v1.2-1

In previous Arch/kernel versions, the network device speed was
automatically set to the lowest possible upon poweroff when WoL was
enabled.

Latest versions do keep the network device to its standard speed (1000M
for example), which consumes some useless power when computer is powered
off and WoL enabled.

Force speed lowering for WoL.
But restore it before continuing boot, when devices are unlocked,
otherwise it remains as-is.

Make it an option, to select the wanted speed, or leave it as-is.

ChangeLog

@@ -1,32 +1,115 @@
+2026-07-12 Julien Coloos <julien.coloos [at] gmail [dot] com>
+
+        * v1.2-1
+        New option to log some messages to kmsg too.
+
+        Change network speed to 10M during boot, to reduce consumption upon WoL.
+
+
+2025-11-15 Julien Coloos <julien.coloos [at] gmail [dot] com>
+
+        * v1.1-2
+        Removed 11-dm-initramfs.rules, which was added to 10-dm.rules.
+        See: https://gitlab.archlinux.org/archlinux/mkinitcpio/mkinitcpio/-/commit/589e0397ea55e61a08fdbcab52ad4639d382f08e
+
+        Use full version (pkgver and pkgrel) for source archive name.
+        Sometimes we need to change the sources, but only for minor external
+        dependencies diff (e.g. adding/removing upstream source), in which
+        case we wish to only bump pkgrel.
+
+
+2022-03-24 Julien Coloos <julien.coloos [at] gmail [dot] com>
+
+        * v1.1-1
+        Refactored install script to more easily spot code coming from other
+        nominal hooks.
+        Updated install script message with latest available options.
+
+        Removed dependency to '/lib/libnss_files.so', as it does not exist and
+        should not be needed anymore.
+        Prevents unwanted warning when building initcpio
+          ==> ERROR: file not found: `/lib/libnss_files.so'
+        See: https://bugs.archlinux.org/task/73702
+
+
+2021-11-13 Julien Coloos <julien.coloos [at] gmail [dot] com>
+
+        * v1.0-1
+        Option to use login shell instead of cryptsetup unlocking script.
+        Option to re-enable Wake-on-LAN on network device.
+
+
+2021-11-12 Julien Coloos <julien.coloos [at] gmail [dot] com>
+
+        * v0.9-2
+        Use SHA256 checksums instead of MD5.
+
+
+2021-10-24 Julien Coloos <julien.coloos [at] gmail [dot] com>
+
+        * v0.9-1
+        Try to print network devices information when interface setup fails.
+
+
+2021-08-15 Julien Coloos <julien.coloos [at] gmail [dot] com>
+
+        * v0.8-1
+        Include 'libgcc_s.so.1' which is necessary for (at least) proper LUKS
+        v2 handling.
+
+
+2020-07-14 Julien Coloos <julien.coloos [at] gmail [dot] com>
+
+        * v0.7-1
+        Dropped 'dsa' private key support; added 'ed25519' private key support.
+
+
+2018-03-13 Julien Coloos <julien.coloos [at] gmail [dot] com>
+
+        * v0.6-1
+        Dropped '-m' option when calling dropbear (latest ArchLinux version
+        does not handle it).
+
+
+2017-06-25 Julien Coloos <julien.coloos [at] gmail [dot] com>
+
+        * v0.5-1
+        Fixed cryptsetup additional arguments handling: were not properly
+        passed.
+
+
 2017-06-25 Julien Coloos <julien.coloos [at] gmail [dot] com>
 
         * v0.4-1
-        Fixed TRIM option handling in /etc/crypttab: 'discard' ('allow-discards' being the switch name to use in cryptsetup)
+        Fixed TRIM option handling in /etc/crypttab: 'discard'
+        ('allow-discards' being the switch name to use in cryptsetup).
 
 
 2015-11-22 Julien Coloos <julien.coloos [at] gmail [dot] com>
 
         * v0.3-1
-        Added configurable timeout for ipconfig
+        Added configurable timeout for ipconfig.
-        Moved configuration file from /etc/dropbear/initrd.env to /etc/initcpio/sshcs_env
+        Moved configuration file from /etc/dropbear/initrd.env to
+        /etc/initcpio/sshcs_env.
 
 
 2014-05-20 Julien Coloos <julien.coloos [at] gmail [dot] com>
 
         * v0.2-1
-        Removed unnecessary dependency: psmisc
+        Removed unnecessary dependency: psmisc.
-        Added configurable timeout to unlock devices before automatic poweroff
+        Added configurable timeout to unlock devices before automatic poweroff.
 
 
 2014-05-19 Julien Coloos <julien.coloos [at] gmail [dot] com>
 
         * v0.1-1
 
-        * Code adapted from dropbear_initrd_encrypt (https://aur.archlinux.org/packages/dropbear_initrd_encrypt/)
+        Code adapted from dropbear_initrd_encrypt.
-        Reworked code
+        See: https://aur.archlinux.org/packages/dropbear_initrd_encrypt/
-        Dropped non-LUKS support
-        Rely on /etc/crypttab
-        Handle multiple devices to unlock
-        Merged dropbear and encryptssh hooks
-        Better resources cleanup
 
+        Reworked code.
+        Dropped non-LUKS support.
+        Rely on /etc/crypttab.
+        Handle multiple devices to unlock.
+        Merged dropbear and encryptssh hooks.
+        Better resources cleanup.

PKGBUILD

@@ -1,20 +1,21 @@
 # Maintainer: Julien Coloos <julien.coloos [at] gmail [dot] com>
 pkgname=initrd-ssh-cryptsetup
-pkgver=0.4
+pkgver=1.2
 pkgrel=1
-pkgdesc="Allows for LUKS-encrypted devices to be unlocked remotely over SSH"
+pkgdesc="Allows to remotely unlock LUKS-encrypted devices over SSH"
 arch=('any')
 url="https://github.com/suiryc/archlinux-$pkgname"
 license=('GPL3')
-depends=('dropbear' 'cryptsetup' 'mkinitcpio-nfs-utils' 'iproute2')
+depends=('dropbear' 'cryptsetup' 'mkinitcpio-nfs-utils' 'iproute2' 'ethtool')
 install=$pkgname.install
 changelog='ChangeLog'
-source=("http://julien.coloos.free.fr/archlinux/$pkgname-$pkgver.tar.xz" "$pkgname.install")
+source=("http://julien.coloos.free.fr/archlinux/$pkgname-$pkgver-$pkgrel.tar.xz" "$pkgname.install")
-md5sums=('fab9d0ffc14a6cd7bcb79fa1b9411336'
+sha256sums=('94156250bfc04490801d8575192a787363cf4637ade2473147d3f63924c5f814'
-         'ac60109d80e7bb2af0d66e69aaf178a6')
+            'b84978b3c2ef32208c2b104ee2d3ce8aaec26da0bd4e9e1c83942f373bbf6285')
 
 package() {
   install -Dm644 "$srcdir/src/install/ssh-cryptsetup"     "$pkgdir/usr/lib/initcpio/install/ssh-cryptsetup"
   install -Dm644 "$srcdir/src/hooks/ssh-cryptsetup"       "$pkgdir/usr/lib/initcpio/hooks/ssh-cryptsetup"
+  install -Dm644 "$srcdir/src/hooks/ssh-cryptsetup-tools" "$pkgdir/usr/lib/initcpio/hooks/ssh-cryptsetup-tools"
 }
 

README.md

@@ -1,42 +1,92 @@
-Personal ArchLinux package combining dropbear and cryptsetup in initrd for unlocking LUKS-encrypted devices either locally (boot console) or remotely over SSH.
+Personal ArchLinux package combining dropbear and cryptsetup in initramfs for unlocking LUKS-encrypted devices either locally (boot console) or remotely over SSH.  
-The code was reworked from [dropbear_initrd_encrypt](https://aur.archlinux.org/packages/dropbear_initrd_encrypt/).
+The code was reworked from legacy dropbear_initrd_encrypt AUR package.
 
 
 ## Installation
-After cloning the repo, installation is done as for an AUR package.
+After cloning the repo, installation is done as for an AUR package, e.g.:
+```bash
+makepkg -sri
+```
 
+## Dropbear
+SSH server key need to be generated for `dropbear`.  
+Either a new key can be generated with `dropbearkey`, e.g.:
+```bash
+dropbearkey -t ecdsa -f /etc/dropbear/dropbear_ecdsa_host_key
+```
+Or an existing OpenSSH key can be converted with `dropbearconvert` (useful so that the server fingerprint is the same with both), e.g.:
+```bash
+dropbearconvert openssh dropbear /etc/ssh/ssh_host_ecdsa_key /etc/dropbear/dropbear_ecdsa_host_key
+```
+Notes:
+   * `rsa` and `ed25519` types are also handled
+   * OpenSSH keys must be in `PEM` format for `dropbearconvert` to properly work
+
+If necessary an existing key file can be converted to `PEM` format using `ssh-keygen`:
+```bash
+ssh-keygen -A -p -m PEM -f /etc/ssh/ssh_host_ecdsa_key
+```
 
 ## Configuration
 As explained upon installation, the following things need to be done:
-   * add the SSH public key to `/etc/dropbear/initrd.authorized_keys`
+   * add the authorized SSH public key to `/etc/dropbear/initrd.authorized_keys`
    * add the `ip=` kernel command parameter to the bootloader configuration (see https://wiki.archlinux.org/index.php/Mkinitcpio#Using_net)
+      - e.g. with `grub`: add `ip=:::::eth0:dhcp` to `GRUB_CMDLINE_LINUX_DEFAULT` in `/etc/default/grub`, and re-generate the configuration with `grub-mkconfig -o /boot/grub/grub.cfg`
+      - also see https://git.kernel.org/pub/scm/libs/klibc/klibc.git/tree/usr/kinit/ipconfig/README.ipconfig
    * in the `HOOKS` section of `/etc/mkinitcpio.conf`, add `ssh-cryptsetup` before `filesystems`; then rebuild the initramfs: `mkinitcpio -p linux`
+      - when using a non-standard keyboard layout, it is also useful to add the `keymap` hook before `ssh-cryptsetup`, and also move `keyboard` before `keymap`
 
 The LUKS-encrypted devices to unlock are derived from `/etc/crypttab`.
 
 
-Some options can be set in `/etc/initcpio/sshcs_env` (file is sourced in initrd shell):
+Some options can be set in `/etc/initcpio/sshcs_env` (file is sourced in initramfs shell):
+   * `sshcs_opt_log_kmsg`: whether to log (debug, info, error) messages to kmsg too
+      - default: `1`
+      - many messages are only printed on console and are not concerned
+      - by default (debug disabled), only useful messages are concerned
+      - set `0` to disable
+   * `sshcs_opt_debug`: whether to be more verbose about ongoing actions
+      - default: `0`
+      - any non-zero value to enable
+   * `sshcs_opt_net_wol`: Wake-on-LAN option to set on network device
+      - default: `g` (MagicPacket™)
+      - usually WoL is disabled once in initramfs shell
+      - set empty to not change network device WoL setting
+   * `sshcs_opt_net_speed`: speed to set on network device
+      - default: `10`
+      - full duplex is enabled, and auto-negociation disabled
+      - latest Arch/kernel tend to keep the speed at 1000M even during WoL
+      - this only applies to boot phase and persists for WoL: when unlocking devices, the network is reconfigured before the OS is fully ready
+      - set `0` to not change network device speed
    * `sshcs_opt_timeout_ipconfig`: time (in seconds) to configure IP
-      - default: 10 seconds
+      - default: `10`
    * `sshcs_opt_listen`: SSH listening port
-      - default: 22
+      - default: `22`
    * `sshcs_opt_timeout_poweroff`: time (in seconds) to unlock devices before automatic powering off
-      - default (and minimum value): 2 minutes
+      - default (and minimum value): `120` (2 minutes)
       - negative value to deactivate
+   * `sshcs_opt_use_shell`: whether to start a full `ash` shell
+      - default: `0`
+      - `1` to enable
+      - when disabled (the default), a script to unlock devices is executed instead
 
 For example:
-
+```bash
-    sshcs_opt_timeout_ipconfig=30
+sshcs_opt_timeout_ipconfig=30
-    sshcs_opt_listen=2222
+sshcs_opt_listen=2222
-    sshcs_opt_timeout_poweroff=-1
+sshcs_opt_timeout_poweroff=-1
-
+sshcs_opt_use_shell=1
+```
 
 ## Building notes
 1. Modify the sources (features in `src`, and/or package building files)
 2. If `src` was modified
-   * archive the `src` folder in `$pkgname-$pkgver.tar.xz` file; e.g.: `tar -cJf initrd-ssh-cryptsetup-0.4.tar.xz src`
+   * bump `pkgver`, or `pkgrel`, in `PKGBUILD`
+   * archive the `src` folder in `$pkgname-$pkgver-$pkgrel.tar.xz` file; e.g.: `tar -cJf initrd-ssh-cryptsetup-$(grep "^pkgver=" PKGBUILD | cut -d'=' -f2)-$(grep "^pkgrel=" PKGBUILD | cut -d'=' -f2).tar.xz src`
    * upload the archive on the online repository (pointed by `PKGBUILD`)
-3. Update `PKGBUILD`
+3. Update ChangeLog
-   * bump `pkgver` if `src` was modified, or `pkgrel` if building files were modified
+4. Update `PKGBUILD`
-   * refresh `md5sums` if necessary (based on `md5sum initrd-ssh-cryptsetup-*.tar.xz initrd-ssh-cryptsetup.install` output)
+   * bump `pkgrel` if only building files were modified
-4. Delete generated archive file if any
+   * refresh `sha256sums` with `updpkgsums` if necessary
+     - or manually, based on `sha256sum initrd-ssh-cryptsetup-*.tar.xz initrd-ssh-cryptsetup.install` output
+5. Delete generated archive file if any

src/hooks/ssh-cryptsetup

@@ -1,23 +1,29 @@
 #!/usr/bin/ash
 
-sshcs_env_load() {
+. "/usr/local/bin/ssh-cryptsetup-tools"
-    local timeout_ipconfig_default=10
-    local timeout_poweroff_min=120
-
-    [ -e "${sshcs_env}" ] && . "${sshcs_env}"
-    [ -z "${sshcs_opt_timeout_ipconfig}" ] && sshcs_opt_timeout_ipconfig=${timeout_ipconfig_default}
-    [ -n "${sshcs_opt_listen}" ] && sshcs_opt_listen="-p ${sshcs_opt_listen}"
-    [ -z "${sshcs_opt_timeout_poweroff}" ] && sshcs_opt_timeout_poweroff=${timeout_poweroff_min}
-    [ ${sshcs_opt_timeout_poweroff} -ge 0 ] && [ ${sshcs_opt_timeout_poweroff} -lt ${timeout_poweroff_min} ] && sshcs_opt_timeout_poweroff=${timeout_poweroff_min}
-}
 
 sshcs_net_start() {
+  local iparg net_address ipconfig_out net_netmask net_gateway net_dns0 net_dns1
+
   # we must have an 'ip' setting, and a device in it
   [ -z "${ip}" ] && [ -n "${nfsaddrs}" ] && ip="${nfsaddrs}"
-    [ -z "${ip}" ] && return 1
+  [ -z "${ip}" ] && {
+    log_dbg "No ip setting to setup network"
+    return 1
+  }
 
   net_device=$(echo ${ip} | cut -d: -f6)
-    [ -z "${net_device}" ] && return 1
+  [ -z "${net_device}" ] && {
+    log_dbg "No network device to setup"
+    return 1
+  }
+
+  # Note: ethtool can access WoL settings right now, but not other settings
+  # until the network is setup.
+  if [ "${sshcs_opt_net_wol:-d}" != "d" ]; then
+    log_dbg "Setting network device=${net_device} wol=${sshcs_opt_net_wol}"
+    ethtool -s "${net_device}" wol "${sshcs_opt_net_wol}"
+  fi
 
   # Setup network and save some values
   # Note: some useful redirection means ('< <(...)' and '<<< "$(...)"') are
@@ -28,9 +34,12 @@ sshcs_net_start() {
 
   echo ""
   echo "Configuring IP (timeout = ${sshcs_opt_timeout_ipconfig}s) ..."
+  # ipconfig manual: https://git.kernel.org/pub/scm/libs/klibc/klibc.git/tree/usr/kinit/ipconfig/README.ipconfig
   ipconfig_out=$(ipconfig -t "${sshcs_opt_timeout_ipconfig}" "ip=${ip}")
   if [ $? -ne 0 ]; then
-        err "IP configuration timeout!"
+    log_err "IP configuration timeout!"
+    echo "Devices probing:"
+    ipconfig -n -t 5 -c none all
     return 1
   fi
 
@@ -51,21 +60,31 @@ sshcs_net_start() {
   . "${net_env}"
   rm -f "${net_env}"
 
-    echo "IP-Config: device=${net_device} ip=${net_address}/${net_netmask} gw=${net_gateway} dns0=${net_dns0} dns1=${net_dns1}"
+  log_msg "IP-Config: device=${net_device} ip=${net_address}/${net_netmask} gw=${net_gateway} dns0=${net_dns0} dns1=${net_dns1}"
 
-    [ -n "${net_address}" ]
+  # Ensure we have an address
+  [ -n "${net_address}" ] || return 1
+
+  # Note: We cannot change the device settings, other than WoL, before the
+  # network is setup.
+  if [ ${sshcs_opt_net_speed} != 0 ]; then
+    log_dbg "Setting network device=${net_device} speed=${sshcs_opt_net_speed}"
+    ethtool -s "${net_device}" speed "${sshcs_opt_net_speed}" duplex full autoneg off
+  fi
 }
 
 sshcs_net_done() {
   # we are done with the network
   if [ -n "${net_device}" ]; then
+    log_dbg "Setting network device=${net_device} down"
     ip addr flush dev "${net_device}"
     ip link set dev "${net_device}" down
   fi
 }
 
 sshcs_trapped_timeout() {
-    err "Timeout reached! Powering off."
+  log_err "Timeout reached! Powering off."
+  sleep 2
   poweroff -f
   exit
 }
@@ -77,12 +96,13 @@ sshcs_trap_timeout() {
     echo ""
     echo "WARNING! Automatic poweroff will be triggered in ${sshcs_opt_timeout_poweroff}s"
     echo "To deactivate, please unlock devices"
-        echo ""
     trap sshcs_trapped_timeout SIGALRM
     (
+      # Wait for timeout
       sleep ${sshcs_opt_timeout_poweroff}
+      # Signal process (triggers poweroff)
       kill -SIGALRM ${pid_init}
-            # Signal is not processed if cryptsetup is waiting for the password
+      # Note: signal is not processed if cryptsetup is waiting for the password
       killall cryptsetup > /dev/null 2>&1
     ) &
     pid_timeout=$!
@@ -90,23 +110,33 @@ sshcs_trap_timeout() {
 }
 
 sshcs_untrap_timeout() {
-    [ -z "${pid_timeout}" ] && return 0
+  [ -z "${pid_timeout:-}" ] && return 0
-    kill ${pid_timeout}
+  # Notes:
+  # If there was a running SSH shell, it may also try to kill it.
+  # This only kills the spawned subshell, leaving the 'sleep' command still
+  # running until done (which is not an issue).
+  proc_parse_stat ${pid_timeout} && kill ${pid_timeout}
+  pid_timeout=
   trap - SIGALRM
-    msg "Timeout cleared."
+  log_dbg "Timeout cleared."
 }
 
-sshcs_unlock() {
+sshcs_shell_run() {
   sshcs_trap_timeout
 
-    # actual script (shared with SSH login) unlocking encrypted devices
+  # actual script (shared with SSH login) with which we can unlock devices
-    . "${sshcs_cryptsetup_script}"
+  sshcs_unlocked_test=0
-
+  log_dbg "Running ${sshcs_shell_script}"
-    sshcs_untrap_timeout
+  # Belt and suspenders: if the script does not exist, trying to source it
+  # actually triggers a kernel panic.
+  if [ ! -e "${sshcs_shell_script}" ]; then
+    log_err "No script to run! ${sshcs_shell_script} does not exist!"
+    return
+  fi
+  . "${sshcs_shell_script}"
 }
 
-sshcs_dropbear_unlock() {
+sshcs_dropbear_run() {
-    local pid_timeout=
   local dev_pts_mounted=0
   local listen=
 
@@ -118,59 +148,22 @@ sshcs_dropbear_unlock() {
   fi
 
   # /etc/passwd file for the root user
-    echo "root:x:0:0:root:/root:${dropbear_login_shell}" > "/etc/passwd"
+  echo "root:x:0:0:root:/root:${sshcs_shell_script}" > "/etc/passwd"
-    echo "${dropbear_login_shell}" > "/etc/shells"
+  echo "${sshcs_shell_script}" > "/etc/shells"
-
-    # root login script
-    cat <<EOF > "${dropbear_login_shell}"
-#!/usr/bin/ash
-
-. "/init_functions"
-
-if [ ! -f "${sshcs_cryptsetup_script}" ]; then
-    err "No cryptsetup script present! Please retry."
-    exit 0
-fi
-
-if [ -c "/dev/mapper/control" ]; then
-    CSQUIET=
-    . "${sshcs_cryptsetup_script}"
-
-    echo ""
-    echo "cryptsetup succeeded! Boot sequence should go on."
-    echo "Please wait and retry for standard SSH service."
-else
-    err "Device resources missing! Please retry."
-fi
-echo ""
-EOF
-    chmod a+x "${dropbear_login_shell}"
 
   [ ! -d "/var/log" ] && mkdir -p "/var/log"
   touch "/var/log/lastlog"
 
-    msg "Starting dropbear ..."
+  log_dbg "Starting dropbear ..."
-    dropbear -Emsgjk -P "${path_dropbear_pid}" ${sshcs_opt_listen}
+  dropbear -Esgjk -P "${path_dropbear_pid}" ${sshcs_opt_listen}
 
-    # Actual unlocking
+  # Actual unlocking shell
-    sshcs_unlock
+  sshcs_shell_run
-
-    # cleanup dropbear
-    if [ -f "${path_dropbear_pid}" ]; then
-        msg "Stopping dropbear ..."
-        kill $(cat "${path_dropbear_pid}")
-        rm -f "${path_dropbear_pid}"
-    fi
-    rm -f "${sshcs_cryptsetup_script}" "${dropbear_login_shell}" "/etc/passwd" "/etc/shells" "/var/log/lastlog"
-
-    # cleanup /dev/pts if necessary
-    if [ ${dev_pts_mounted} -ne 0 ]; then
-        umount "/dev/pts"
-        rm -R "/dev/pts"
-    fi
 }
 
 sshcs_cryptpart_process() {
+  local cryptdev_orig cryptopt cryptargs
+
   # ensure there is a device (handle 'UUID=' format)
   [ -z "${cryptdev}" ] && return 0
   [ "${cryptdev#UUID=}" != "${cryptdev}" ] && cryptdev="/dev/disk/by-uuid/${cryptdev#UUID=}"
@@ -196,66 +189,61 @@ sshcs_cryptpart_process() {
   cryptdev_orig=${cryptdev}
   if cryptdev=$(resolve_device "${cryptdev_orig}" ${rootdelay}); then
     if cryptsetup isLuks "${cryptdev}" >/dev/null 2>&1; then
+      log_dbg "Adding crypt device=${cryptdev} type=${crypttype} name=${cryptname} args=<${cryptargs}> in setup script"
 
       # update script used to unlock device either in console or SSH
-            [ -s "${sshcs_cryptsetup_script}" ] || cat <<EOF > "${sshcs_cryptsetup_script}"
+      [ -s "${sshcs_cryptsetup_script}" ] || cat <<'EOF' > "${sshcs_cryptsetup_script}"
+#!/usr/bin/ash
+
+. "/usr/local/bin/ssh-cryptsetup-tools"
+
 cycle_or_retry() {
   local res
 
-    read -n 1 -s -t 5 -p "Whithin 5s press 'P' to poweroff, 'R' to reboot or any other key to retry. " res
+  read -n 1 -s -t 5 -p "Within 5s press 'P' to poweroff, 'R' to reboot or any other key to retry. " res
   echo ""
-    if [ "\${res}" = "P" ]; then
+  [ "${res}" == "P" ] && poweroff -f
-        poweroff -f
+  [ "${res}" == "R" ] && reboot -f
-    elif [ "\${res}" = "R" ]; then
-        reboot -f
-    fi
 }
+
+try_unlock() {
 EOF
 
       cat <<EOF >> "${sshcs_cryptsetup_script}"
-# loop until device is available
+  # loop until device is available
-while [ ! -e "/dev/mapper/${cryptname}" ]; do
+  while [ ! -e "/dev/mapper/${cryptname}" ]; do
-    if cryptsetup open --type "${crypttype}" "${cryptdev}" "${cryptname}" "${cryptargs}" "\${CSQUIET}"; then
+    if [ \${sshcs_unlocked_test:-0} -eq 1 ]; then
+      sshcs_unlocked=0
+      return
+    fi
+    if cryptsetup open --type "${crypttype}" "${cryptdev}" "${cryptname}" ${cryptargs} "\${CSQUIET}"; then
       if poll_device "/dev/mapper/${cryptname}" ${rootdelay}; then
         killall cryptsetup > /dev/null 2>&1
         break
       fi
-        err "Device still not mapped! Please wait or retry."
+      log_err "Device still not mapped! Please wait or retry."
     elif [ ! -e "/dev/mapper/${cryptname}" ]; then
-        err "cryptsetup failed! Please retry."
+      log_err "cryptsetup failed! Please retry."
     else
       break
     fi
 
     cycle_or_retry
-done
+  done
 EOF
     else
-            err "Failed to manage encrypted device ${cryptdev_orig}: not a LUKS volume."
+      log_err "Failed to manage encrypted device ${cryptdev_orig}: not a LUKS volume."
     fi
   fi
 }
 
-run_hook() {
+sshcs_cryptpart_setup() {
-    local etc_crypttab="/etc/crypttab"
+  local cryptdev crypttype cryptname cryptpass cryptoptions
-    local sshcs_env="/etc/initcpio/sshcs_env"
-    local path_dropbear_pid="/.dropbear.pid"
-    local dropbear_login_shell="/.cryptsetup_shell.sh"
-    local sshcs_cryptsetup_script="/.cryptsetup_script.sh"
-    local net_env="/.net_env.sh"
-    local line iparg net_address net_device ipconfig_out net_netmask net_gateway net_dns0 net_dns1
-    local cryptdev cryptdev_orig crypttype cryptname cryptpass cryptoptions cryptopt cryptargs CSQUIET
 
-    # Load our options
+  # Notes:
-    sshcs_env_load
+  # The script is built piece by piece to unlock each target device.
-
+  # If there is no device to unlock, there is no script, and boot should simply
-    # sanity check: crypttab should be present
+  # go on as usual.
-    [ ! -e "${etc_crypttab}" ] && return 0
-
-    modprobe -a -q dm-crypt >/dev/null 2>&1
-    [ "${quiet}" = "y" ] && CSQUIET=">/dev/null"
-
-    umask 0022
 
   # check encrypted devices to handle
   cryptdev=
@@ -269,23 +257,96 @@ run_hook() {
     sshcs_cryptpart_process
   done < "${etc_crypttab}"
 
+  # Nothing else to do if there is no device we can unlock
+  [ -s "${sshcs_cryptsetup_script}" ] || return 0
+
+  # There were deviced to unlock.
+  # We can now finish the script.
+  cat <<'EOF' >> "${sshcs_cryptsetup_script}"
+  # No other device to unlock
+}
+
+if [ -c "/dev/mapper/control" ]; then
+  CSQUIET=
+  try_unlock
+
+  [ ${sshcs_unlocked_test:-0} -eq 1 ] && return
+  sshcs_check_done 0
+else
+  if [ \${sshcs_unlocked_test:-0} -eq 1 ]; then
+    sshcs_unlocked=0
+    return
+  fi
+  echo ""
+  log_err "Device resources missing! Please retry."
+fi
+EOF
+  chmod a+x "${sshcs_cryptsetup_script}"
+
+  if [ ${sshcs_opt_use_shell} -eq 0 ]; then
+    # The script we built *is* the shell to run.
+    sshcs_shell_script=${sshcs_cryptsetup_script}
+  else
+    # User will have a full shell, and can call the script if needed.
+    cat <<EOF > "${sshcs_shell_script}"
+#!/usr/bin/ash
+
+. "/usr/local/bin/ssh-cryptsetup-tools"
+
+echo ""
+echo "Call ${sshcs_cryptsetup_script} to try unlocking device(s)"
+
+# Now give the user its shell
+/usr/bin/ash
+
+# Check whether we are fully done
+sshcs_check_done 1
+EOF
+    chmod a+x "${sshcs_shell_script}"
+  fi
+}
+
+run_hook() {
+  local etc_crypttab="/etc/crypttab"
+  local path_dropbear_pid="/.dropbear.pid"
+  local sshcs_shell_script="/.sshcs_shell.sh"
+  local net_env="/.sshcs_net_env.sh"
+  local line net_device
+  local CSQUIET
+
+  # Note: options were loaded already
+
+  # sanity check: crypttab should be present
+  [ ! -e "${etc_crypttab}" ] && {
+    log_dbg "No crypttab configuration to process"
+    return 0
+  }
+
+  # Initialize random generator ASAP.
+  # May delay first SSH login by a few seconds otherwise.
+  (dd if=/dev/urandom of=/dev/null bs=4 count=1 status=none > /dev/null 2>&1) &
+  (dd if=/dev/random of=/dev/null bs=4 count=1 status=none > /dev/null 2>&1) &
+
+  modprobe -a -q dm-crypt >/dev/null 2>&1
+  [ "${quiet}" = "y" ] && CSQUIET=">/dev/null"
+
+  umask 0022
+
+  # Setup script used to unlock device either in console or SSH
+  sshcs_cryptpart_setup
   if [ ! -e "${sshcs_cryptsetup_script}" ]; then
-        err "No encrypted device found! Skipping crypt remote unlocking."
+    log_err "No encrypted device found! Skipping crypt remote unlocking."
     return 0
   fi
 
   # start and check network
   if ! sshcs_net_start; then
-        err "Net interface not available! Skipping crypt remote unlocking."
+    log_err "Net interface not available! Skipping crypt remote unlocking."
     # We still allow to unlock locally with timeout
-        sshcs_unlock
+    sshcs_shell_run
-        # stop the network if possible
-        sshcs_net_done
     return 0
   fi
 
   # time to unlock (through console or dropbear)
-    sshcs_dropbear_unlock
+  sshcs_dropbear_run
-    # stop the network before going on in boot sequence
-    sshcs_net_done
 }

src/hooks/ssh-cryptsetup-tools

@@ -0,0 +1,221 @@
+#!/usr/bin/ash
+
+. "/init_functions"
+
+# Log debug message, if debug enabled.
+# Also log as kmsg if enabled.
+log_dbg() {
+  [ ${sshcs_opt_debug} -eq 0 ] && return 0
+  echo "$@"
+  [ ${sshcs_opt_log_kmsg} -eq 0 ] && return 0
+  echo "<31>sshcs: $@" > /dev/kmsg
+}
+
+# Log information message, even if quiet.
+# Also log as kmsg if enabled.
+log_msg() {
+  echo "$@"
+  [ ${sshcs_opt_log_kmsg} -eq 0 ] && return 0
+  echo "<30>sshcs: $@" > /dev/kmsg
+}
+
+# Log error message (prefixed with "ERROR: " in console).
+# Also log as kmsg if enabled.
+log_err() {
+  err "$@"
+  [ ${sshcs_opt_log_kmsg} -eq 0 ] && return 0
+  echo "<27>sshcs: $@" > /dev/kmsg
+}
+
+sshcs_env_load() {
+  local sshcs_env="/etc/initcpio/sshcs_env"
+
+  local log_kmsg_default=1
+  local debug_default=0
+  local net_wol_default=g
+  local net_speed_default=10
+  local timeout_ipconfig_default=10
+  local timeout_poweroff_min=120
+  local use_shell_default=0
+
+  [ ${sshcs_env_loaded:-0} -eq 1 ] && return
+  [ -e "${sshcs_env}" ] && . "${sshcs_env}"
+  sshcs_env_loaded=1
+  [ -z "${sshcs_opt_log_kmsg}" ] && sshcs_opt_log_kmsg=${log_kmsg_default}
+  [ -z "${sshcs_opt_debug}" ] && sshcs_opt_debug=${debug_default}
+  [ -z "${sshcs_opt_net_wol}" ] && sshcs_opt_net_wol=${net_wol_default}
+  [ -z "${sshcs_opt_net_speed}" ] && sshcs_opt_net_speed=${net_speed_default}
+  [ -z "${sshcs_opt_timeout_ipconfig}" ] && sshcs_opt_timeout_ipconfig=${timeout_ipconfig_default}
+  [ -n "${sshcs_opt_listen}" ] && sshcs_opt_listen="-p ${sshcs_opt_listen}"
+  [ -z "${sshcs_opt_timeout_poweroff}" ] && sshcs_opt_timeout_poweroff=${timeout_poweroff_min}
+  [ -z "${sshcs_opt_use_shell}" ] && sshcs_opt_use_shell=${use_shell_default}
+  [ ${sshcs_opt_timeout_poweroff} -ge 0 ] && [ ${sshcs_opt_timeout_poweroff} -lt ${timeout_poweroff_min} ] && sshcs_opt_timeout_poweroff=${timeout_poweroff_min}
+
+  sshcs_cryptsetup_script="/.sshcs_cryptsetup_script.sh"
+}
+
+proc_parse_stat() {
+  local unused
+
+  pid=$1
+  cmd=
+  ppid=
+  [ ! -e /proc/${pid}/stat ] && return 1
+  read unused cmd unused ppid unused < /proc/${pid}/stat
+}
+
+proc_find_parent_cmd() {
+  pid=$1
+  proc_parse_stat ${pid} || return 1
+  while [ ${ppid} -gt 1 ]
+  do
+    proc_parse_stat ${ppid} || return 1
+    if [ "${cmd}" == "($2)" ]; then
+      ppid=${pid}
+      pid=$1
+      return 0
+    fi
+    pid=${ppid}
+  done
+
+  return 1
+}
+
+proc_is_console() {
+  if [ -z "${is_console:-}" ]; then
+    # We are in console if we were not forked from dropbear.
+    is_console=1
+    proc_find_parent_cmd $$ "dropbear" && is_console=0
+  fi
+
+  [ "${is_console}" -eq 1 ]
+}
+
+sshcs_cleanup() {
+  local pgrep_output
+
+  # Reminders:
+  # We are called when devices have been unlocked.
+  #
+  # We are only called as part of the main shell (whether on console - the init
+  # script - or through SSH - as the user login shell), and once we return our
+  # parent shell will end.
+  #
+  # The unlocking script does 'killall cryptsetup' after each successful unlock,
+  # which is used to wakeup any other running unlocking script.
+  # Thus as long as all devices have been unlocked, we don't expect any script
+  # to be stuck on 'cryptsetup' calls.
+
+  # If we did change the network speed, time to reset it.
+  if [ -n "${net_device}" ] && [ ${sshcs_opt_net_speed} != 0 ]; then
+    log_dbg "Restoring network device=${net_device} speed"
+    ethtool -s "${net_device}" autoneg on
+  fi
+
+  if proc_is_console; then
+    # We are in the console.
+    # It is time to properly end the processes we started and files we created.
+    # When using a shell - instead of directly calling the unlocking script -
+    # we also need to signal any SSH shell so that it is properly cleaned too.
+
+    # cleanup dropbear
+    if [ -f "${path_dropbear_pid}" ]; then
+      log_dbg "Stopping dropbear ..."
+      kill $(cat "${path_dropbear_pid}")
+      rm -f "${path_dropbear_pid}"
+    fi
+
+    if [ ${sshcs_opt_use_shell} -eq 1 ]; then
+      # Find and kill all shells spawned by SSH.
+      # This is necessary to properly terminate both these shells and the spawned
+      # SSH processes.
+      # Reminder: "... | ..." does fork a subshell
+      log_dbg "Searching SSH shells ..."
+      pgrep_output=$(pgrep /usr/bin/ash)
+      pgrep_output=$(echo "${pgrep_output}" | grep -E -v "^(|1|$$)$")
+      echo "${pgrep_output}" | while read pid; do
+        proc_parse_stat ${pid} || continue
+        proc_find_parent_cmd ${pid} "dropbear" || continue
+        log_dbg "Killing SSH shell pid=${pid}"
+        kill -SIGHUP ${pid}
+      done
+    fi
+
+    # cleanup /dev/pts if necessary
+    if [ ${dev_pts_mounted:-0} -ne 0 ]; then
+      umount "/dev/pts"
+      rm -R "/dev/pts"
+    fi
+
+    # stop the network before going on in boot sequence
+    sshcs_net_done
+
+    rm -f "${sshcs_cryptsetup_script}" "${sshcs_shell_script}" "/etc/passwd" "/etc/shells" "/var/log/lastlog"
+  elif [ ${sshcs_opt_use_shell} -eq 1 ]; then
+    # We are in a SSH shell session.
+
+    # Find and kill console shell.
+    # This is necessary so that our script launched from the init process can
+    # finally check that devices have been properly unlocked, properly end and
+    # let the init process end booting.
+    # Note: as a side effect, this will also kill the shell that was forked to
+    # trigger a timeout, which is fine (we want to kill it, either from here or
+    # from the init shell).
+    log_dbg "Searching console shells ..."
+    pgrep_output=$(pgrep /usr/bin/ash)
+    pgrep_output=$(echo "${pgrep_output}" | grep -E -v "^(|1|$$)$")
+    echo "${pgrep_output}" | while read pid; do
+      proc_find_parent_cmd ${pid} "dropbear" && continue
+      log_dbg "Killing console shell pid=${pid}"
+      kill -SIGHUP ${pid}
+    done
+  fi
+  # else: when in SSH shell script, we have nothing else to do other than exit.
+
+  log_dbg "All done"
+}
+
+sshcs_check_done() {
+  # Whether we are called from the main script: that is whether the shell will
+  # end when we return.
+  local finalize=$1
+
+  # This is always the main script when not using shell
+  [ ${sshcs_opt_use_shell} -eq 0 ] && finalize=1
+
+  # Reset timeout when applicable: only possible from init script.
+  proc_is_console && type sshcs_untrap_timeout > /dev/null 2>&1 && sshcs_untrap_timeout
+
+  # Check devices are unlocked.
+  sshcs_unlocked_test=1
+  sshcs_unlocked=1
+  . "${sshcs_cryptsetup_script}"
+  if [ ${sshcs_unlocked} -ne 1 ]; then
+    echo ""
+    # When finalizing in console, power off
+    if [ ${finalize} -eq 1 ] &&  proc_is_console; then
+      log_err "Devices are still locked! Powering off."
+      poweroff -f
+    fi
+
+    # When in shell or SSH, let user try again
+    log_err "Devices are still locked! Please retry."
+    return
+  fi
+
+  if [ ${finalize} -eq 0 ]; then
+    # Kill our parent (the interactive shell); the script that launched it will
+    # do finalization.
+    proc_parse_stat $$
+    kill -SIGHUP ${ppid}
+    exit 0
+  fi
+
+  echo ""
+  log_msg "cryptsetup succeeded! Boot sequence should go on."
+  proc_is_console || echo "Please wait and reconnect to nominal SSH service."
+
+  sshcs_cleanup
+}
+
+sshcs_env_load

src/install/ssh-cryptsetup

@@ -32,7 +32,7 @@ build() {
   local etc_crypttab="/etc/crypttab"
   local dropbear_authorized_keys="/etc/dropbear/initrd.authorized_keys"
   local sshcs_env="/etc/initcpio/sshcs_env"
-    local dropbear_key_types=( "dss" "rsa" "ecdsa" )
+  local dropbear_key_types=( "rsa" "ecdsa" "ed25519" )
   local dropbear_keyfile_prefix="/etc/dropbear/dropbear_"
   local dropbear_keyfile_suffix="_host_key"
   local openssh_keyfile_prefix="/etc/ssh/ssh_host_"
@@ -52,44 +52,70 @@ build() {
 
   sshcs_check_keys
 
-    add_checked_modules "/drivers/net/"
+  # Note: parts of this script (modules/binaries/files added) are the same than
-    add_module dm-crypt
+  # other install scripts (/usr/lib/initcpio/install/):
-    # Note: crypto modules are necessary
+  #   - 'encrypt': nominal support of encrypted volumes at boot time
-    if [ -n "${CRYPTO_MODULES}" ]; then
+  #   - 'net': network tools
+
+  ## Modules
+  # (from 'encrypt')
+  add_module 'dm-crypt'
+  add_module 'dm-integrity'
+  if [[ $CRYPTO_MODULES ]]; then
     local mod
-        for mod in ${CRYPTO_MODULES}; do
+    for mod in $CRYPTO_MODULES; do
-            add_module "${mod}"
+      add_module "$mod"
     done
   else
-        add_all_modules "/crypto/"
+    add_all_modules '/crypto/'
   fi
 
+  # (from 'net')
+  add_checked_modules '/drivers/net/'
+
+
+  ## Binaries
+  # (from 'encrypt')
+  add_binary 'cryptsetup'
+  # cryptsetup calls pthread_create(), which dlopen()s libgcc_s.so.1
+  # Note: at least necessary for LUKS v2 volumes.
+  # Also see similar/related bug reports (e.g. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=950254).
+  add_binary '/usr/lib/libgcc_s.so.1'
+
+  # (from 'net')
+  add_binary '/usr/lib/initcpio/ipconfig' '/bin/ipconfig'
+
+  # (ours)
   # Note: dmsetup is necessary for device mapper features
-    add_binary "cryptsetup"
+  add_binary 'dmsetup'
-    add_binary "dmsetup"
+  add_binary 'dropbear'
-    add_binary "dropbear"
+  add_binary 'ip'
-    add_binary "ip"
+  add_binary 'ethtool'
-    add_binary "/usr/lib/initcpio/ipconfig" "/sbin/ipconfig"
 
-    # Our hook files
+
+  ## Other files
+  # (from 'encrypt')
+  # cryptsetup-related files
+  map add_udev_rule \
+      '10-dm.rules' \
+      '13-dm-disk.rules' \
+      '95-dm-notify.rules'
+
+  # (ours)
+  # Our script and options
   [ -e "${sshcs_env}" ] && add_file "${sshcs_env}"
-
+  # Note: use /usr/local/bin, even though everything actually points to /usr/bin
-    # auth-related files
+  # in initramfs.
-    add_file "/lib/libnss_files.so"
+  add_file '/usr/lib/initcpio/hooks/ssh-cryptsetup-tools' '/usr/local/bin/ssh-cryptsetup-tools'
 
   # SSH-related files
-    add_file "${dropbear_authorized_keys}" "/root/.ssh/authorized_keys"
+  add_file "${dropbear_authorized_keys}" '/root/.ssh/authorized_keys'
-    add_file "/etc/dropbear/dropbear_rsa_host_key"
+  for keytype in "${dropbear_key_types[@]}"; do
-    add_file "/etc/dropbear/dropbear_dss_host_key"
+    add_file "${dropbear_keyfile_prefix}${keytype}${dropbear_keyfile_suffix}"
-    add_file "/etc/dropbear/dropbear_ecdsa_host_key"
+  done
 
-    # cryptsetup-related files
+  # crypt partitions
   add_file "${etc_crypttab}"
-    add_file "/usr/lib/udev/rules.d/10-dm.rules"
-    add_file "/usr/lib/udev/rules.d/13-dm-disk.rules"
-    add_file "/usr/lib/udev/rules.d/95-dm-notify.rules"
-    add_file "/usr/lib/initcpio/udev/11-dm-initramfs.rules" "/usr/lib/udev/rules.d/11-dm-initramfs.rules"
-
 
   add_runscript
 }
@@ -103,18 +129,11 @@ Network is configured with 'ip=' kernel parameter (see 'mkinitcpio-nfs-utils').
 Authorized SSH key(s) must be present in '/etc/dropbear/initrd.authorized_keys'.
 LUKS encrypted devices to unlock are derived from '/etc/crypttab', which must
 be present.
-Some options can be set in '/etc/initcpio/sshcs_env' (file is sourced in
+Some options can be set in '/etc/initcpio/sshcs_env'.
-initrd shell):
+See the README for more details.
- * 'sshcs_opt_timeout_ipconfig': time (s) to configure IP
-   - default: 10 seconds
- * 'sshcs_opt_listen': listening port (22 by default)
- * 'sshcs_opt_timeout_poweroff': time (s) to unlock devices before automatic
-   powering off
-   - default (and minimum value): 2 minutes
-   - negative value to deactivate
 
-Each SSH server key ('dropbear_rsa_host_key', 'dropbear_dss_host_key' and
+Each SSH server key ('dropbear_rsa_host_key', 'dropbear_ecdsa_host_key' and
-'dropbear_ecdsa_host_key' in '/etc/dropbear' folder) is imported from OpenSSH
+'dropbear_ed25519_host_key' in '/etc/dropbear' folder) is imported from OpenSSH
 if present or generated if missing. Fingerprints are displayed upon building
 the initramfs image.
 EOF