1

UBUNTU 20.04LTS LUKS PASSPHRASE FAIL

UBUNTU 20.04 LTS (FULL DISC ENCRYPTION) INITIAL SITUATION:

Upon rebooting my 20.04 LTS the LUKS passphrase was not accepted, with these messages.

  • reboot ….
  • please unlock disc sda3_crypt
  • 3x cryptsetup failed, bad password or options ?
  • volume group “vgubuntu” not found
  • cannot proceed volume group vgubuntu
  • done.
  • …
  • missing modules (cat proc modules: ls /dev)
  • ALERT! /dev/mapper/vgunbuntu-root does not exist
  • Dropping to shell
  • BusyBox V1.30.1 (Ubuntu 1:1.30.1-4 ubuntu6.4) builtin shell (ash)
  • (initramfs)_

"I only ever added one LUKS password and have never modified any LUKS settings. Unfortunately I didn’t complete the planned backup in prep of Ubuntu 22.04 LTS upgrade. I’m reading the following, but I’m still not confident about the GRUB, BUSYBOX, LUKS and INITRAMFS commands." https://help.ubuntu.com/community/ManualFullSystemEncryption/Troubleshooing sda3_crypt: cryptsetup failed after 20.04 to 22.04 upgrade https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1979159

UBUNTU 22.04 USB LIVE SYSTEM COMMAND RESULTS ON UBUNTU 20.04 LUKS FULL ENCRYPTED DRIVE:

-lsblk -> sda has

  • sda1 8:1 0 512M 0 part - sda2 8:2 0 732M 0 part - sda3 8:3 0 231.7G 0 part
  • gparted → ‘/dev/sda1 ! EFI SYSTEM PARTITION fat32 512.00MB boot,esp
  •       ‘/dev/sda2                         ext4  732.00MB 209.70MB 522/30MB

  •       ‘/dev/sda3                   [Encrypted]  231.67GiB 231.67GiB 0.00B
  • disks → Samsung SSD 850 EVO 250GB, disk is OK, GUID Partition Table
  •   ‘/dev/sda1 EFI system 537MB

  •    ‘/dev/sda2  Ext4 ver 1.0 -not mounted, Linux Filesystem

  •    ‘/dev/sda3  LUKS Encryption ver 2 – Locked, Linux Filesystem
  • fdisk -l shows same info as disks program
  • cryptsetup -v open --type=luks2 /dev/sda3 ghs, No usable token is available.
  • cryptsetup luksDump /dev/sda3

LUKS header information

  • Version: 2
  • Epoch: 3
  • Metadata area: 16384 [bytes]
  • Keyslots area: 16744448 [bytes]
  • UUID: 51459cec-1774-491a-a8b2-0c4c88351cc1
  • Label: (no label)
  • Subsystem: (no subsystem)
  • Flags: (no flags)
  • Data segments:
  • 0: crypt

  •   offset: 16777216 [bytes]

  •   length: (whole device)

  •   cipher: aes-xts-plain64

  •   sector: 512 [bytes]
  • Keyslots:
  • 0: luks2

  •   Key:        512 bits

  •   Priority:   normal

  •   Cipher:     aes-xts-plain64

  •   Cipher key: 512 bits

  •   PBKDF:      argon2i

  •   Time cost:  6

  •   Memory:     1048576

  •   Threads:    4

  •   Salt:       5a 7c 75 fb 9f 9d f0 c0 2d 77 d2 cc d5 20 3f cc 

  •               88 35 0b f9 63 5c a9 8a 39 44 08 4b e1 aa e3 d2 

  •   AF stripes: 4000

  •   AF hash:    sha256

  •   Area offset:32768 [bytes]

  •   Area length:258048 [bytes]

  •   Digest ID:  0
  • Tokens:
  • Digests:
  • 0: pbkdf2

  •   Hash:       sha256

  •   Iterations: 131863

  •   Salt:       28 00 57 e8 a6 5c d9 ba 29 5a 65 17 5b 0b 6e 59 

  •               2a 60 fe 07 21 c5 41 79 34 a2 79 ae 84 d9 1e 27 

  •   Digest:     f9 14 4d 3c 31 80 44 29 f3 bb e1 74 90 84 7f 9d 

  •               72 44 fe 8d 38 1f 03 b8 a3 e2 e9 b8 15 40 a3 a8 "

QUESTIONS:

  • What are the methods and commands to mount an encrypted disc on an Ubuntu 22.04 USB Live USB system ?

  • Is there any luksDump information that might indicate a hardware or software problem ?

  • Is it possible that the LUKS password was changed or LUKS system files modified before I rebooted ? (I understand this would require sudo priviledges)

  • Is there any discernable changes on modified LUKS system files that are checkable for changes before I reboot ?

  • How can you tell if the LUKS passphrases have changed ?

                            ----====----
Gerry
  • 11

0 Answers0