Questions / problems with rootfs encryption

[gogo2464]

The soft is great but the doc very confusing. It first guess that I have to run the script under the link https://github.com/gitbls/sdm/blob/master/Docs/Disk-Encryption.md#standalone-rootfs-encryption-configuration and then I realize that I have to install https://github.com/gitbls/sdm/blob/master/Docs/Disk-Encryption.md#the-sdm-cryptconfig-script so as I did not

Ensures the required disk crypto software is installed: cryptsetup, cryptsetup-initramfs, and cryptsetup-bin

and I have not so I can not run the initramfs: sdmcryptfs not installed. then I have to reinstall my full raspberry.

It would be absolutely amazing if you could just make a tutorial of how to use the script to encrypt the raspberry sdcard. it would be really less confusing instead of speaking of the options.

Best regards.

[gogo2464]

@gitbls maybe should I just reboot?

[gitbls]

I'm sorry that you're having problems with the document. It's quite simple actually. As the document explains:

• https://github.com/gitbls/sdm/blob/master/Docs/Disk-Encryption.md#standalone-rootfs-encryption-configuration: "Download and run sdm-cryptconfig"
• Then, in that same section it directs you to run sdm-cryptconfig: sudo sdm-cryptconfig, which sets everything up AND ensures that sdmcryptfs is copied down and installed into the initramfs

The document IS a tutorial. However, it's possible that it assumes a level of expertise beyond your level.

I suggested on IRC that you read the entire document FIRST, before starting. Reading implies a certain level of comprehension.

Did you actually read and understand the document before starting the process?

If you're still interested in pursuing this method, please start over, and note each and every step that you do, and where you are running into a problem. Provide that information here and I'll be happy to help you sort out where you went astray.

Many other people have had this work very successfully for them. If you slow down, read and understand the steps, you'll quickly and easily join that group of happy people with encrypted rootfs on their systems.

[gogo2464]

I have read yes. to be honest I did not probably spend enough time in understanding.

[gogo2464]

IO did:

# sdm-make-luks-usb-key and sdm-add-luks-key are only needed if you want to use a USB Keyfile Disk
sudo curl --fail --silent --show-error -L https://github.com/gitbls/sdm/raw/master/sdm-make-luks-usb-key -o /usr/local/bin/sdm-make-luks-usb-key
sudo curl --fail --silent --show-error -L https://github.com/gitbls/sdm/raw/master/sdm-add-luks-key -o /usr/local/bin/sdm-add-luks-key
sudo chmod 755 /usr/local/bin/sdm-add-luks-key /usr/local/bin/sdm-make-luks-usb-key

# sdm-cryptconfig is required for rootfs encryption
sudo curl --fail --silent --show-error -L https://github.com/gitbls/sdm/raw/master/sdm-cryptconfig -o /usr/local/bin/sdm-cryptconfig
sudo chmod 755 /usr/local/bin/sdm-cryptconfig
sudo sdm-cryptconfig 

sudo reboot

now I am stuck at initramfs. because initramfs does not see sdmcryptfs

[gogo2464]

I am just confused about this chapter: https://github.com/gitbls/sdm/blob/master/Docs/Disk-Encryption.md#terse-description should I reboot during the initramfs to continue?

[gitbls]

I am just confused about this chapter: https://github.com/gitbls/sdm/blob/master/Docs/Disk-Encryption.md#terse-description should I reboot during the initramfs to continue?

Please describe in detail the steps you've taken this far.

[gogo2464]

@gitbls Yes sure! Thank you very much for the attention and help.

I installed a fresh raspberry pi OS 5.

I ran sdm-cryptconfig :

# sdm-make-luks-usb-key and sdm-add-luks-key are only needed if you want to use a USB Keyfile Disk
sudo curl --fail --silent --show-error -L https://github.com/gitbls/sdm/raw/master/sdm-make-luks-usb-key -o /usr/local/bin/sdm-make-luks-usb-key
sudo curl --fail --silent --show-error -L https://github.com/gitbls/sdm/raw/master/sdm-add-luks-key -o /usr/local/bin/sdm-add-luks-key
sudo chmod 755 /usr/local/bin/sdm-add-luks-key /usr/local/bin/sdm-make-luks-usb-key

# sdm-cryptconfig is required for rootfs encryption
sudo curl --fail --silent --show-error -L https://github.com/gitbls/sdm/raw/master/sdm-cryptconfig -o /usr/local/bin/sdm-cryptconfig
sudo chmod 755 /usr/local/bin/sdm-cryptconfig
sudo sdm-cryptconfig 

and I rebooted with sudo reboot. Then I immediately did sdmcryptfs /dev/mmcblk0 /dev/sda but my initramfs does not sees sdmcryptfs at all.

sdmcryptfs has not been installed then.

[gogo2464]

also I go to iniramfs becasue /dev/mapper/cryptroot dies not exists.

[gogo2464]

I think there might be a missing empty partition in my sdcard. Might it be the cause please?

[gogo2464]

should I add an usb stick or should I reduce the partition size?

[gitbls]

Too many questions at once! I can't answer all of these. You didn't provide impotant information such as what OS and version.

After you run sdm-cryptconfig, the initramfs (/boot/firmware/initramfs_2712 for a Pi5) will contain sdmcryptfs. This can be verified by sudo lsinitramfs /boot/firmware/initramfs_2712 | grep sdmcryptfs.

If it doesn't show up in the output of this command, then something is broken on your system. So...

• Did you apt update and apt upgrade before starting the encryption process? This is a really good idea
• Did you get any errors from sdm-cryptconfig?

Since you've run sdm-cryptconfig but it appears that your initramfs is hosed, you cannot recover this. I suggest:

• Start over with RasPiOS (either with desktop or Lite)
• Bring it fully up to date with apt update / apt upgrade
• Run sdm-cryptconfig
• Before rebooting, check the initramfs contents with the above lsinitramfs command. If it's not there, we'll have to figure out why. Don't reboot the system at this point

You have likely done something wrong, but I can't tell what because the information you've provided is incomplete.

[gogo2464]

I am on raspios buellesyes arm64 (./2024-10-22-raspios-bullseye-arm64.img.xz)

[gitbls]

I am on raspios buellesyes arm64 (./2024-10-22-raspios-bullseye-arm64.img.xz)

Oh. This only works on Bookworm and later. Sorry! You should have mentioned that MUCH earlier.

Why are you using Bullseye anyhow? It's almost 4 years old.

[gogo2464]

ah no sorry!

It is weird lsb_relrease -a shows:

bookworm.

When ran on raspios

[gitbls]

I'm sorry...I can't help you unless you slow down and provide thoughtful complete responses. So far you haven't done that.

Please see my prior note with a suggestion on how to proceed (your actions start with "I suggest").

Be deliberate, take good notes, and if you get to a stuck point (like no sdmcryptfs in initramfs), stop there and provide complete and detailed information.

This definitely works, as you saw from the completely unsolicited input from tesseract on IRC. If you do it correctly, it will work.

But please understand, a) this is not as simple as installing an app with apt, and b) It's not reversible. Once encrypted, your OS install will remain encrypted.