Skip to content

Remote LUKS Unlocking with Dropbear SSH

Learn how to remotely unlock LUKS encrypted LVM volumes using Dropbear SSH on Ubuntu Server. This comprehensive guide covers everything from installing requirements to configuring Dropbear SSH

  • Remote unlocking LUKS encrypted LVM using Dropbear SSH in Ubuntu Server 22.04.3 LTS
Install Requirements 
su 
apt update
apt upgrade
apt-get install dropbear-initramfs initramfs-tools busybox
Configure /etc/initramfs-tools/initramfs.conf 
cat << "EOF" >> /etc/initramfs-tools/initramfs.conf
### Cryptsetup / Dropbear / Initramfs
IP=192.168.1.181::192.168.1.1:255.255.255.0:server:enp4s0:off
EOF
Create / Generate Dropber Keys

Note: host keys are already present, as they were automatically generated during the installation of the dropbear package, so there is no need to create new ones as other guides tell you to do

dropbearkey -t dss -f /etc/dropbear/initramfs/dropbear_dss_host_key
dropbearkey -t rsa -f /etc/dropbear/initramfs/dropbear_rsa_host_key
dropbearkey -t ecdsa /etc/dropbear/initramfs/dropbear_ecdsa_host_key
dropbearkey -t ed25519 -f /etc/dropbear/initramfs/dropbear_ed25519_host_key
Script: Create cleanup.sh 
cat << "EOF" >/
#!/bin/sh

echo "Killing dropbear"
pkill -9 dropbear
exit 0
EOF
Main Script: Unlock the LUKS encrypted LVM, create the initramfs hook 
cat << 'END_SCRIPT' > /etc/initramfs-tools/hooks/crypt_unlock.sh
#!/bin/sh

PREREQ="dropbear"
 
prereqs() {
    echo "$PREREQ"
}
 
case "$1" in
    prereqs)
        prereqs
        exit 0
        ;;
esac
 
. "${CONFDIR}/initramfs.conf"
. /usr/share/initramfs-tools/hook-functions
 
if [ "${DROPBEAR}" != "n" ] && [ -r "/etc/crypttab" ] ; then
    cat > "${DESTDIR}/bin/unlock" << 'INNER_EOF'
#!/bin/sh
if PATH=/lib/unlock:/bin:/sbin /scripts/local-top/cryptroot; then
    kill "$(ps | grep cryptroot | grep -v "grep" | awk '{print $1}')"
    # following line kill the remote shell right after the passphrase has
    # been entered.
    kill -9 "$(ps | grep "\-sh" | grep -v "grep" | awk '{print $1}')"
    exit 0
fi
exit 1
INNER_EOF
 
    chmod 755 "${DESTDIR}/bin/unlock"
 
    mkdir -p "${DESTDIR}/lib/unlock"
    cat > "${DESTDIR}/lib/unlock/plymouth" << 'INNER_EOF'
#!/bin/sh
[ "$1" == "--ping" ] && exit 1
/bin/plymouth "$@"
INNER_EOF
 
    chmod 755 "${DESTDIR}/lib/unlock/plymouth"
 
    echo "To unlock root-partition run 'unlock'" >> "${DESTDIR}/etc/motd"
fi
END_SCRIPT
Make cleanup.sh and crypt_unlock.sh executable 
chmod +x /etc/initramfs-tools/scripts/init-bottom/cleanup.sh
chmod +x /etc/initramfs-tools/hooks/crypt_unlock.sh
Add SSH Keys To authorized_keys 
cp ~/.ssh/authorized_keys  /etc/dropbear/initramfs/
Optional: Samsung Laptop - Fix i915 issues during boot with gpu driver 
wget https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/tree/i915/dg2_huc_gsc.bin
chmod +x dg2_huc_gsc.bin
mv dg2_huc_gsc.bin /lib/firmware/i915/
Disable dropbear as soon as possible after our root unlock

Note: This is not necessary if OpenSSH was already installed.

sed -i -e 's/NO_START=0/NO_START=1/' /etc/dropbear/initramfs/dropbear.conf
Client: Configure SSH Client: ~/.ssh/config
Option Description
-I 600 Disconnect the session if no traffic is transmitted or received for 600 seconds
-j Disable local port forwarding
-k Disable remote port forwarding
-p 2222 Listen on port 2222
-s Disable password logins 
sed -i 's/#DROPBEAR_OPTIONS=/DROPBEAR_OPTIONS="-I 600 -j -k -p 2222 -s"/g' /etc/dropbear/initramfs/dropbear.conf
Append ifconfig to 0.0.0.0 to avoid internet/resolve.conf issues 
echo "append ifconfig enp0s4 0.0.0.0 down" >> /usr/share/initramfs-tools/scripts/init-bottom/dropbear
Upgrade Initramfs / Grub configurations and reboot 
update-initramfs -u -k all 2> /dev/null
update-grub
reboot
Client: Connect to server and unlock luks container (rootfs) 
alias s="ssh -p2222 root@server"
unlock-server
Reference(s)