GithubHelp home page GithubHelp logo

mkinitcpio-gpg-encrypt's People

Contributors

vincent43 avatar xdbob avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar

Forkers

karlyeurl mihok

mkinitcpio-gpg-encrypt's Issues

Combine with SSH encrypt

Hi,

I'm currently using the hook provided here: https://github.com/grazzolini/mkinitcpio-utils
on my desktop PC.
I'm now using your hook on my laptop and I'm quite happy with it.
I looked into it a little but can't quite figure it out.
Would it be possible to combine both hooks for my desktop PC?
The idea then would be:

  1. Check if Yubikey is plugged in and if so provide PIN prompt
  2. If Yubikey is not plugged in fallback to passphrase prompt that is then accessible via SSH

I'm sure this is doable but I haven't quite figured out how. Can you help me?

shelcheck test report

Hi! Thank you for maintaining this great tool. I tested gpg-encrypt-hook with shellcheck (avalaible in Archlinux here) tool and it found following issues:

In gpg-encrypt-hook line 1:
#!/usr/bin/ash
^-- SC2187: Ash scripts will be checked as Dash. Add '# shellcheck shell=dash' to silence.


In gpg-encrypt-hook line 5:
    [ "${quiet}" = "y" ] && CSQUIET=">/dev/null"
       ^-- SC2154: quiet is referenced but not assigned.


In gpg-encrypt-hook line 9:
    if [ -n "$cryptkey" ]; then
             ^-- SC2154: cryptkey is referenced but not assigned (did you mean 'cryptdev'?).


In gpg-encrypt-hook line 10:
        IFS=: read ckdev ckarg1 ckarg2 <<EOF
        ^-- SC2162: read without -r will mangle backslashes.


In gpg-encrypt-hook line 16:
        elif resolved=$(resolve_device "${ckdev}" ${rootdelay}); then
                                                  ^-- SC2154: rootdelay is referenced but not assigned.
                                                  ^-- SC2086: Double quote to prevent globbing and word splitting.


In gpg-encrypt-hook line 36:
        [ ! -f ${ckeyfile} ] && echo "Keyfile could not be opened. Reverting to passphrase."
               ^-- SC2086: Double quote to prevent globbing and word splitting.


In gpg-encrypt-hook line 39:
    if [ -n "${cryptdevice}" ]; then
             ^-- SC2154: cryptdevice is referenced but not assigned.


In gpg-encrypt-hook line 41:
        IFS=: read cryptdev cryptname cryptoptions <<EOF
        ^-- SC2162: read without -r will mangle backslashes.


In gpg-encrypt-hook line 55:
    for cryptopt in ${cryptoptions//,/ }; do
                    ^-- SC2169: In dash, string replacement is not supported.


In gpg-encrypt-hook line 66:
    if resolved=$(resolve_device "${cryptdev}" ${rootdelay}); then
                                               ^-- SC2086: Double quote to prevent globbing and word splitting.


In gpg-encrypt-hook line 67:
        if cryptsetup isLuks ${resolved} >/dev/null 2>&1; then
                             ^-- SC2086: Double quote to prevent globbing and word splitting.


In gpg-encrypt-hook line 76:
                    /usr/bin/pcscd --auto-exit &> /dev/null
                                               ^-- SC2169: In dash, &> is not supported.


In gpg-encrypt-hook line 81:
                    /usr/bin/gpg --homedir "/etc/initcpio/gpg" --card-status &> /dev/null
                                                                             ^-- SC2169: In dash, &> is not supported.


In gpg-encrypt-hook line 90:
                    /bin/killall gpg-agent scdaemon pcscd &> /dev/null
                                                          ^-- SC2169: In dash, &> is not supported.


In gpg-encrypt-hook line 93:
                if eval cryptsetup --key-file ${ckeyfile} open --type luks ${resolved} ${cryptname} ${cryptargs} ${CSQUIET}; then
                                                                           ^-- SC2086: Double quote to prevent globbing and word splitting.
                                                                                                    ^-- SC2086: Double quote to prevent globbing and word splitting.


In gpg-encrypt-hook line 95:
                        shred -u "/decrypted.bin" &> /dev/null
                                                  ^-- SC2169: In dash, &> is not supported.


In gpg-encrypt-hook line 108:
                while ! eval cryptsetup open --type luks ${resolved} ${cryptname} ${cryptargs} ${CSQUIET}; do
                                                         ^-- SC2086: Double quote to prevent globbing and word splitting.
                                                                                  ^-- SC2086: Double quote to prevent globbing and word splitting.


In gpg-encrypt-hook line 120:
        elif [ -n "${crypto}" ]; then
                   ^-- SC2154: crypto is referenced but not assigned (did you mean 'cryptopt'?).


In gpg-encrypt-hook line 129:
            IFS=: read c_hash c_cipher c_keysize c_offset c_skip <<EOF
            ^-- SC2162: read without -r will mangle backslashes.


In gpg-encrypt-hook line 146:
            if [ $? -ne 0 ]; then
                 ^-- SC2181: Check exit code directly with e.g. 'if mycmd;', not indirectly with $?.

I don't have great knowledge about internals so I leave this to your best judgment for now.

Keyfile located in the initramfs not being decrypted

Hi,

I installed your AUR package and I seem to have some issues. I followed all your instructions, but once I try to boot I get the following message:

No key available with this passphrase.
Invalid keyfile. Reverting to passphrase.

Furthermore, I don't get prompted for my pin for my YubiKey Neo. To test this further I added the GPG encrypted keyfile to my LUKS. This immediately worked, but of course should not happen. It seems my GPG encrypted file it immediately given to the decryption process of the LUKS volume.

My keyfile is located in the root directory and is called crypto_keyfile.bin.gpg, I added this to my mkinitcpio.conf

FILES="/crypto_keyfile.bin.gpg"

and this is my GRUB Kernel command line (without UUID):

GRUB_CMDLINE_LINUX="cryptdevice=UUID=XXXXX cryptkey=rootfs:/crypto_keyfile.bin.gpg"

Any idea what might be wrong or how I could debug this further? Thank you for any help you might be able to offer!

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.