[SOLVED] How to mount encrypted, LVM volumes?

[jerome1232]

EDITED to reflect wanchai's comments and additions

Dealing with encryption and LVM from a live cd.

This is more for future refrence, I know I will have to deal with these disks from a live cd sometime. I currently have an encrypted file system that uses lvm. I have no idea how to work with these partitions! Right now I'm booted into a live cd, the file system was encrypted via luks (alternate install cd) I'm using twofish encryption.

Okay this was easier than I thought it was going to be, man pages are great.

/dev/sda1 is my /boot
/dev/sda2 is my crypto partition

sudo apt-get install cryptsetup            # Installs the tools we need to deal with encrypted partitions
sudo modprobe dm-crypt                      # Inserts a module we need
sudo cryptsetup luksOpen /dev/sda2 cheer   # Unlocks the partition sda2 and names it cheer
Enter LUKS passphrase: 
key slot 0 unlocked.
Command successful.
#
# Now that we have unlocked the encryption, it's just dealing with the lvm
#
#
sudo apt-get install lvm2  # installs the tools we need
sudo modprobe dm-mod       # inserts a module we need
sudo vgscan                # Scans for all volume groups
  Reading all physical volumes.  This may take a while...
  Found volume group "Ubuntu" using metadata type lvm2
sudo vgchange -a y Ubuntu  # this made the VG Ubuntu active, if you don't give it a volume group as an argument it'll make them all active        
sudo lvscan                # This command lists the logical volumes and their /dev path
  ACTIVE            '/dev/Ubuntu/Root' [15.00 GB] inherit
  ACTIVE            '/dev/Ubuntu/swap' [1.00 GB] inherit
  ACTIVE            '/dev/Ubuntu/home' [215.89 GB] inherit
#
# Now I mount them to do whatever it is I need to do, if you wanted to run a fsck on them you obviously wouldn't mount them.
#
sudo mkdir /media/root; sudo mkdir /media/home
sudo mount /dev/Ubuntu/Root /media/root; sudo mount /dev/Ubuntu/home /media/home
#
# Now to reverse the process and unmount everything
#
sudo umount /media/root; sudo umount /media/home
sudo rmdir /media/root; sudo rmdir /media/home
sudo vgchange -a n Ubuntu 
sudo cryptsetup luksClose cheer

[wanchai]

Thanks for your post, solved my problem.

Why are you saying that you are not sure how to mount them? Your last line in the code box does exactly that.


More stuff for future reference:

If you have multiple disks with LVMs, for example the disk your OS is running on plus the USB disk you're trying to mount, then vgchange should get the volume name as an argument, for example:

sudo vgchange -a y testDiskVG1

To un-do the whole thing, you need to unmount the logical volumes, then close the volume group and lastly close the encrypted partition. For example (using jerome1232's naming scheme):

sudo umount /media/root; sudo umount /media/home
sudo vgchange -a n Ubuntu 
sudo cryptsetup luksClose cheer

Another little problem I had: both my built-in disk and the external one used the same name for the volume group. In this case it's impossible to activate the second volume group. Use vgdisplay to see what you have. Important are the fields VG Name and VG UUID. Then you can use

vgrename oldUUID newName

to make the names unique.


One last thing: when you plug in a USB drive with encrypted LVM partitions, Gnome pops up a dialog "Unlock Encrypted Data". When you use that, Ubuntu will do half the job. Do

ls -l /dev/mapper

to see how far you got. You'll probably have to manually mount the partitions, and you certainly have to un-do things manually. Instead of something short, like 'cheer', this automagic ersatz cryptsetup gizmo will use a long, ugly name, but you'll see it in /dev/mapper.

[jerome1232]

Yeah I actually just worked it over before anybody responded with an answer, so I edited my post to reflect how I got it working in case someone stumbled on the thread looking for an answer I see I forgot to edit out a few things. I added some of your additions.

[wanchai]

Again, for future reference:

cryptmount after booting from Ubuntu 8.10 Desktop CD

Basically it works in the same way, but first you need to manually install packages cryptsetup and lvm2. Unfortunately, these packages are not on the Desktop CD, so you either need network access or have them on a non-encrypted disk.

Then you need to "modprobe dm-crypt". If you don't do the modprobe, cryptsetup openLuks will give you an error that sounds like "wrong password" (https://bugs.launchpad.net/ubuntu/+s...up/+bug/267192)

[gauthma]

After having installed Kubuntu on my laptop using this tutorial, (which an almost identical setup to the one used in the explanation), I had become concerned about to do if I ever encountered problems and needed to boot from a live CD. This post cleared it out for me (worked in the first attempt, and was so much simpler of what I had imagined!)

Anyway, great work!
Big thanks

[jerome1232]

Anyway, great work!
Big thanks

I'm glad it helped you

Unfortunately, these packages are not on the Desktop CD, so you either need network access or have them on a non-encrypted disk.

Good point I had never thought about if I was stranded without access to a repository, I think I'll be downloading these packages and putting them somewhere unencrypted/lvm'd.

[John Wiersba]

Again, for future reference:
cryptmount after booting from Ubuntu 8.10 Desktop CD

Wanchai: what did you mean by this? Was this supposed to be a be a link to an article?

[wanchai]

John, it wasn't a link, just underlined text, changed it to bold, hopefully that's less confusing