EDIT: Added garuda inxi:
Summary
╭─mario@mario in ~ took 0s
╰─λ sudo cat /usr/bin/garuda-inxi
[sudo] password for mario:
#!/bin/bash
if [ -t 1 ] ; then
c_134=$'\033[1;34m'
c_131=$'\033[1;31m'
c_off=$'\033[0m'
else
c0="c0"
fi
detect_dual_boot() {
if [[ $EUID -eq 0 ]] && [[ -x /usr/bin/os-prober ]]; then
local OSPROBER_OUT="$(os-prober)" || { DUALBOOT="Os-prober error"; exit; }
echo $OSPROBER_OUT | grep -q "Windows Boot Manager" &> /dev/null && DUALBOOT="Yes" || DUALBOOT="No/Undetected"
elif [[ -x /usr/bin/efibootmgr ]] && [ -d /boot/efi ]; then
local EFIBOOTMGR_OUT="$(efibootmgr)" || { DUALBOOT="Efibootmgr error"; exit; }
echo $EFIBOOTMGR_OUT | grep -q "Windows Boot Manager" &> /dev/null && DUALBOOT="Probably (Run as root to verify)" || DUALBOOT="No/Undetected"
elif [[ -x /usr/bin/os-prober ]]; then
DUALBOOT="<superuser required>"
else
DUALBOOT="No detection tool installed"
fi
}
detect_snapshots() {
if [ -d /.snapshots ] || pacman -Qq snapper-support &> /dev/null; then
printf "snapper "
elif [ -d /run/timeshift ] || pacman -Qq timeshift-support &> /dev/null; then
printf "timeshift "
elif pacman -Qq snapper &> /dev/null; then
printf "snapper(custom) "
elif pacman -Qq timeshift &> /dev/null; then
printf "timeshift(custom) "
fi
}
generate_relevant_software() {
local RELEVANT=()
local packages
packages="$(pacman -Qq garuda-dracut-support mkinitcpio dracut nvidia-dkms grub-customizer 2> /dev/null | xargs || true)"
systemctl is-enabled tlp &> /dev/null && RELEVANT+=("tlp")
systemctl is-active NetworkManager &> /dev/null && RELEVANT+=("NetworkManager")
systemctl is-active connman &> /dev/null && RELEVANT+=("connman")
if [[ "$packages" =~ (^| )garuda-dracut-support($| ) ]]; then
RELEVANT+=("dracut")
elif [[ "$packages" =~ (^| )dracut($| ) ]]; then
RELEVANT+=("dracut(custom)")
fi
[[ "$packages" =~ (^| )mkinitcpio($| ) ]] && RELEVANT+=("mkinitcpio")
[[ "$packages" =~ (^| )nvidia-dkms($| ) ]] && RELEVANT+=("nvidia-dkms")
[[ "$packages" =~ (^| )grub-customizer($| ) ]] && RELEVANT+=("grub-customizer")
detect_snapshots
local RELEVANT_SOFTWARE="${RELEVANT[*]}"
[ -z "$RELEVANT_SOFTWARE" ] && RELEVANT_SOFTWARE="None"
echo "$RELEVANT_SOFTWARE"
}
generate_system_update() {
local last_update
last_update="$(date -r /var/lib/garuda/last_update +%s 2> /dev/null)" || { echo "Unknown/Never"; return; }
local reboot=""
if [ "$last_update" -gt "$(date -r /proc +%s)" ]; then
reboot=" ${c_131}↻${c_off}"
fi
echo -e "$(date -d"@$last_update" +%F)${reboot}"
}
inxi -Faz${c0} --zv
echo -e "${c_134}Garuda ($(pacman -Q garuda-common-settings | awk '{print $2}')):${c_off}"
install_date="$(head -n1 /var/log/pacman.log | cut -d " " -f1 | cut -c 2-11)"
echo -e "${c_134} System install date:${c_off} ${install_date}"
echo -e "${c_134} Last full system update:${c_off} $(generate_system_update)"
echo -e "${c_134} Is partially upgraded: ${c_off} $([ -e /var/lib/garuda/partial_upgrade ] && echo Yes || echo No)"
echo -e "${c_134} Relevant software: ${c_off} $(generate_relevant_software)"
detect_dual_boot &> /dev/null
echo -e "${c_134} Windows dual boot: ${c_off} ${DUALBOOT}"
echo -e "${c_134} Failed units: ${c_off} $(systemctl list-units --failed --full --all --plain --no-legend | awk '{printf("%s ",$1)}')"
if [ "$1" == "funstuff" ]; then
update_count="$(paclog --grep="starting full system upgrade" | wc -l)"
echo -e "${c_134} Total system updates: ${c_off} ${update_count}"
echo -e "${c_134} --> Updates per week: ${c_off} $(( ${update_count}/(($(date +%s) - $(date --date="$install_date" +%s) )/(60*60*24*7)) ))"
fi
```-
As the title says i want to unlock my luks partition at boot using a keyfile stored on an USB drive. Yes i know i should use a Yubikey (and i will in the future) but i want to learn and understand how it would work.
After countless hours reading threads and manpages im not sure I learned anything other than that i tried various approaches and that they did not work. But I hope that its a Layer 8 problem.
Also this is only a testclient. I dont care if there is dataloss in the process! I just want to figure it out!
The Setup i currently have:
Drive Partitions:
NAME FSTYPE FSVER LABEL UUID FSAVAIL FSUSE% MOUNTPOINTS
sda
├─sda1 vfat FAT32 961B-6B91 298,6M 0% /boot/efi
├─sda2 crypto_LUKS 1 a94fa0a8-dcaa-4051-b3bb-1718cc6eba85
│ └─luks-a94fa0a8-dcaa-4051-b3bb-1718cc6eba85 btrfs dfcfa048-d201-46ee-ab20-eec66e74c2d2 448,9G 4% /var/tmp
│ /var/cache
│ /var/log
│ /root
│ /home
│ /srv
│ /
└─sda3 crypto_LUKS 1 faa0557d-f79c-49dd-8904-d11a7c3e1da8
└─luks-faa0557d-f79c-49dd-8904-d11a7c3e1da8 swap 1 swap 5cd4a803-586d-416e-b8eb-7dddf26c90e9 [SWAP]
sdb
└─sdb1 THE USB I WANT TO USE!
zram0 swap 1 zram0 93ebc1a7-83c1-4de9-ac65-f83b7878bcbe [SWAP]
My USB:
ls /run/media/mario/luksgood/
drwxr-xr-x - mario 18 Jun 12:32 .Trash-1000
drwxr-xr-x - mario 23 Jun 16:54 .Trash-1924804655
.rw-r--r-- 2,0k mario 29 Jun 21:14 key
I modified /etc/default/grub manually, from what i thought i learned from different threads. Most Likely here lies one of the mistakes.
# GRUB boot loader configuration
GRUB_DEFAULT=0
GRUB_TIMEOUT=5
GRUB_DISTRIBUTOR='Garuda'
#GRUB_CMDLINE_LINUX_DEFAULT='quiet rd.luks.uuid=a94fa0a8-dcaa-4051-b3bb-1718cc6eba85 rd.luks.uuid=faa0557d-f79c-49dd-8904-d11a7c3e1da8 resume=/dev/mapper/luks-faa0557d-f79c-49dd-8904-d11a7c3e1da8 loglevel=3'
GRUB_CMDLINE_LINUX_DEFAULT="quiet splash rd.luks.name=a94fa0a8-dcaa-4051-b3bb-1718cc6eba85=luksroot rd.luks.key=/dev/disk/by-uuid/0845-C218:key rd.luks.timeout=15"
GRUB_CMDLINE_LINUX=""
...
One of the Threads i read was saying i need to use dracut to make the initramfs aware of the USB. But for the love of god i cannot get it to work.
I created “/etc/dracut.conf.d/10-usb-luks.conf”
╰─λ sudo cat /etc/dracut.conf.d/10-usb-luks.conf
[sudo] password for mario:
hostonly="no"
add_device+=" /dev/disk/by-uuid/0845-C218 "
add_drivers+=" usb_storage usbhid xhci_hcd ehci_pci ehci_hcd uhci_hcd sd_mod "
filesystems+=" vfat "
I also did a rebuild of initramfs using “sudo dracut --force /boot/initramfs-linux-zen.img 6.15.4-zen2-1-zen” but i cant find a mention of “vfat” or the device uuid in the logs:
LOG:
dracut[I]: Executing: /usr/bin/dracut --force /boot/initramfs-linux-zen.img 6.15.4-zen2-1-zen
dracut[I]: *** Including module: bash ***
dracut[I]: *** Including module: systemd ***
dracut[I]: *** Including module: systemd-ask-password ***
dracut[I]: *** Including module: systemd-battery-check ***
dracut[I]: *** Including module: systemd-cryptsetup ***
dracut[I]: *** Including module: systemd-initrd ***
dracut[I]: *** Including module: systemd-journald ***
dracut[I]: *** Including module: systemd-modules-load ***
dracut[I]: *** Including module: systemd-pcrphase ***
dracut[I]: *** Including module: systemd-sysctl ***
dracut[I]: *** Including module: systemd-tmpfiles ***
dracut[I]: *** Including module: systemd-udevd ***
dracut[I]: *** Including module: modsign ***
dracut[I]: *** Including module: dbus-broker ***
dracut[I]: *** Including module: dbus ***
dracut[I]: *** Including module: i18n ***
dracut[I]: *** Including module: network-manager ***
dracut[I]: *** Including module: network ***
dracut[I]: *** Including module: net-lib ***
dracut[I]: *** Including module: btrfs ***
dracut[I]: *** Including module: crypt ***
dracut[I]: *** Including module: dm ***
dracut[I]: *** Including module: kernel-modules ***
dracut[I]: *** Including module: kernel-modules-extra ***
dracut[I]: *** Including module: kernel-network-modules ***
dracut[I]: *** Including module: lvm ***
dracut[I]: *** Including module: mdraid ***
dracut[I]: *** Including module: nvdimm ***
dracut[I]: *** Including module: qemu ***
dracut[I]: *** Including module: qemu-net ***
dracut[I]: *** Including module: btrfs-snapshot-overlay ***
dracut[I]: *** Including module: fido2 ***
dracut[I]: *** Including module: pkcs11 ***
dracut[I]: *** Including module: cifs ***
dracut[I]: *** Including module: hwdb ***
dracut[I]: *** Including module: lunmask ***
dracut[I]: *** Including module: nfs ***
dracut[I]: *** Including module: resume ***
dracut[I]: *** Including module: rootfs-block ***
dracut[I]: *** Including module: terminfo ***
dracut[I]: *** Including module: udev-rules ***
dracut[I]: *** Including module: virtiofs ***
dracut[I]: *** Including module: dracut-systemd ***
dracut[I]: *** Including module: usrmount ***
dracut[I]: *** Including module: base ***
dracut[I]: *** Including module: fs-lib ***
dracut[I]: *** Including module: shell-interpreter ***
dracut[I]: *** Including module: shutdown ***
dracut[I]: *** Including module: systemd-sysusers ***
dracut[I]: *** Including modules done ***
dracut[I]: *** Installing kernel module dependencies ***
dracut[I]: *** Installing kernel module dependencies done ***
dracut[I]: *** Resolving executable dependencies ***
dracut[I]: *** Resolving executable dependencies done ***
dracut[I]: *** Hardlinking files ***
dracut[I]: *** Hardlinking files done ***
dracut[I]: *** Generating early-microcode cpio image ***
dracut[I]: *** Constructing GenuineIntel.bin ***
dracut[I]: *** Store current command line parameters ***
dracut[I]: *** Stripping files ***
dracut[I]: *** Stripping files done ***
dracut[I]: *** Creating image file '/boot/initramfs-linux-zen.img.tmp' ***
dracut[I]: *** Creating initramfs image file '/boot/initramfs-linux-zen.img.tmp' done ***
dracut[I]: *** Moving image file '/boot/initramfs-linux-zen.img.tmp' to '/boot/initramfs-linux-zen.img' ***
dracut[I]: *** Moving image file '/boot/initramfs-linux-zen.img.tmp' to '/boot/initramfs-linux-zen.img' done ***
After Reboot i just get prompted for my password as usual.
I apologise if this is really dumb and also for my bad english. If someone could point me in the right direction i would be grateful!
Best Regards
Tastelessbrain
