Arch Linux

Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!
Tasklist

FS#22108 - [archboot] installation root on lvm2 on dmcrypt printing cleartext password at boot and shutdown

Attached to Project: Arch Linux
Opened by spock (spock) - Wednesday, 15 December 2010, 10:39 GMT
Last edited by Tobias Powalowski (tpowa) - Wednesday, 17 October 2012, 13:34 GMT
Task Type Bug Report
Category Packages: Extra
Status Closed
Assigned To Tobias Powalowski (tpowa)
Architecture All
Severity Medium
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description:
When installing archlinux using the archboot iso (version 2010.12) with root on lvm2 on dmcrypt (probably also without lvm2) the password used for LUKS encryption is printed in cleartext during both bootup and shutdown. The bootup error was something in the line of syntax error of line 228 in /etc/rc.sysinit (do_crypt). And the error message contained the password in cleartext. At shutdown it was "do_uncrypt" error and cleartext password shown again. I do have some strange characters (brackets "(){}" for example) in my password that I guess could break scripts. But it works fine in the official 2010.05 iso.

I was in a rush to finish installing the system so I didn't take good notes on the problem before I installed with the official ISO. Sorry if the information is lacking detail.

Additional info:
* archlinux-2010.12-1-archboot.iso from official ftp

Steps to reproduce:
Boot archboot installation media.
Create luks device.
Create LVM2 devices on top of luks.
Create filesystems on top of LVM2.
Install and configure the system.
Reboot.
Enter the password to unlock the luks partition.
Wait for initscripts to start loading.
Password revealed because of error.
This task depends upon

Closed by  Tobias Powalowski (tpowa)
Wednesday, 17 October 2012, 13:34 GMT
Reason for closing:  Fixed
Comment by spock (spock) - Wednesday, 15 December 2010, 10:48 GMT
Seems I cannot edit the bug report so I'll just add this here.

The problem remains after a full system update (pacman -Syu). I also noticed that quite a bit of packages on the archboot ISO was newer than the official core repo.
Comment by Tobias Powalowski (tpowa) - Saturday, 18 December 2010, 07:57 GMT
This is not a archboot bug, but a bug in normal arch boot process, probably new initscripts.
archboot is not used anymore on reboot and if a pacman -Syu doesn't solve the issue something is wrong during the normal boot process.
Comment by spock (spock) - Saturday, 18 December 2010, 16:36 GMT
Of course archboot is not used anymore on reboot. My best guess was that archboot messed something up during the installation and left this problem with password printed in cleartext. But thats far fetched I guess. Never the less the problem is(was?) there.

As I wrote in the bug report I later installed using the official 2010.05 iso, and that one worked perfectly, including after 'pacman -Syu'.
Comment by spock (spock) - Wednesday, 29 December 2010, 12:12 GMT
Today I did another installation with archboot 2010.12, and the same problem persisted. I also tried with a more plaintext password but the problem was still there!

After some searching I noticed that the file /etc/crypttab has the line "dmcrypt /dev/xxx <mypassword>" in it, even tho it shouldn't be there (atleast in my case). Removing this line fixed the problem. Also why do we store the password in cleartext like that?
Again, my setup is: root filesystem on top of LVM2 which is on top of LUKS/dmcrypt. The password is entered at boot, so crypttab shouldn't have any info added to it by this kind of installation, right?
Comment by Tobias Powalowski (tpowa) - Friday, 01 April 2011, 19:49 GMT
Still an issue with latest isos?
Comment by spock (spock) - Sunday, 01 May 2011, 07:18 GMT
Yes, although the problem changed a bit. Now "ASK" is added to crypttab, which leaves another error message since filesystem root is already mounted with password earlier in the boot process. I spotted the new dialog (but I cant remember atm. what it said) and I remember thinking for myself after the installation that that new dialog should say "automatically add mounting/password information to /etc/crypttab - yes/no". and then do just that.
Comment by spock (spock) - Sunday, 22 May 2011, 22:48 GMT
With 2011.05-2 the following still got added to crypttab (even after answering "no" in the save passwords to crypttab dialog).

dmcrypt /dev/sda4 ASK

No serious errors during boot but when the hook is run it will fail since dmcrypt is already initialized and mounted earlier.
Also noticed a spelling error in the new dialog window, "safe" instead of "save".

Loading...