reinstallation

dm-crypt Rainer Maier 6 participants 15 messages Aug 11, 2009 – Aug 12, 2009 2 messages not in the archive

Share & tools

Rainer Maier

author

2009-08-11 13:45 UTC #0 lore raw

Hi all,
I had LUKS installed on my old raid5 system (via 3ware - 9500S-LP4). Then the PC broke and I installed my Debian on a new one. The raid controller also moved and works again.
The raid system still contains the LUKS encrypted partition. How can I reinstall LUKS on my new Debian (Lenny)?

Any hints or tutorials ?

I scanned the internet, but I didn't find a tutorial I would trust. I am also afraid to damage the data.
The unencrypted Data on the 2nd. raid partition is very valuable to me.

Thanks.
Rainer

Hannes Erven

2009-08-11 14:02 UTC #1 lore raw

Hi Rainer,

Quoted 1 line

How can I reinstall LUKS on my new Debian (Lenny)?

I guess the debian (and thus cryptsetup) installations on your old machine weren't that up to date, right?

With the new debian lenny, you don't need to install anything: LUKS is already included in the default cryptsetup package you should already have installed (http://packages.debian.org/lenny/cryptsetup ).

From http://code.google.com/p/cryptsetup/:
"The former version of cryptsetup only had low-level operations for dm-crypt ready, and around version cryptsetup-luks 1.0.5 was renamed to be the official version of cryptsetup. "

You still might have to change your old scripts, if you have some, to just call cryptsetup instead of cryptsetup-luks .

HTH, best regards

-hannes

[email protected]

author

2009-08-11 21:25 UTC #2 lore raw

Hi Hannes,
in the documents I keep. I found that I had encrypted /dev/sda2. The procedure I recorded was:
umount /dev/sda2
cryptsetup luksFormat /dev/sda2
cryptsetup luksOpen /dev/sda2 tresor
mkfs.ext3 /dev/mapper/tresor
mount /dev/mapper/tresor /tresor

What will happen if I repeat the steps ? Should I just leave the mkfs.ext3 out ?
Would I be able to access my old data again ? What does lufsFormat really do ? Format the partition ? As I staded the data is pretty valuable to me.

thanks for your help.
Best regards
Rainer

-------- Original-Nachricht --------

Quoted 37 lines

Datum: Tue, 11 Aug 2009 16:01:56 +0200
Von: Hannes Erven <[email protected]>
An: Rainer Maier <[email protected]>
CC: [email protected]
Betreff: Re: [dm-crypt] reinstallation
Hi Rainer,
Quoted 1 line
How can I reinstall LUKS on my new Debian (Lenny)?
I guess the debian (and thus cryptsetup) installations on your old machine weren't that up to date, right?
With the new debian lenny, you don't need to install anything: LUKS is already included in the default cryptsetup package you should already have installed (http://packages.debian.org/lenny/cryptsetup ).
Quoted 1 line
Quoted 1 line
From http://code.google.com/p/cryptsetup/:
"The former version of cryptsetup only had low-level operations for dm-crypt ready, and around version cryptsetup-luks 1.0.5 was renamed to be the official version of cryptsetup. "
You still might have to change your old scripts, if you have some, to just call cryptsetup instead of cryptsetup-luks .
HTH, best regards
-hannes
_______________________________________________
dm-crypt mailing list
[email protected]
http://www.saout.de/mailman/listinfo/dm-crypt

Signature · 2 lines

Jetzt kostenlos herunterladen: Internet Explorer 8 und Mozilla Firefox 3 -
sicherer, schneller und einfacher! http://portal.gmx.net/de/go/atbrowser

Moji

2009-08-11 22:06 UTC #3 lore raw

I do not entirely understand your question, so I apologize if my answer is not what you are looking for.

If you repeated those steps then any information on /dev/sda2 will be lost forever.

"luksFormat" writes the luks header information, that includes the key that decrypts the rest of the partition(device). If there is an old key it will write over it making any old data on that luks partition effectively unrecoverable.

"luksOpen" uses your supplied key to decrypt the device key stored in the header information and then maps it to /dev/mapper/.

If I understand your original post, the "/dev/sda2" is currently unencrypted data? If that is the case then you MUST copy that data over to another device while you set up then encrypted partition, then transfer it back, as the steps you listed will erase your old partition.

-MJ

Quoted 57 lines · [email protected] wrote:

Hi Hannes,
in the documents I keep. I found that I had encrypted /dev/sda2. The procedure I recorded was:
umount /dev/sda2
cryptsetup luksFormat /dev/sda2
cryptsetup luksOpen /dev/sda2 tresor
mkfs.ext3 /dev/mapper/tresor
mount /dev/mapper/tresor /tresor
What will happen if I repeat the steps ? Should I just leave the mkfs.ext3 out ?
Would I be able to access my old data again ? What does lufsFormat really do ? Format the partition ? As I staded the data is pretty valuable to me.
thanks for your help.
Best regards
Rainer
-------- Original-Nachricht --------
Quoted 36 lines
Datum: Tue, 11 Aug 2009 16:01:56 +0200
Von: Hannes Erven <[email protected]>
An: Rainer Maier <[email protected]>
CC: [email protected]
Betreff: Re: [dm-crypt] reinstallation
Hi Rainer,
Quoted 1 line
How can I reinstall LUKS on my new Debian (Lenny)?
I guess the debian (and thus cryptsetup) installations on your old machine weren't that up to date, right?
With the new debian lenny, you don't need to install anything: LUKS is already included in the default cryptsetup package you should already have installed (http://packages.debian.org/lenny/cryptsetup ).
Quoted 1 line
Quoted 1 line
From http://code.google.com/p/cryptsetup/:
"The former version of cryptsetup only had low-level operations for dm-crypt ready, and around version cryptsetup-luks 1.0.5 was renamed to be the official version of cryptsetup. "
You still might have to change your old scripts, if you have some, to just call cryptsetup instead of cryptsetup-luks .
HTH, best regards
-hannes
_______________________________________________
dm-crypt mailing list
[email protected]
http://www.saout.de/mailman/listinfo/dm-crypt

[email protected]

author

2009-08-11 22:25 UTC #10 lore raw

In reply to a message not in the archive

When I just enter
cryptsetup luksOpen /dev/sda2 tresor
I get the reply:
Command failed: No setup backend available

I guess it somehow has a relation to the mapper.
Any idea ?

Best regards
Rainer

-------- Original-Nachricht --------

Quoted 105 lines

Datum: Tue, 11 Aug 2009 23:42:29 +0200
Von: Arno Wagner <[email protected]>
An: [email protected]
Betreff: Re: [dm-crypt] reinstallation
I suspect luksFormat wipes the LUKS superblock and creates a new one, i.e. all data is permanently lost. mkfs.ext3 will overwrote the filesystem metadata, i.e. the filesystem structure is lost.
However
Quoted 2 lines
cryptsetup luksOpen /dev/sda2 tresor
mount /dev/mapper/tresor /tresor
should work, with sda2 replaced with whatever the LUKS container now is in. Basically you just do what you did before to access (not create) the device, just with a (potentially) different device identifier.
As to preventing partition loss, make a sector-wise backup copy, e.g. with dd or dd_rescue before risking it.
Arno
Quoted 2 lines · On Tue, Aug 11, 2009 at 11:25:16PM +0200, [email protected] wrote:
Hi Hannes,
in the documents I keep. I found that I had encrypted /dev/sda2. The
procedure I recorded was:
Quoted 12 lines
umount /dev/sda2
cryptsetup luksFormat /dev/sda2
cryptsetup luksOpen /dev/sda2 tresor
mkfs.ext3 /dev/mapper/tresor
mount /dev/mapper/tresor /tresor
What will happen if I repeat the steps ? Should I just leave the mkfs.ext3 out ?
Would I be able to access my old data again ? What does lufsFormat really do ? Format the partition ? As I staded the data is pretty valuable to me.
Quoted 27 lines
thanks for your help.
Best regards
Rainer
-------- Original-Nachricht --------
Quoted 21 lines
Datum: Tue, 11 Aug 2009 16:01:56 +0200
Von: Hannes Erven <[email protected]>
An: Rainer Maier <[email protected]>
CC: [email protected]
Betreff: Re: [dm-crypt] reinstallation
Hi Rainer,
Quoted 1 line
How can I reinstall LUKS on my new Debian (Lenny)?
I guess the debian (and thus cryptsetup) installations on your old machine weren't that up to date, right?
With the new debian lenny, you don't need to install anything: LUKS is already included in the default cryptsetup package you should already have installed (http://packages.debian.org/lenny/cryptsetup ).
Quoted 1 line
Quoted 1 line
From http://code.google.com/p/cryptsetup/:
"The former version of cryptsetup only had low-level operations for dm-crypt ready, and around version cryptsetup-luks 1.0.5 was renamed
to
Quoted 8 lines
Quoted 8 lines
be the official version of cryptsetup. "
You still might have to change your old scripts, if you have some, to just call cryptsetup instead of cryptsetup-luks .
HTH, best regards
Quoted 11 lines
Quoted 8 lines
-hannes
_______________________________________________
dm-crypt mailing list
[email protected]
http://www.saout.de/mailman/listinfo/dm-crypt
Signature · 1 line
Jetzt kostenlos herunterladen: Internet Explorer 8 und Mozilla Firefox 3
-
Quoted 6 lines
sicherer, schneller und einfacher! http://portal.gmx.net/de/go/atbrowser
_______________________________________________
dm-crypt mailing list
[email protected]
http://www.saout.de/mailman/listinfo/dm-crypt
Signature · 9 lines
Arno Wagner, Dr. sc. techn., Dipl. Inform., CISSP -- Email:
[email protected] 
GnuPG:  ID: 1E25338F  FP: 0C30 5782 9D93 F785 E79C  0296 797F 6B50 1E25
338F
----
Cuddly UI's are the manifestation of wishful thinking. -- Dylan Evans

If it's in the news, don't worry about it.  The very definition of 
"news" is "something that hardly ever happens." -- Bruce Schneier 

Signature · 2 lines

Neu: GMX Doppel-FLAT mit Internet-Flatrate + Telefon-Flatrate
für nur 19,99 Euro/mtl.!* http://portal.gmx.net/de/go/dsl02

[email protected]

author

2009-08-11 22:40 UTC #4 lore raw

In reply to Moji

Sorry for the unclear statements.
Here are the answers:
I did not repeat the steps.
/dev/sda2 holds the encrypted data.

Here my description what has happened. Hopefully it becomes clearer now.

What I wrote were the initial steps I perforemed when I first set up the partition (/dev/sda2).
Again I did not repeat them now.
After my old PC had died I installed the RAID controller in a new PC and installed Debian. (/dev/hda) cryptsetup is now already included. (Thanks for the hint Arno) Since it's a hardware controller the files on the not encrypted partition (/dev/sda1) were immediately available.
Now I am looking for the steps I have to perform to access the data in the encrypted partition (/dev/sda2) again, without destroying them.

When I now enter
cryptsetup luksOpen /dev/sda2 tresor
I get
Command failed: No steup backend available

Best regards
Rainer

-------- Original-Nachricht --------

Quoted 89 lines

Datum: Wed, 12 Aug 2009 01:06:31 +0300
Von: Moji <[email protected]>
An: [email protected]
Betreff: Re: [dm-crypt] reinstallation
I do not entirely understand your question, so I apologize if my answer is not what you are looking for.
If you repeated those steps then any information on /dev/sda2 will be lost forever.
"luksFormat" writes the luks header information, that includes the key that decrypts the rest of the partition(device). If there is an old key it will write over it making any old data on that luks partition effectively unrecoverable.
"luksOpen" uses your supplied key to decrypt the device key stored in the header information and then maps it to /dev/mapper/.
If I understand your original post, the "/dev/sda2" is currently unencrypted data? If that is the case then you MUST copy that data over to another device while you set up then encrypted partition, then transfer it back, as the steps you listed will erase your old partition.
-MJ
Quoted 2 lines · [email protected] wrote:
Hi Hannes,
in the documents I keep. I found that I had encrypted /dev/sda2. The
procedure I recorded was:
Quoted 12 lines
umount /dev/sda2
cryptsetup luksFormat /dev/sda2
cryptsetup luksOpen /dev/sda2 tresor
mkfs.ext3 /dev/mapper/tresor
mount /dev/mapper/tresor /tresor
What will happen if I repeat the steps ? Should I just leave the mkfs.ext3 out ?
Would I be able to access my old data again ? What does lufsFormat really do ? Format the partition ? As I staded the data is pretty valuable to me.
Quoted 43 lines
thanks for your help.
Best regards
Rainer
-------- Original-Nachricht --------
Quoted 36 lines
Datum: Tue, 11 Aug 2009 16:01:56 +0200
Von: Hannes Erven <[email protected]>
An: Rainer Maier <[email protected]>
CC: [email protected]
Betreff: Re: [dm-crypt] reinstallation
Hi Rainer,
Quoted 1 line
How can I reinstall LUKS on my new Debian (Lenny)?
I guess the debian (and thus cryptsetup) installations on your old machine weren't that up to date, right?
With the new debian lenny, you don't need to install anything: LUKS is already included in the default cryptsetup package you should already have installed (http://packages.debian.org/lenny/cryptsetup ).
Quoted 1 line
Quoted 1 line
From http://code.google.com/p/cryptsetup/:
"The former version of cryptsetup only had low-level operations for dm-crypt ready, and around version cryptsetup-luks 1.0.5 was renamed to be the official version of cryptsetup. "
You still might have to change your old scripts, if you have some, to just call cryptsetup instead of cryptsetup-luks .
HTH, best regards
-hannes
_______________________________________________
dm-crypt mailing list
[email protected]
http://www.saout.de/mailman/listinfo/dm-crypt
_______________________________________________
dm-crypt mailing list
[email protected]
http://www.saout.de/mailman/listinfo/dm-crypt

Signature · 2 lines

Jetzt kostenlos herunterladen: Internet Explorer 8 und Mozilla Firefox 3 -
sicherer, schneller und einfacher! http://portal.gmx.net/de/go/chbrowser

[email protected]

author

2009-08-11 22:54 UTC #12 lore raw

In reply to a message not in the archive

I tried:

modprobe dm_mod
ioctl: 4.11.0-ioctl (2006-10-12) initialized: [email protected] modprobe crypto_blkcipher
FATAL: Module crypto_blkcipher not found
modprobe cbc
modprobe dm_crypt
modprobe aes_generic
FATAL: Module aes_generic not found
modprobe aes_i586
cryptsetup luksOpen /dev/sda2 tresor
Command failed: No setup backend available

Best regards
Rainer

-------- Original-Nachricht --------

Quoted 164 lines

Datum: Tue, 11 Aug 2009 18:39:19 -0400
Von: Sam <[email protected]>
An: [email protected]
CC: [email protected]
Betreff: Re: [dm-crypt] reinstallation
Your problem is then with your Linux installation.
I would be guessing that your device mapper is not setup properly, or best case is simply not loaded by default for some reason.
Try this as root:
modprobe dm_mod
That will load the device mapper module (driver) and should be enough.
Then try your luksOpen command again.
If you get the same errror, then try also all of these in addition to the dm_mod:
modprobe crypto_blkcipher
modprobe cbc
modprobe dm_crypt
modprobe aes_generic
modprobe aes_i586
Some of these might fail with an error, but that could be just that they are
already built into your kernel (and thus are permanently loaded -- that is okay).
Now try the luksOpen again. If it still doesn't work, then I do not know. However, it really should have worked by now at least.
If it did work: note that you will need to add these commands to your /etc/init.d/boot.local file (just add them to the end just like you typed them
in the terminal). This will cause them to be loaded upon startup each time.
Hope that helps.
Sam
Quoted 5 lines
When I just enter
cryptsetup luksOpen /dev/sda2 tresor
I get the reply:
Command failed: No setup backend available
Quoted 72 lines
I guess it somehow has a relation to the mapper.
Any idea ?
Best regards
Rainer
-------- Original-Nachricht --------
Quoted 63 lines
Datum: Tue, 11 Aug 2009 23:42:29 +0200
Von: Arno Wagner <[email protected]>
An: [email protected]
Betreff: Re: [dm-crypt] reinstallation
I suspect luksFormat wipes the LUKS superblock and creates a new one, i.e. all data is permanently lost. mkfs.ext3 will overwrote the filesystem metadata, i.e. the filesystem structure is lost.
However
Quoted 2 lines
cryptsetup luksOpen /dev/sda2 tresor
mount /dev/mapper/tresor /tresor
should work, with sda2 replaced with whatever the LUKS container now is in. Basically you just do what you did before to access (not create) the device, just with a (potentially) different device identifier.
As to preventing partition loss, make a sector-wise backup copy, e.g. with dd or dd_rescue before risking it.
Arno
Quoted 2 lines · On Tue, Aug 11, 2009 at 11:25:16PM +0200, [email protected] wrote:
Hi Hannes,
in the documents I keep. I found that I had encrypted /dev/sda2. The
procedure I recorded was:
Quoted 33 lines
umount /dev/sda2
cryptsetup luksFormat /dev/sda2
cryptsetup luksOpen /dev/sda2 tresor
mkfs.ext3 /dev/mapper/tresor
mount /dev/mapper/tresor /tresor
What will happen if I repeat the steps ? Should I just leave the mkfs.ext3 out ?
Would I be able to access my old data again ? What does lufsFormat really do ? Format the partition ? As I staded the data is pretty valuable to me.
thanks for your help.
Best regards
Rainer
-------- Original-Nachricht --------
Quoted 14 lines
Datum: Tue, 11 Aug 2009 16:01:56 +0200
Von: Hannes Erven <[email protected]>
An: Rainer Maier <[email protected]>
CC: [email protected]
Betreff: Re: [dm-crypt] reinstallation
Hi Rainer,
Quoted 1 line
How can I reinstall LUKS on my new Debian (Lenny)?
I guess the debian (and thus cryptsetup) installations on your old machine weren't that up to date, right?
With the new debian lenny, you don't need to install anything:
LUKS
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
is already included in the default cryptsetup package you should already have installed
(http://packages.debian.org/lenny/cryptsetup
Quoted 5 lines
Quoted 5 lines
Quoted 5 lines
Quoted 5 lines
).
Quoted 1 line
Quoted 1 line
From http://code.google.com/p/cryptsetup/:
"The former version of cryptsetup only had low-level operations
for
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
dm-crypt ready, and around version cryptsetup-luks 1.0.5 was
renamed
Quoted 6 lines
Quoted 6 lines
to
Quoted 3 lines
Quoted 3 lines
be the official version of cryptsetup. "
You still might have to change your old scripts, if you have some,
to
Quoted 22 lines
Quoted 22 lines
Quoted 5 lines
Quoted 5 lines
just call cryptsetup instead of cryptsetup-luks .
HTH, best regards
Quoted 8 lines
Quoted 8 lines
-hannes
_______________________________________________
dm-crypt mailing list
[email protected]
http://www.saout.de/mailman/listinfo/dm-crypt
-
Quoted 6 lines
sicherer, schneller und einfacher!
http://portal.gmx.net/de/go/atbrowser
_______________________________________________
dm-crypt mailing list
[email protected]
http://www.saout.de/mailman/listinfo/dm-crypt

Signature · 2 lines

Neu: GMX Doppel-FLAT mit Internet-Flatrate + Telefon-Flatrate
für nur 19,99 Euro/mtl.!* http://portal.gmx.net/de/go/dsl02

Sam

2009-08-11 23:02 UTC #13 lore raw

That is unfortunate.
Well, give us a bit more information. Try doing the following:

cryptsetup luksDump /dev/sda2

(this will just output some info on what encryption algorithm your partition uses)

Then paste what it says into an email. Just the first 6 lines would be enough for me (upto and including "Hash spec:").

Ie:

LUKS header information for /dev/sda7

Version:        1
Cipher name:    aes
Cipher mode:    xts-plain
Hash spec:      sha1

Regards,
Sam

Quoted 195 lines

I tried:
modprobe dm_mod
ioctl: 4.11.0-ioctl (2006-10-12) initialized: [email protected] modprobe crypto_blkcipher
FATAL: Module crypto_blkcipher not found
modprobe cbc
modprobe dm_crypt
modprobe aes_generic
FATAL: Module aes_generic not found
modprobe aes_i586
cryptsetup luksOpen /dev/sda2 tresor
Command failed: No setup backend available
Best regards
Rainer
-------- Original-Nachricht --------
Quoted 175 lines
Datum: Tue, 11 Aug 2009 18:39:19 -0400
Von: Sam <[email protected]>
An: [email protected]
CC: [email protected]
Betreff: Re: [dm-crypt] reinstallation
Your problem is then with your Linux installation.
I would be guessing that your device mapper is not setup properly, or best case is simply not loaded by default for some reason.
Try this as root:
modprobe dm_mod
That will load the device mapper module (driver) and should be enough.
Then try your luksOpen command again.
If you get the same errror, then try also all of these in addition to the dm_mod:
modprobe crypto_blkcipher
modprobe cbc
modprobe dm_crypt
modprobe aes_generic
modprobe aes_i586
Some of these might fail with an error, but that could be just that they are
already built into your kernel (and thus are permanently loaded -- that is okay).
Now try the luksOpen again. If it still doesn't work, then I do not know. However, it really should have worked by now at least.
If it did work: note that you will need to add these commands to your /etc/init.d/boot.local file (just add them to the end just like you typed them
in the terminal). This will cause them to be loaded upon startup each time.
Hope that helps.
Sam
Quoted 5 lines
When I just enter
cryptsetup luksOpen /dev/sda2 tresor
I get the reply:
Command failed: No setup backend available
Quoted 73 lines
I guess it somehow has a relation to the mapper.
Any idea ?
Best regards
Rainer
-------- Original-Nachricht --------
Quoted 64 lines
Datum: Tue, 11 Aug 2009 23:42:29 +0200
Von: Arno Wagner <[email protected]>
An: [email protected]
Betreff: Re: [dm-crypt] reinstallation
I suspect luksFormat wipes the LUKS superblock and creates a new one, i.e. all data is permanently lost. mkfs.ext3 will overwrote the filesystem metadata, i.e. the filesystem structure is lost.
However
Quoted 2 lines
cryptsetup luksOpen /dev/sda2 tresor
mount /dev/mapper/tresor /tresor
should work, with sda2 replaced with whatever the LUKS container now is in. Basically you just do what you did before to access (not create) the device, just with a (potentially) different device identifier.
As to preventing partition loss, make a sector-wise backup copy, e.g. with dd or dd_rescue before risking it.
Arno
Quoted 3 lines · On Tue, Aug 11, 2009 at 11:25:16PM +0200, [email protected] wrote:
Hi Hannes,
in the documents I keep. I found that I had encrypted /dev/sda2. The
procedure I recorded was:
Quoted 33 lines
umount /dev/sda2
cryptsetup luksFormat /dev/sda2
cryptsetup luksOpen /dev/sda2 tresor
mkfs.ext3 /dev/mapper/tresor
mount /dev/mapper/tresor /tresor
What will happen if I repeat the steps ? Should I just leave the mkfs.ext3 out ?
Would I be able to access my old data again ? What does lufsFormat really do ? Format the partition ? As I staded the data is pretty valuable to me.
thanks for your help.
Best regards
Rainer
-------- Original-Nachricht --------
Quoted 14 lines
Datum: Tue, 11 Aug 2009 16:01:56 +0200
Von: Hannes Erven <[email protected]>
An: Rainer Maier <[email protected]>
CC: [email protected]
Betreff: Re: [dm-crypt] reinstallation
Hi Rainer,
Quoted 1 line
How can I reinstall LUKS on my new Debian (Lenny)?
I guess the debian (and thus cryptsetup) installations on your old machine weren't that up to date, right?
With the new debian lenny, you don't need to install anything:
LUKS
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
is already included in the default cryptsetup package you should already have installed
(http://packages.debian.org/lenny/cryptsetup
Quoted 5 lines
Quoted 5 lines
Quoted 5 lines
Quoted 5 lines
).
Quoted 1 line
Quoted 1 line
From http://code.google.com/p/cryptsetup/:
"The former version of cryptsetup only had low-level operations
for
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
dm-crypt ready, and around version cryptsetup-luks 1.0.5 was
renamed
Quoted 6 lines
Quoted 6 lines
to
Quoted 4 lines
Quoted 4 lines
be the official version of cryptsetup. "
You still might have to change your old scripts, if you have some,
to
Quoted 22 lines
Quoted 22 lines
Quoted 5 lines
Quoted 5 lines
just call cryptsetup instead of cryptsetup-luks .
HTH, best regards
Quoted 8 lines
Quoted 8 lines
-hannes
_______________________________________________
dm-crypt mailing list
[email protected]
http://www.saout.de/mailman/listinfo/dm-crypt
-
Quoted 6 lines
sicherer, schneller und einfacher!
http://portal.gmx.net/de/go/atbrowser
_______________________________________________
dm-crypt mailing list
[email protected]
http://www.saout.de/mailman/listinfo/dm-crypt

Jonas Meurer

2009-08-11 23:34 UTC #5 lore raw

In reply to [email protected]

Hello Rainer,

Quoted 12 lines · On 12/08/2009 [email protected] wrote:

Here my description what has happened. Hopefully it becomes clearer now.
What I wrote were the initial steps I perforemed when I first set up the partition (/dev/sda2). Again I did not repeat them now. After my old PC had died I installed the RAID controller in a new PC and installed Debian. (/dev/hda) cryptsetup is now already included. (Thanks for the hint Arno)
Since it's a hardware controller the files on the not encrypted partition (/dev/sda1) were immediately available.
Now I am looking for the steps I have to perform to access the data in the encrypted partition (/dev/sda2) again, without destroying them.

Quoted 4 lines

When I now enter
cryptsetup luksOpen /dev/sda2 tresor
I get
Command failed: No steup backend available

please give some more information. i.e. paste the output of the following commands (as root):

# dpkg -l cryptsetup

# cryptsetup --version

# cryptsetup luksDump /dev/sda2

# cat /proc/crypto

none of the commands modifies your partition, they only print information about versions, partition types, crypto ciphers, kernel crypto support, etc.

greetings,
jonas

Jonas Meurer

2009-08-11 23:37 UTC #6 lore raw

Quoted 27 lines · On 12/08/2009 Jonas Meurer wrote:

Hello Rainer,
Quoted 12 lines · On 12/08/2009 [email protected] wrote:
Here my description what has happened. Hopefully it becomes clearer now.
What I wrote were the initial steps I perforemed when I first set up the partition (/dev/sda2). Again I did not repeat them now. After my old PC had died I installed the RAID controller in a new PC and installed Debian. (/dev/hda) cryptsetup is now already included. (Thanks for the hint Arno)
Since it's a hardware controller the files on the not encrypted partition (/dev/sda1) were immediately available.
Now I am looking for the steps I have to perform to access the data in the encrypted partition (/dev/sda2) again, without destroying them.
Quoted 4 lines
When I now enter
cryptsetup luksOpen /dev/sda2 tresor
I get
Command failed: No steup backend available
please give some more information. i.e. paste the output of the following commands (as root):
# dpkg -l cryptsetup
# cryptsetup --version

Quoted 7 lines

# cryptsetup luksDump /dev/sda2
# cat /proc/crypto
none of the commands modifies your partition, they only print information about versions, partition types, crypto ciphers, kernel crypto support, etc.

and one more:

# dmsetup targets

greetings,
jonas

Rainer Maier

author

2009-08-12 06:15 UTC #14 lore raw

In reply to Sam

here's the output:

Version:        1
Cipher name:    aes
Cipher mode:    cbc-essiv:sha256
Hash spec:      sha1
Payload offset: 1032
MK bits:        128

Best regards
Rainer

Quoted 211 lines · Sam

That is unfortunate.
Well, give us a bit more information. Try doing the following:
cryptsetup luksDump /dev/sda2
(this will just output some info on what encryption algorithm your partition uses)
Then paste what it says into an email. Just the first 6 lines would be enough for me (upto and including "Hash spec:").
Ie:
LUKS header information for /dev/sda7
Version:        1
Cipher name:    aes
Cipher mode:    xts-plain
Hash spec:      sha1
Regards,
Sam
Quoted 14 lines
I tried:
modprobe dm_mod
ioctl: 4.11.0-ioctl (2006-10-12) initialized: [email protected] modprobe crypto_blkcipher
FATAL: Module crypto_blkcipher not found
modprobe cbc
modprobe dm_crypt
modprobe aes_generic
FATAL: Module aes_generic not found
modprobe aes_i586
cryptsetup luksOpen /dev/sda2 tresor
Command failed: No setup backend available
Quoted 171 lines
Best regards
Rainer
-------- Original-Nachricht --------
Quoted 165 lines
Datum: Tue, 11 Aug 2009 18:39:19 -0400
Von: Sam <[email protected]>
An: [email protected]
CC: [email protected]
Betreff: Re: [dm-crypt] reinstallation
Your problem is then with your Linux installation.
I would be guessing that your device mapper is not setup properly, or best case is simply not loaded by default for some reason.
Try this as root:
modprobe dm_mod
That will load the device mapper module (driver) and should be enough.
Then try your luksOpen command again.
If you get the same errror, then try also all of these in addition to the dm_mod:
modprobe crypto_blkcipher
modprobe cbc
modprobe dm_crypt
modprobe aes_generic
modprobe aes_i586
Some of these might fail with an error, but that could be just that they are
already built into your kernel (and thus are permanently loaded -- that is okay).
Now try the luksOpen again. If it still doesn't work, then I do not know. However, it really should have worked by now at least.
If it did work: note that you will need to add these commands to your /etc/init.d/boot.local file (just add them to the end just like you typed them
in the terminal). This will cause them to be loaded upon startup each time.
Hope that helps.
Sam
Quoted 5 lines
When I just enter
cryptsetup luksOpen /dev/sda2 tresor
I get the reply:
Command failed: No setup backend available
Quoted 70 lines
I guess it somehow has a relation to the mapper.
Any idea ?
Best regards
Rainer
-------- Original-Nachricht --------
Quoted 61 lines
Datum: Tue, 11 Aug 2009 23:42:29 +0200
Von: Arno Wagner <[email protected]>
An: [email protected]
Betreff: Re: [dm-crypt] reinstallation
I suspect luksFormat wipes the LUKS superblock and creates a new one, i.e. all data is permanently lost. mkfs.ext3 will overwrote the filesystem metadata, i.e. the filesystem structure is lost.
However
Quoted 2 lines
cryptsetup luksOpen /dev/sda2 tresor
mount /dev/mapper/tresor /tresor
should work, with sda2 replaced with whatever the LUKS container now is in. Basically you just do what you did before to access (not create) the device, just with a (potentially) different device identifier.
As to preventing partition loss, make a sector-wise backup copy, e.g. with dd or dd_rescue before risking it.
Arno
Quoted 3 lines · On Tue, Aug 11, 2009 at 11:25:16PM +0200, [email protected] wrote:
Hi Hannes,
in the documents I keep. I found that I had encrypted /dev/sda2. The
procedure I recorded was:
Quoted 32 lines
umount /dev/sda2
cryptsetup luksFormat /dev/sda2
cryptsetup luksOpen /dev/sda2 tresor
mkfs.ext3 /dev/mapper/tresor
mount /dev/mapper/tresor /tresor
What will happen if I repeat the steps ? Should I just leave the mkfs.ext3 out ?
Would I be able to access my old data again ? What does lufsFormat really do ? Format the partition ? As I staded the data is pretty valuable to me.
thanks for your help.
Best regards
Rainer
-------- Original-Nachricht --------
Quoted 13 lines
Datum: Tue, 11 Aug 2009 16:01:56 +0200
Von: Hannes Erven <[email protected]>
An: Rainer Maier <[email protected]>
CC: [email protected]
Betreff: Re: [dm-crypt] reinstallation
Hi Rainer,
Quoted 1 line
How can I reinstall LUKS on my new Debian (Lenny)?
I guess the debian (and thus cryptsetup) installations on your old machine weren't that up to date, right?
With the new debian lenny, you don't need to install anything:
LUKS
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
Quoted 2 lines
is already included in the default cryptsetup package you should already have installed
(http://packages.debian.org/lenny/cryptsetup
Quoted 4 lines
Quoted 4 lines
Quoted 4 lines
Quoted 4 lines
).
Quoted 1 line
Quoted 1 line
From http://code.google.com/p/cryptsetup/:
"The former version of cryptsetup only had low-level operations
for
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
dm-crypt ready, and around version cryptsetup-luks 1.0.5 was
renamed
Quoted 6 lines
Quoted 6 lines
to
Quoted 4 lines
Quoted 4 lines
be the official version of cryptsetup. "
You still might have to change your old scripts, if you have some,
to
Quoted 21 lines
Quoted 21 lines
Quoted 5 lines
Quoted 5 lines
just call cryptsetup instead of cryptsetup-luks .
HTH, best regards
Quoted 8 lines
Quoted 8 lines
-hannes
_______________________________________________
dm-crypt mailing list
[email protected]
http://www.saout.de/mailman/listinfo/dm-crypt
-
Quoted 6 lines
sicherer, schneller und einfacher!
http://portal.gmx.net/de/go/atbrowser
_______________________________________________
dm-crypt mailing list
[email protected]
http://www.saout.de/mailman/listinfo/dm-crypt
_______________________________________________
dm-crypt mailing list
[email protected]
http://www.saout.de/mailman/listinfo/dm-crypt

Rainer Maier

author

2009-08-12 06:24 UTC #7 lore raw

In reply to Jonas Meurer

Hi Jonas,
here is the output:

--------------------------------------------------------------------------------------------------------

sv3000:~# dpkg -l cryptsetup
Gewünscht=Unbekannt/Installieren/R=Entfernen/P=Vollständig Löschen/Halten
| Status=Nicht/Installiert/Config/U=Entpackt/Fehlgeschl. Konfiguration/
         Halb installiert/Trigger erWartet/Trigger anhängig
|/ Fehler?=(kein)/Halten/R=Neuinst notw/X=beide (Status, Fehler: GROSS=schlecht)
||/ Name                        Version                     Beschreibung
+++-===========================-===========================-======================================================================
un  cryptsetup                  <keine>                     (keine Beschreibung vorhanden)
sv3000:~#

--> directly in the kernel.

--------------------------------------------------------------------------------------------------------

sv3000:~# cryptsetup --version
cryptsetup 1.0.6
--------------------------------------------------------------------------------------------------------
sv3000:~# cryptsetup luksDump /dev/sda2
LUKS header information for /dev/sda2

Version:        1
Cipher name:    aes
Cipher mode:    cbc-essiv:sha256
Hash spec:      sha1
Payload offset: 1032
MK bits:        128

MK digest:

MK salt:

MK iterations:  10
UUID:           6c2a5824-5594-4516-885b-4a82a5be9554

Key Slot 0: DISABLED
Key Slot 1: ENABLED
Iterations: 115171
Salt:

Key material offset: 136
AF stripes: 4000
Key Slot 2: DISABLED
Key Slot 3: DISABLED
Key Slot 4: DISABLED
Key Slot 5: DISABLED
Key Slot 6: DISABLED
Key Slot 7: DISABLED
sv3000:~#

--------------------------------------------------------------------------------------------------------

sv3000:~# cat /proc/crypto
name         : aes
driver       : aes-i586
module       : aes_i586
priority     : 200
refcnt       : 1
type         : cipher
blocksize    : 16
min keysize  : 16
max keysize  : 32

name : md5
driver : md5-generic
module : kernel
priority : 0
refcnt : 1
type : digest
blocksize : 64
digestsize : 16

sv3000:~#

--------------------------------------------------------------------------------------------------------

sv3000:~# dmsetup targets
-su: dmsetup: command not found
sv3000:~#

I cut the salt and digest.
Best regards
Rainer

Quoted 44 lines · Jonas Meurer

Hello Rainer,
Quoted 12 lines · On 12/08/2009 [email protected] wrote:
Here my description what has happened. Hopefully it becomes clearer now.
What I wrote were the initial steps I perforemed when I first set up the partition (/dev/sda2). Again I did not repeat them now. After my old PC had died I installed the RAID controller in a new PC and installed Debian. (/dev/hda) cryptsetup is now already included. (Thanks for the hint Arno)
Since it's a hardware controller the files on the not encrypted partition (/dev/sda1) were immediately available.
Now I am looking for the steps I have to perform to access the data in the encrypted partition (/dev/sda2) again, without destroying them.
Quoted 3 lines
When I now enter
cryptsetup luksOpen /dev/sda2 tresor
I get Command failed: No steup backend available
please give some more information. i.e. paste the output of the following commands (as root):
# dpkg -l cryptsetup
# cryptsetup --version
# cryptsetup luksDump /dev/sda2
# cat /proc/crypto
none of the commands modifies your partition, they only print information about versions, partition types, crypto ciphers, kernel crypto support, etc.
greetings,
jonas
------------------------------------------------------------------------
_______________________________________________
dm-crypt mailing list
[email protected]
http://www.saout.de/mailman/listinfo/dm-crypt

Milan Broz

2009-08-12 06:57 UTC #15 lore raw

In reply to [email protected]

Quoted 1 line · [email protected] wrote:

Command failed: No setup backend available

This should never happen, did you compile cryptsetup yourself and with some extra parameters to configure?

(This says there is no backend in your binary and it cannot work at all, actually plugins never worked properly and libdevmapper is only option to use here)

If so, do not add any plugin parameters to configure, or just try to add --enable-libdevmapper only. Or better, use distro compiled version.

Milan

Jonas Meurer

2009-08-12 09:39 UTC #8 lore raw

In reply to Rainer Maier

hey,

Quoted 1 line · On 12/08/2009 Rainer Maier wrote:

here is the output:

let's see ...

Quoted 5 lines

sv3000:~# dpkg -l cryptsetup
un  cryptsetup            <keine>           (keine Beschreibung vorhanden)

sv3000:~# cryptsetup --version
cryptsetup 1.0.6

interesting. so how did you install cryptsetup. did you compile it yourself? why don't you use the cryptsetup version distributed within debian? you can install it with 'apt-get install cryptsetup', this takes care of required libraries and other dependencies as well (see below).

Quoted 9 lines

sv3000:~# cryptsetup luksDump /dev/sda2
LUKS header information for /dev/sda2

Version:        1
Cipher name:    aes
Cipher mode:    cbc-essiv:sha256
Hash spec:      sha1
Payload offset: 1032
MK bits:        128

Quoted 6 lines

MK digest:

MK salt:

MK iterations:  10
UUID:           6c2a5824-5594-4516-885b-4a82a5be9554

ok, so the luks partition itself seems to be fine.

Quoted 11 lines

sv3000:~# cat /proc/crypto
name         : aes
driver       : aes-i586
module       : aes_i586
priority     : 200
refcnt       : 1
type         : cipher
blocksize    : 16
min keysize  : 16
max keysize  : 32

Quoted 8 lines

name : md5
driver : md5-generic
module : kernel
priority : 0
refcnt : 1
type : digest
blocksize : 64
digestsize : 16

that one misses the cbc blockcipher at least. try 'modprobe cbc'. if that doesn't work, check your kernel config. do you run a debian kernel or a selfcompiled one? in the first case cbc should be available. in the second you should know what to do to add cbc support to your kernel.

Quoted 2 lines

sv3000:~# dmsetup targets
-su: dmsetup: command not found

ah, that's interesting. so you seem to not have installed dmsetup. do you have libdevmapper at all? i really suggest to use the debian cryptsetup package and let the debian package system manage dependencies. that way you can be sure that all required programs and libraries are installed allong with cryptsetup.

greetings,
jonas

Rainer Maier

author

2009-08-12 12:27 UTC #16 lore raw

In reply to Milan Broz

Hi Milan,
I think it works.
I kicked my self compiled version and installed the actual maintainer with apt. At least the machine is now asking for the password.

Thank you very much
Best regards
Rainer

Quoted 22 lines · Milan Broz

Quoted 1 line · [email protected] wrote:
Command failed: No setup backend available
This should never happen, did you compile cryptsetup yourself and with some extra parameters to configure?
(This says there is no backend in your binary and it cannot work at all, actually plugins never worked properly and libdevmapper is only option to use here)
If so, do not add any plugin parameters to configure, or just try to add --enable-libdevmapper only. Or better, use distro compiled version.
Milan
_______________________________________________
dm-crypt mailing list
[email protected]
http://www.saout.de/mailman/listinfo/dm-crypt