partition 
is about to be permanently and irretrivably erased. 

Please fix the installer ASAP and if you need help doing 
it right, _ask_! We will be happy to help.                             

Regards,
Arno Wagner
Maintainer cryptsetup FAQ

-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier 

Re: [dm-crypt] Bug Report to Ubuntu regarding dangerous installer

[Claudio Moretti]

[-- Attachment #1: Type: text/plain, Size: 1842 bytes --]

On Fri, Apr 15, 2011 at 18:58, Arno Wagner <arno@wagner.name> wrote:

> Dear all,
>
> I just sent the email below to ubuntu-bugsquad@lists.ubuntu.com.
> I did not find another way to report a bug without installing
> Ubuntu (which am an not about to do). If somebody knows a better
> way or has Ubuntu installed and can file this directly for the
> installer package, please feel free.
>
> I hope this communicates the problem adequately.
>
> Arno
>
> As far as I know (I'm an Ubuntu user, with a little experience) you can
choose between automatic and manual partitioning; partitioning options are
shown here: https://help.ubuntu.com/community/GraphicalInstall and the
partition step in the installation process is fully described here:
https://help.ubuntu.com/10.10/installation-guide/i386/module-details.html#di-partition

If you choose automatic partitioning, you will lose the content of your
disks, but the system warns you; if you choose manual partitioning and
delete the dm-crypt partitions to make new ones, I don't see how the
installer can warn you, aside from telling you you're destroying a partition
(and if you choose manual partitioning, you should know what can happen,
otherwise you shouldn't use it).

In order to use encrypted disks, the installer needs to write the partition
table: before doing it, it warns you that when writing the partition table
changes will be written on the disk and you may lose your data.

In _my_ opinion, the process is quite clear. I see that there may be
problems, but, well (and with this I don't mean to offend anybody, because I
made really stupid mistakes with encrypted partitions) if you don't read
what you're doing, it's not an Ubuntu problem; like if you type that
uppercase YES while luksFormat-ting a partition and then complain that it
should have warned you better...

Claudio

[-- Attachment #2: Type: text/html, Size: 2404 bytes --]

Re: [dm-crypt] Bug Report to Ubuntu regarding dangerous installer

[Arno Wagner]

On Fri, Apr 15, 2011 at 09:38:36PM +0200, Claudio Moretti wrote:
> On Fri, Apr 15, 2011 at 18:58, Arno Wagner <arno@wagner.name> wrote:
> 
> > Dear all,
> >
> > I just sent the email below to ubuntu-bugsquad@lists.ubuntu.com.
> > I did not find another way to report a bug without installing
> > Ubuntu (which am an not about to do). If somebody knows a better
> > way or has Ubuntu installed and can file this directly for the
> > installer package, please feel free.
> >
> > I hope this communicates the problem adequately.
> >
> > Arno
> >
> > As far as I know (I'm an Ubuntu user, with a little experience) you can
> choose between automatic and manual partitioning; partitioning options are
> shown here: https://help.ubuntu.com/community/GraphicalInstall and the
> partition step in the installation process is fully described here:
> https://help.ubuntu.com/10.10/installation-guide/i386/module-details.html#di-partition
> 
> If you choose automatic partitioning, you will lose the content of your
> disks, but the system warns you; if you choose manual partitioning and
> delete the dm-crypt partitions to make new ones, I don't see how the
> installer can warn you, aside from telling you you're destroying a partition
> (and if you choose manual partitioning, you should know what can happen,
> otherwise you shouldn't use it).
> 
> In order to use encrypted disks, the installer needs to write the partition
> table: before doing it, it warns you that when writing the partition table
> changes will be written on the disk and you may lose your data.

Huh? Why does it need to write the partition table? LUKS causes
no such requirement...

> In _my_ opinion, the process is quite clear. I see that there may be
> problems, but, well (and with this I don't mean to offend anybody, because I
> made really stupid mistakes with encrypted partitions) if you don't read
> what you're doing, it's not an Ubuntu problem; like if you type that
> uppercase YES while luksFormat-ting a partition and then complain that it
> should have warned you better...

I think this is something else. But I would not know.

Arno
-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier 

Re: [dm-crypt] Bug Report to Ubuntu regarding dangerous installer

[Claudio Moretti]

[-- Attachment #1: Type: text/plain, Size: 3327 bytes --]

>
> > > As far as I know (I'm an Ubuntu user, with a little experience) you can
> > choose between automatic and manual partitioning; partitioning options
> are
> > shown here: https://help.ubuntu.com/community/GraphicalInstall and the
> > partition step in the installation process is fully described here:
> >
> https://help.ubuntu.com/10.10/installation-guide/i386/module-details.html#di-partition
> >
> > If you choose automatic partitioning, you will lose the content of your
> > disks, but the system warns you; if you choose manual partitioning and
> > delete the dm-crypt partitions to make new ones, I don't see how the
> > installer can warn you, aside from telling you you're destroying a
> partition
> > (and if you choose manual partitioning, you should know what can happen,
> > otherwise you shouldn't use it).
> >
> > In order to use encrypted disks, the installer needs to write the
> partition
> > table: before doing it, it warns you that when writing the partition
> table
> > changes will be written on the disk and you may lose your data.
>
> Huh? Why does it need to write the partition table? LUKS causes
> no such requirement...
>

The alternate installer provides you with a "Prepare encrypted disks" option
(something like this, I don't remember the exact name); You create your
partitions and select the "physical volume for encryption" filesystem type ;
then you choose the "Prepare encrypted disk" option and the installer writes
the partition table, asks for which partitions you want to encrypt and makes
you choose passphrases.
Then it shows you new "disks" that are your encrypted partitions; inside of
those "disks" you can create your ext{2,3,4}/FAT/ReiserFS/etc. partitions
(screenshot of what I mean, taken from Google Images:
https://learninginlinux.files.wordpress.com/2008/04/dscf0021mod.jpg)
I think this happens because the right partitions are needed to use the
device mapper and create filesystems in which the system can be installed

>
> > In _my_ opinion, the process is quite clear. I see that there may be
> > problems, but, well (and with this I don't mean to offend anybody,
> because I
> > made really stupid mistakes with encrypted partitions) if you don't read
> > what you're doing, it's not an Ubuntu problem; like if you type that
> > uppercase YES while luksFormat-ting a partition and then complain that it
> > should have warned you better...
>
> I think this is something else. But I would not know.
>
> Then I don't know, either. But I think that when choosing the alternate
installer (which is more advanced than the graphical one) you should know
you're using an "expert" tool..
I'm attaching a few screenshot I found on GI of what the installer does

Main menu:
http://www.linuxlog.org/wp-content/uploads/2011/01/Ubuntu-64-bit-@-2011-01-20-134415.png
Main menu (manual partitioning):
https://help.ubuntu.com/community/Installation/SoftwareRAID?action=AttachFile&do=get&target=ubuntu_raid_06.png
Partition usage list:
http://www.phoronix.net/image.php?id=ubuntu_1010_btrfs&image=ubuntu_1010_btrfs1_med
Partitioning confirmation:
http://members.iinet.net.au/~herman546/p2.2/2_006-confirm-partitions.png
Partition schema with dm-crypt and LVM:
http://static.screencasts.ubuntu.com/videos/20070910_installing_ubuntu_part_2_427x240.png

Hope this may help.

Claudio

[-- Attachment #2: Type: text/html, Size: 4842 bytes --]

Re: [dm-crypt] Bug Report to Ubuntu regarding dangerous installer

[Cristian KLEIN]

> Then I don't know, either. But I think that when choosing the alternate
> installer (which is more advanced than the graphical one) you should know
> you're using an "expert" tool..
> I'm attaching a few screenshot I found on GI of what the installer does

Hello,

Let me elaborate a little bit on what happened. I had a computer with
one ext2 /boot partition and one huge dm-crypt volume, inside which I
had three logical volumes: root, swap and home. My intend was to
install Ubuntu Natty on root, without touching home.

LVM and dm-crypt can only be configured using the alternate Installer,
so I downloaded the daily version of Ubuntu Natty Alternate Installer
and hoped for the best. When I got to the menu asking me to create
partitions / file systems, Ubuntu did not automatically activate the
existing dm-crypt volume. In fact, it didn't even show that the
partition was of type "crypto". IIRC, the partition was just shown to
be unknown. Trying to activate the dm-crypt volume, the only option I
could find was "configure encrypted volumes" [1]. Later I found out
that it only allows to create a new volume, but not activate an
existing one.

I understand that the alternate installer is supposed to be for
experts, but I still think that:
1) Ubuntu failed to detect the existing dm-crypt volume, thus
confusing the user.
2) The installer did not provide an easy-to-find command for
activating the dm-crypt volume.
3) Airbags have been turned off, without the user's knowledge.

Please comment and tell me if I am wrong.

Cheers,
Cristi.

[1] https://help.ubuntu.com/community/Installation/SoftwareRAID?action=AttachFile&do=get&target=ubuntu_raid_06.png

Re: [dm-crypt] Bug Report to Ubuntu regarding dangerous installer

[PsiStormYamato]

I've never fooled with encrypted LVMs; I always encrypt separate
partitions. I had a feeling that going the LVM route could lead to
problems, and it looks like you've found one.

I brief search turned up this post from 2009, so it's apparently a known
issue. A workaround is presented, but it's probably not something that
most folks would think to try.
http://ubuntuforums.org/archive/index.php/t-1009031.html


On Sat, 2011-04-16 at 18:18 +0200, Cristian KLEIN wrote:

> Hello,
> 
> Let me elaborate a little bit on what happened. I had a computer with
> one ext2 /boot partition and one huge dm-crypt volume, inside which I
> had three logical volumes: root, swap and home. My intend was to
> install Ubuntu Natty on root, without touching home.
> 
> LVM and dm-crypt can only be configured using the alternate Installer,
> so I downloaded the daily version of Ubuntu Natty Alternate Installer
> and hoped for the best. When I got to the menu asking me to create
> partitions / file systems, Ubuntu did not automatically activate the
> existing dm-crypt volume. In fact, it didn't even show that the
> partition was of type "crypto". IIRC, the partition was just shown to
> be unknown. Trying to activate the dm-crypt volume, the only option I
> could find was "configure encrypted volumes" [1]. Later I found out
> that it only allows to create a new volume, but not activate an
> existing one.
> 
> I understand that the alternate installer is supposed to be for
> experts, but I still think that:
> 1) Ubuntu failed to detect the existing dm-crypt volume, thus
> confusing the user.
> 2) The installer did not provide an easy-to-find command for
> activating the dm-crypt volume.
> 3) Airbags have been turned off, without the user's knowledge.
> 
> Please comment and tell me if I am wrong.
> 
> Cheers,
> Cristi.
> 
> [1] https://help.ubuntu.com/community/Installation/SoftwareRAID?action=AttachFile&do=get&target=ubuntu_raid_06.png
> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt

Re: [dm-crypt] Bug Report to Ubuntu regarding dangerous installer

[M Thomas Frederiksen]

[-- Attachment #1: Type: text/plain, Size: 1014 bytes --]

On Sat, Apr 16, 2011 at 12:18, Cristian KLEIN <cristiklein@gmail.com> wrote:

> ...
>
> I understand that the alternate installer is supposed to be for
> experts, but I still think that:
> 1) Ubuntu failed to detect the existing dm-crypt volume, thus
> confusing the user.
> 2) The installer did not provide an easy-to-find command for
> activating the dm-crypt volume.
> 3) Airbags have been turned off, without the user's knowledge.
>
> Please comment and tell me if I am wrong.
>

I've had the same problem with Ubuntu.  It gives you the impression that
you're activating the partition, and then scribbles all over your data.  Any
other type of partition you can activate w/out damage, or reformat.  It's a
horrible installer.  One thing that LUKS might do, is remove this
--batch-mode option (if a header is found).  That way if a LUKS header is
already there, it will not overwrite the header.  If the user really wants
to scribble on the data, make them pop open a console and type YES.

-- 
Cheers,
~Thomas

[-- Attachment #2: Type: text/html, Size: 1359 bytes --]

Re: [dm-crypt] Bug Report to Ubuntu regarding dangerous installer

[Arno Wagner]

On Sat, Apr 16, 2011 at 08:20:02PM -0400, M Thomas Frederiksen wrote:
> On Sat, Apr 16, 2011 at 12:18, Cristian KLEIN <cristiklein@gmail.com> wrote:
> 
> > ...
> >
> > I understand that the alternate installer is supposed to be for
> > experts, but I still think that:
> > 1) Ubuntu failed to detect the existing dm-crypt volume, thus
> > confusing the user.
> > 2) The installer did not provide an easy-to-find command for
> > activating the dm-crypt volume.
> > 3) Airbags have been turned off, without the user's knowledge.
> >
> > Please comment and tell me if I am wrong.


I agree with you. While there are a number of things you could
have done to prevent this problem, the root cause of the 
problem is that the installer made it far too easy to kill your 
LUKS volume.

Still, backup is non-optional with LUKS as well. Remember that
disks have about a 5%/year failure rate (if treated well) and
that about half die without warning.
 
> I've had the same problem with Ubuntu.  It gives you the impression that
> you're activating the partition, and then scribbles all over your data.  Any
> other type of partition you can activate w/out damage, or reformat.  It's a
> horrible installer.  One thing that LUKS might do, is remove this
> --batch-mode option (if a header is found).  That way if a LUKS header is
> already there, it will not overwrite the header.  If the user really wants
> to scribble on the data, make them pop open a console and type YES.

The --batch-mode option is there for a reason. It assumes that
the wrapper process knows what it is doing. It is also necessary
in some circuymstances, so removing it is not the right approach.

What I don't like is that the Ubuntu installer turns off the checks
and then does not supply an adequate replacement for the situation
it is run in. We will see whether anything will come from my complaint.

Arno 
-- 
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email: arno@wagner.name 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25 338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier 

Re: [dm-crypt] Bug Report to Ubuntu regarding dangerous installer

[PsiStormYamato]

Is this an old issue, or one that only exists in recent versions of
Ubuntu?

I've never had any problems, but I always use Ubuntu's Alternate
install, which I'm guessing would have more textual warnings and whatnot
since it is a text-based installer after all.



On Fri, 2011-04-15 at 18:58 +0200, Arno Wagner wrote

> The dm-crypt mailing list (archive here:
> http://dir.gmane.org/gmane.linux.kernel.device-mapper.dm-crypt)
> has had several reports that the Ubuntu installer creates 
> new LUKS partitions (encrypted partitions) on top of exisiting 
> ones without giving adequate warning and at the same time
> giving the impression that the existing LUKS partition would be 
> activated. The rather clear warning and verification question 
> asked by the cryptsetup tool seems to get disabled with the 
> "--batch-mode" option.