Abstract:

This document provides a step-by-step guide for securely unlocking a Root File System (Rootfs) that has been encrypted using Dracut with Systemd and Grub, remotely via an SSH connection using the Dropbear SSH server. It details the installation and configuration of Dropbear, including host key generation and authorized key setup. The core of the solution involves creating custom Dracut modules to start Dropbear early in the boot process and a utility script to prompt for the LUKS passphrase. Additionally, it covers the necessary Grub modifications for network configuration during the early boot stage. The guide concludes with instructions on how to use SSH to connect to the machine and trigger the disk unlock, noting that Dropbear automatically closes the connection upon successful passphrase entry.

Summarizing Rootfs Encryption Unlock over SSH

(Note: As the input is a text document, timestamps are not applicable.)

• Purpose: This guide enables remote unlocking of an encrypted Rootfs via SSH using Dropbear, assuming encryption is configured with Dracut, Systemd, and Grub.
• Installation - Dropbear:
  • Install the net-misc/dropbear package.
  • Generate Dropbear server host keys using dropbear -R.
  • Add your SSH public key(s) to /etc/dropbear/authorized_keys for access.
• Dracut Module Creation:
  • Create the module directory: /usr/lib/dracut/modules.d/50dropbear.
  • dropbear-init.sh: A script to start Dropbear in the early boot environment, running dropbear -E -s -j -k -p 2222 & (port 2222 is configurable).
  • unlock.sh: A script that, when executed, starts all currently activating Systemd units, which includes prompting for the disk passphrase.
  • module-setup.sh: Configures the Dracut module, ensuring dropbear and its host keys, authorized_keys, and the unlock.sh script are included in the initramfs. It also hooks dropbear-init.sh into the initqueue.
• Update Initramfs: After module creation, update the initramfs using dracut --force.
• Grub Configuration:
  • Edit /etc/default/grub to add network parameters to GRUB_CMDLINE_LINUX_DEFAULT. This includes the machine's IP address, gateway, subnet, and network interface name (e.g., ip=xxx.xxx.xxx.xxx::yyy.yyy.yyy.yyy:zzz.zzz.zzz.zzz::eno1:none).
  • Update the Grub configuration: grub-mkconfig -o /boot/grub/grub.cfg.
• Usage:
  • SSH into the machine using the configured port and root user: ssh -p 2222 root@xxx.xxx.xxx.xxx.
  • Once connected, execute the unlock command to trigger the passphrase prompt for the encrypted disk.
  • Key Takeaway: Dropbear will automatically close the SSH connection once the correct passphrase is entered and the disk is unlocked.