v1.2-1

In previous Arch/kernel versions, the network device speed was
automatically set to the lowest possible upon poweroff when WoL was
enabled.

Latest versions do keep the network device to its standard speed (1000M
for example), which consumes some useless power when computer is powered
off and WoL enabled.

Force speed lowering for WoL.
But restore it before continuing boot, when devices are unlocked,
otherwise it remains as-is.

Make it an option, to select the wanted speed, or leave it as-is.

ChangeLog

@@ -1,75 +1,115 @@
+2026-07-12 Julien Coloos <julien.coloos [at] gmail [dot] com>
+
+        * v1.2-1
+        New option to log some messages to kmsg too.
+
+        Change network speed to 10M during boot, to reduce consumption upon WoL.
+
+
+2025-11-15 Julien Coloos <julien.coloos [at] gmail [dot] com>
+
+        * v1.1-2
+        Removed 11-dm-initramfs.rules, which was added to 10-dm.rules.
+        See: https://gitlab.archlinux.org/archlinux/mkinitcpio/mkinitcpio/-/commit/589e0397ea55e61a08fdbcab52ad4639d382f08e
+
+        Use full version (pkgver and pkgrel) for source archive name.
+        Sometimes we need to change the sources, but only for minor external
+        dependencies diff (e.g. adding/removing upstream source), in which
+        case we wish to only bump pkgrel.
+
+
+2022-03-24 Julien Coloos <julien.coloos [at] gmail [dot] com>
+
+        * v1.1-1
+        Refactored install script to more easily spot code coming from other
+        nominal hooks.
+        Updated install script message with latest available options.
+
+        Removed dependency to '/lib/libnss_files.so', as it does not exist and
+        should not be needed anymore.
+        Prevents unwanted warning when building initcpio
+          ==> ERROR: file not found: `/lib/libnss_files.so'
+        See: https://bugs.archlinux.org/task/73702
+
+
 2021-11-13 Julien Coloos <julien.coloos [at] gmail [dot] com>
 
         * v1.0-1
-        Option to use login shell instead of cryptsetup unlocking script
+        Option to use login shell instead of cryptsetup unlocking script.
-        Option to re-enable Wake-on-LAN on network device
+        Option to re-enable Wake-on-LAN on network device.
 
 
 2021-11-12 Julien Coloos <julien.coloos [at] gmail [dot] com>
 
         * v0.9-2
-        Use SHA256 checksums instead of MD5
+        Use SHA256 checksums instead of MD5.
 
 
 2021-10-24 Julien Coloos <julien.coloos [at] gmail [dot] com>
 
         * v0.9-1
-        Try to print network devices information when interface setup fails
+        Try to print network devices information when interface setup fails.
 
 
 2021-08-15 Julien Coloos <julien.coloos [at] gmail [dot] com>
 
         * v0.8-1
-        Include 'libgcc_s.so.1' which is necessary for (at least) proper LUKS v2 handling
+        Include 'libgcc_s.so.1' which is necessary for (at least) proper LUKS
+        v2 handling.
 
 
 2020-07-14 Julien Coloos <julien.coloos [at] gmail [dot] com>
 
         * v0.7-1
-        Dropped 'dsa' private key support; added 'ed25519' private key support
+        Dropped 'dsa' private key support; added 'ed25519' private key support.
 
 
 2018-03-13 Julien Coloos <julien.coloos [at] gmail [dot] com>
 
         * v0.6-1
-        Dropped '-m' option when calling dropbear (latest ArchLinux version does not handle it)
+        Dropped '-m' option when calling dropbear (latest ArchLinux version
+        does not handle it).
 
 
 2017-06-25 Julien Coloos <julien.coloos [at] gmail [dot] com>
 
         * v0.5-1
-        Fixed cryptsetup additional arguments handling: were not properly passed
+        Fixed cryptsetup additional arguments handling: were not properly
+        passed.
 
 
 2017-06-25 Julien Coloos <julien.coloos [at] gmail [dot] com>
 
         * v0.4-1
-        Fixed TRIM option handling in /etc/crypttab: 'discard' ('allow-discards' being the switch name to use in cryptsetup)
+        Fixed TRIM option handling in /etc/crypttab: 'discard'
+        ('allow-discards' being the switch name to use in cryptsetup).
 
 
 2015-11-22 Julien Coloos <julien.coloos [at] gmail [dot] com>
 
         * v0.3-1
-        Added configurable timeout for ipconfig
+        Added configurable timeout for ipconfig.
-        Moved configuration file from /etc/dropbear/initrd.env to /etc/initcpio/sshcs_env
+        Moved configuration file from /etc/dropbear/initrd.env to
+        /etc/initcpio/sshcs_env.
 
 
 2014-05-20 Julien Coloos <julien.coloos [at] gmail [dot] com>
 
         * v0.2-1
-        Removed unnecessary dependency: psmisc
+        Removed unnecessary dependency: psmisc.
-        Added configurable timeout to unlock devices before automatic poweroff
+        Added configurable timeout to unlock devices before automatic poweroff.
 
 
 2014-05-19 Julien Coloos <julien.coloos [at] gmail [dot] com>
 
         * v0.1-1
 
-        * Code adapted from dropbear_initrd_encrypt (https://aur.archlinux.org/packages/dropbear_initrd_encrypt/)
+        Code adapted from dropbear_initrd_encrypt.
-        Reworked code
+        See: https://aur.archlinux.org/packages/dropbear_initrd_encrypt/
-        Dropped non-LUKS support
-        Rely on /etc/crypttab
-        Handle multiple devices to unlock
-        Merged dropbear and encryptssh hooks
-        Better resources cleanup
 
+        Reworked code.
+        Dropped non-LUKS support.
+        Rely on /etc/crypttab.
+        Handle multiple devices to unlock.
+        Merged dropbear and encryptssh hooks.
+        Better resources cleanup.

PKGBUILD

@@ -1,6 +1,6 @@
 # Maintainer: Julien Coloos <julien.coloos [at] gmail [dot] com>
 pkgname=initrd-ssh-cryptsetup
-pkgver=1.0
+pkgver=1.2
 pkgrel=1
 pkgdesc="Allows to remotely unlock LUKS-encrypted devices over SSH"
 arch=('any')
@@ -9,8 +9,8 @@ license=('GPL3')
 depends=('dropbear' 'cryptsetup' 'mkinitcpio-nfs-utils' 'iproute2' 'ethtool')
 install=$pkgname.install
 changelog='ChangeLog'
-source=("http://julien.coloos.free.fr/archlinux/$pkgname-$pkgver.tar.xz" "$pkgname.install")
+source=("http://julien.coloos.free.fr/archlinux/$pkgname-$pkgver-$pkgrel.tar.xz" "$pkgname.install")
-sha256sums=('de6ef287ecfd57614835fec1fcaa01eb3a7f999d42a749e20b6747671320508f'
+sha256sums=('94156250bfc04490801d8575192a787363cf4637ade2473147d3f63924c5f814'
             'b84978b3c2ef32208c2b104ee2d3ce8aaec26da0bd4e9e1c83942f373bbf6285')
 
 package() {

README.md

@@ -4,26 +4,28 @@ The code was reworked from legacy dropbear_initrd_encrypt AUR package.
 
 ## Installation
 After cloning the repo, installation is done as for an AUR package, e.g.:
-
+```bash
 makepkg -sri
-
+```
 
 ## Dropbear
 SSH server key need to be generated for `dropbear`.  
 Either a new key can be generated with `dropbearkey`, e.g.:
-
+```bash
 dropbearkey -t ecdsa -f /etc/dropbear/dropbear_ecdsa_host_key
+```
 Or an existing OpenSSH key can be converted with `dropbearconvert` (useful so that the server fingerprint is the same with both), e.g.:
-
+```bash
 dropbearconvert openssh dropbear /etc/ssh/ssh_host_ecdsa_key /etc/dropbear/dropbear_ecdsa_host_key
+```
 Notes:
    * `rsa` and `ed25519` types are also handled
    * OpenSSH keys must be in `PEM` format for `dropbearconvert` to properly work
 
 If necessary an existing key file can be converted to `PEM` format using `ssh-keygen`:
-
+```bash
 ssh-keygen -A -p -m PEM -f /etc/ssh/ssh_host_ecdsa_key
-
+```
 
 ## Configuration
 As explained upon installation, the following things need to be done:
@@ -38,13 +40,24 @@ The LUKS-encrypted devices to unlock are derived from `/etc/crypttab`.
 
 
 Some options can be set in `/etc/initcpio/sshcs_env` (file is sourced in initramfs shell):
+   * `sshcs_opt_log_kmsg`: whether to log (debug, info, error) messages to kmsg too
+      - default: `1`
+      - many messages are only printed on console and are not concerned
+      - by default (debug disabled), only useful messages are concerned
+      - set `0` to disable
    * `sshcs_opt_debug`: whether to be more verbose about ongoing actions
       - default: `0`
       - any non-zero value to enable
    * `sshcs_opt_net_wol`: Wake-on-LAN option to set on network device
       - default: `g` (MagicPacket™)
-      - usually WOL is disabled once in initramfs shell
+      - usually WoL is disabled once in initramfs shell
-      - set empty to not change network device WOL setting
+      - set empty to not change network device WoL setting
+   * `sshcs_opt_net_speed`: speed to set on network device
+      - default: `10`
+      - full duplex is enabled, and auto-negociation disabled
+      - latest Arch/kernel tend to keep the speed at 1000M even during WoL
+      - this only applies to boot phase and persists for WoL: when unlocking devices, the network is reconfigured before the OS is fully ready
+      - set `0` to not change network device speed
    * `sshcs_opt_timeout_ipconfig`: time (in seconds) to configure IP
       - default: `10`
    * `sshcs_opt_listen`: SSH listening port
@@ -58,18 +71,18 @@ Some options can be set in `/etc/initcpio/sshcs_env` (file is sourced in initram
       - when disabled (the default), a script to unlock devices is executed instead
 
 For example:
-
+```bash
 sshcs_opt_timeout_ipconfig=30
 sshcs_opt_listen=2222
 sshcs_opt_timeout_poweroff=-1
 sshcs_opt_use_shell=1
-
+```
 
 ## Building notes
 1. Modify the sources (features in `src`, and/or package building files)
 2. If `src` was modified
-   * bump `pkgver` in `PKGBUILD`
+   * bump `pkgver`, or `pkgrel`, in `PKGBUILD`
-   * archive the `src` folder in `$pkgname-$pkgver.tar.xz` file; e.g.: `tar -cJf initrd-ssh-cryptsetup-$(grep "^pkgver=" PKGBUILD | cut -d'=' -f2).tar.xz src`
+   * archive the `src` folder in `$pkgname-$pkgver-$pkgrel.tar.xz` file; e.g.: `tar -cJf initrd-ssh-cryptsetup-$(grep "^pkgver=" PKGBUILD | cut -d'=' -f2)-$(grep "^pkgrel=" PKGBUILD | cut -d'=' -f2).tar.xz src`
    * upload the archive on the online repository (pointed by `PKGBUILD`)
 3. Update ChangeLog
 4. Update `PKGBUILD`

src/hooks/ssh-cryptsetup

@@ -8,18 +8,20 @@ sshcs_net_start() {
   # we must have an 'ip' setting, and a device in it
   [ -z "${ip}" ] && [ -n "${nfsaddrs}" ] && ip="${nfsaddrs}"
   [ -z "${ip}" ] && {
-    dbg "No ip setting to setup network"
+    log_dbg "No ip setting to setup network"
     return 1
   }
 
   net_device=$(echo ${ip} | cut -d: -f6)
   [ -z "${net_device}" ] && {
-    dbg "No network device to setup"
+    log_dbg "No network device to setup"
     return 1
   }
 
+  # Note: ethtool can access WoL settings right now, but not other settings
+  # until the network is setup.
   if [ "${sshcs_opt_net_wol:-d}" != "d" ]; then
-    dbg "Setting network device=${net_device} wol=${sshcs_opt_net_wol}"
+    log_dbg "Setting network device=${net_device} wol=${sshcs_opt_net_wol}"
     ethtool -s "${net_device}" wol "${sshcs_opt_net_wol}"
   fi
 
@@ -35,7 +37,7 @@ sshcs_net_start() {
   # ipconfig manual: https://git.kernel.org/pub/scm/libs/klibc/klibc.git/tree/usr/kinit/ipconfig/README.ipconfig
   ipconfig_out=$(ipconfig -t "${sshcs_opt_timeout_ipconfig}" "ip=${ip}")
   if [ $? -ne 0 ]; then
-    err "IP configuration timeout!"
+    log_err "IP configuration timeout!"
     echo "Devices probing:"
     ipconfig -n -t 5 -c none all
     return 1
@@ -58,22 +60,31 @@ sshcs_net_start() {
   . "${net_env}"
   rm -f "${net_env}"
 
-  echo "IP-Config: device=${net_device} ip=${net_address}/${net_netmask} gw=${net_gateway} dns0=${net_dns0} dns1=${net_dns1}"
+  log_msg "IP-Config: device=${net_device} ip=${net_address}/${net_netmask} gw=${net_gateway} dns0=${net_dns0} dns1=${net_dns1}"
 
-  [ -n "${net_address}" ]
+  # Ensure we have an address
+  [ -n "${net_address}" ] || return 1
+
+  # Note: We cannot change the device settings, other than WoL, before the
+  # network is setup.
+  if [ ${sshcs_opt_net_speed} != 0 ]; then
+    log_dbg "Setting network device=${net_device} speed=${sshcs_opt_net_speed}"
+    ethtool -s "${net_device}" speed "${sshcs_opt_net_speed}" duplex full autoneg off
+  fi
 }
 
 sshcs_net_done() {
   # we are done with the network
   if [ -n "${net_device}" ]; then
-    dbg "Setting network device=${net_device} down"
+    log_dbg "Setting network device=${net_device} down"
     ip addr flush dev "${net_device}"
     ip link set dev "${net_device}" down
   fi
 }
 
 sshcs_trapped_timeout() {
-  err "Timeout reached! Powering off."
+  log_err "Timeout reached! Powering off."
+  sleep 2
   poweroff -f
   exit
 }
@@ -87,9 +98,11 @@ sshcs_trap_timeout() {
     echo "To deactivate, please unlock devices"
     trap sshcs_trapped_timeout SIGALRM
     (
+      # Wait for timeout
       sleep ${sshcs_opt_timeout_poweroff}
+      # Signal process (triggers poweroff)
       kill -SIGALRM ${pid_init}
-      # Signal is not processed if cryptsetup is waiting for the password
+      # Note: signal is not processed if cryptsetup is waiting for the password
       killall cryptsetup > /dev/null 2>&1
     ) &
     pid_timeout=$!
@@ -97,7 +110,7 @@ sshcs_trap_timeout() {
 }
 
 sshcs_untrap_timeout() {
-  [ -z "${pid_timeout}" ] && return 0
+  [ -z "${pid_timeout:-}" ] && return 0
   # Notes:
   # If there was a running SSH shell, it may also try to kill it.
   # This only kills the spawned subshell, leaving the 'sleep' command still
@@ -105,7 +118,7 @@ sshcs_untrap_timeout() {
   proc_parse_stat ${pid_timeout} && kill ${pid_timeout}
   pid_timeout=
   trap - SIGALRM
-  msg "Timeout cleared."
+  log_dbg "Timeout cleared."
 }
 
 sshcs_shell_run() {
@@ -113,11 +126,17 @@ sshcs_shell_run() {
 
   # actual script (shared with SSH login) with which we can unlock devices
   sshcs_unlocked_test=0
+  log_dbg "Running ${sshcs_shell_script}"
+  # Belt and suspenders: if the script does not exist, trying to source it
+  # actually triggers a kernel panic.
+  if [ ! -e "${sshcs_shell_script}" ]; then
+    log_err "No script to run! ${sshcs_shell_script} does not exist!"
+    return
+  fi
   . "${sshcs_shell_script}"
 }
 
 sshcs_dropbear_run() {
-  local pid_timeout=
   local dev_pts_mounted=0
   local listen=
 
@@ -128,26 +147,6 @@ sshcs_dropbear_run() {
     dev_pts_mounted=1
   fi
 
-  if [ ${sshcs_opt_use_shell} -eq 0 ]; then
-    sshcs_shell_script=${sshcs_cryptsetup_script}
-  else
-    cat <<EOF > "${sshcs_shell_script}"
-#!/usr/bin/ash
-
-. "/usr/local/bin/ssh-cryptsetup-tools"
-
-echo ""
-echo "Call ${sshcs_cryptsetup_script} to try unlocking device(s)"
-
-# Now give the user its shell
-/usr/bin/ash
-
-# Check whether we are fully done
-sshcs_check_done 1
-EOF
-    chmod a+x "${sshcs_shell_script}"
-  fi
-
   # /etc/passwd file for the root user
   echo "root:x:0:0:root:/root:${sshcs_shell_script}" > "/etc/passwd"
   echo "${sshcs_shell_script}" > "/etc/shells"
@@ -155,7 +154,7 @@ EOF
   [ ! -d "/var/log" ] && mkdir -p "/var/log"
   touch "/var/log/lastlog"
 
-  msg "Starting dropbear ..."
+  log_dbg "Starting dropbear ..."
   dropbear -Esgjk -P "${path_dropbear_pid}" ${sshcs_opt_listen}
 
   # Actual unlocking shell
@@ -190,7 +189,7 @@ sshcs_cryptpart_process() {
   cryptdev_orig=${cryptdev}
   if cryptdev=$(resolve_device "${cryptdev_orig}" ${rootdelay}); then
     if cryptsetup isLuks "${cryptdev}" >/dev/null 2>&1; then
-      dbg "Adding crypt device=${cryptdev} type=${crypttype} name=${cryptname} args=<${cryptargs}> in setup script"
+      log_dbg "Adding crypt device=${cryptdev} type=${crypttype} name=${cryptname} args=<${cryptargs}> in setup script"
 
       # update script used to unlock device either in console or SSH
       [ -s "${sshcs_cryptsetup_script}" ] || cat <<'EOF' > "${sshcs_cryptsetup_script}"
@@ -222,9 +221,9 @@ EOF
         killall cryptsetup > /dev/null 2>&1
         break
       fi
-      err "Device still not mapped! Please wait or retry."
+      log_err "Device still not mapped! Please wait or retry."
     elif [ ! -e "/dev/mapper/${cryptname}" ]; then
-      err "cryptsetup failed! Please retry."
+      log_err "cryptsetup failed! Please retry."
     else
       break
     fi
@@ -233,7 +232,7 @@ EOF
   done
 EOF
     else
-      err "Failed to manage encrypted device ${cryptdev_orig}: not a LUKS volume."
+      log_err "Failed to manage encrypted device ${cryptdev_orig}: not a LUKS volume."
     fi
   fi
 }
@@ -241,6 +240,11 @@ EOF
 sshcs_cryptpart_setup() {
   local cryptdev crypttype cryptname cryptpass cryptoptions
 
+  # Notes:
+  # The script is built piece by piece to unlock each target device.
+  # If there is no device to unlock, there is no script, and boot should simply
+  # go on as usual.
+
   # check encrypted devices to handle
   cryptdev=
   crypttype=luks
@@ -256,6 +260,8 @@ sshcs_cryptpart_setup() {
   # Nothing else to do if there is no device we can unlock
   [ -s "${sshcs_cryptsetup_script}" ] || return 0
 
+  # There were deviced to unlock.
+  # We can now finish the script.
   cat <<'EOF' >> "${sshcs_cryptsetup_script}"
   # No other device to unlock
 }
@@ -272,10 +278,32 @@ else
     return
   fi
   echo ""
-  err "Device resources missing! Please retry."
+  log_err "Device resources missing! Please retry."
 fi
 EOF
   chmod a+x "${sshcs_cryptsetup_script}"
+
+  if [ ${sshcs_opt_use_shell} -eq 0 ]; then
+    # The script we built *is* the shell to run.
+    sshcs_shell_script=${sshcs_cryptsetup_script}
+  else
+    # User will have a full shell, and can call the script if needed.
+    cat <<EOF > "${sshcs_shell_script}"
+#!/usr/bin/ash
+
+. "/usr/local/bin/ssh-cryptsetup-tools"
+
+echo ""
+echo "Call ${sshcs_cryptsetup_script} to try unlocking device(s)"
+
+# Now give the user its shell
+/usr/bin/ash
+
+# Check whether we are fully done
+sshcs_check_done 1
+EOF
+    chmod a+x "${sshcs_shell_script}"
+  fi
 }
 
 run_hook() {
@@ -290,7 +318,7 @@ run_hook() {
 
   # sanity check: crypttab should be present
   [ ! -e "${etc_crypttab}" ] && {
-    dbg "No crypttab configuration to process"
+    log_dbg "No crypttab configuration to process"
     return 0
   }
 
@@ -307,13 +335,13 @@ run_hook() {
   # Setup script used to unlock device either in console or SSH
   sshcs_cryptpart_setup
   if [ ! -e "${sshcs_cryptsetup_script}" ]; then
-    err "No encrypted device found! Skipping crypt remote unlocking."
+    log_err "No encrypted device found! Skipping crypt remote unlocking."
     return 0
   fi
 
   # start and check network
   if ! sshcs_net_start; then
-    err "Net interface not available! Skipping crypt remote unlocking."
+    log_err "Net interface not available! Skipping crypt remote unlocking."
     # We still allow to unlock locally with timeout
     sshcs_shell_run
     return 0

src/hooks/ssh-cryptsetup-tools

@@ -2,15 +2,38 @@
 
 . "/init_functions"
 
-dbg () {
+# Log debug message, if debug enabled.
-  [ ${sshcs_opt_debug} != 0 ] && echo "$@"
+# Also log as kmsg if enabled.
+log_dbg() {
+  [ ${sshcs_opt_debug} -eq 0 ] && return 0
+  echo "$@"
+  [ ${sshcs_opt_log_kmsg} -eq 0 ] && return 0
+  echo "<31>sshcs: $@" > /dev/kmsg
+}
+
+# Log information message, even if quiet.
+# Also log as kmsg if enabled.
+log_msg() {
+  echo "$@"
+  [ ${sshcs_opt_log_kmsg} -eq 0 ] && return 0
+  echo "<30>sshcs: $@" > /dev/kmsg
+}
+
+# Log error message (prefixed with "ERROR: " in console).
+# Also log as kmsg if enabled.
+log_err() {
+  err "$@"
+  [ ${sshcs_opt_log_kmsg} -eq 0 ] && return 0
+  echo "<27>sshcs: $@" > /dev/kmsg
 }
 
 sshcs_env_load() {
   local sshcs_env="/etc/initcpio/sshcs_env"
 
+  local log_kmsg_default=1
   local debug_default=0
   local net_wol_default=g
+  local net_speed_default=10
   local timeout_ipconfig_default=10
   local timeout_poweroff_min=120
   local use_shell_default=0
@@ -18,8 +41,10 @@ sshcs_env_load() {
   [ ${sshcs_env_loaded:-0} -eq 1 ] && return
   [ -e "${sshcs_env}" ] && . "${sshcs_env}"
   sshcs_env_loaded=1
+  [ -z "${sshcs_opt_log_kmsg}" ] && sshcs_opt_log_kmsg=${log_kmsg_default}
   [ -z "${sshcs_opt_debug}" ] && sshcs_opt_debug=${debug_default}
   [ -z "${sshcs_opt_net_wol}" ] && sshcs_opt_net_wol=${net_wol_default}
+  [ -z "${sshcs_opt_net_speed}" ] && sshcs_opt_net_speed=${net_speed_default}
   [ -z "${sshcs_opt_timeout_ipconfig}" ] && sshcs_opt_timeout_ipconfig=${timeout_ipconfig_default}
   [ -n "${sshcs_opt_listen}" ] && sshcs_opt_listen="-p ${sshcs_opt_listen}"
   [ -z "${sshcs_opt_timeout_poweroff}" ] && sshcs_opt_timeout_poweroff=${timeout_poweroff_min}
@@ -81,6 +106,12 @@ sshcs_cleanup() {
   # Thus as long as all devices have been unlocked, we don't expect any script
   # to be stuck on 'cryptsetup' calls.
 
+  # If we did change the network speed, time to reset it.
+  if [ -n "${net_device}" ] && [ ${sshcs_opt_net_speed} != 0 ]; then
+    log_dbg "Restoring network device=${net_device} speed"
+    ethtool -s "${net_device}" autoneg on
+  fi
+
   if proc_is_console; then
     # We are in the console.
     # It is time to properly end the processes we started and files we created.
@@ -89,7 +120,7 @@ sshcs_cleanup() {
 
     # cleanup dropbear
     if [ -f "${path_dropbear_pid}" ]; then
-      msg "Stopping dropbear ..."
+      log_dbg "Stopping dropbear ..."
       kill $(cat "${path_dropbear_pid}")
       rm -f "${path_dropbear_pid}"
     fi
@@ -99,19 +130,19 @@ sshcs_cleanup() {
       # This is necessary to properly terminate both these shells and the spawned
       # SSH processes.
       # Reminder: "... | ..." does fork a subshell
-      dbg "Searching SSH shells ..."
+      log_dbg "Searching SSH shells ..."
       pgrep_output=$(pgrep /usr/bin/ash)
       pgrep_output=$(echo "${pgrep_output}" | grep -E -v "^(|1|$$)$")
       echo "${pgrep_output}" | while read pid; do
         proc_parse_stat ${pid} || continue
         proc_find_parent_cmd ${pid} "dropbear" || continue
-        dbg "Killing SSH shell pid=${pid}"
+        log_dbg "Killing SSH shell pid=${pid}"
         kill -SIGHUP ${pid}
       done
     fi
 
     # cleanup /dev/pts if necessary
-    if [ ${dev_pts_mounted} -ne 0 ]; then
+    if [ ${dev_pts_mounted:-0} -ne 0 ]; then
       umount "/dev/pts"
       rm -R "/dev/pts"
     fi
@@ -130,16 +161,18 @@ sshcs_cleanup() {
     # Note: as a side effect, this will also kill the shell that was forked to
     # trigger a timeout, which is fine (we want to kill it, either from here or
     # from the init shell).
-    dbg "Searching console shells ..."
+    log_dbg "Searching console shells ..."
     pgrep_output=$(pgrep /usr/bin/ash)
     pgrep_output=$(echo "${pgrep_output}" | grep -E -v "^(|1|$$)$")
     echo "${pgrep_output}" | while read pid; do
       proc_find_parent_cmd ${pid} "dropbear" && continue
-      dbg "Killing console shell pid=${pid}"
+      log_dbg "Killing console shell pid=${pid}"
       kill -SIGHUP ${pid}
     done
   fi
   # else: when in SSH shell script, we have nothing else to do other than exit.
+
+  log_dbg "All done"
 }
 
 sshcs_check_done() {
@@ -161,12 +194,12 @@ sshcs_check_done() {
     echo ""
     # When finalizing in console, power off
     if [ ${finalize} -eq 1 ] &&  proc_is_console; then
-      err "Devices are still locked! Powering off."
+      log_err "Devices are still locked! Powering off."
       poweroff -f
     fi
 
     # When in shell or SSH, let user try again
-    err "Devices are still locked! Please retry."
+    log_err "Devices are still locked! Please retry."
     return
   fi
 
@@ -179,7 +212,7 @@ sshcs_check_done() {
   fi
 
   echo ""
-  echo "cryptsetup succeeded! Boot sequence should go on."
+  log_msg "cryptsetup succeeded! Boot sequence should go on."
   proc_is_console || echo "Please wait and reconnect to nominal SSH service."
 
   sshcs_cleanup

src/install/ssh-cryptsetup

@@ -52,56 +52,70 @@ build() {
 
   sshcs_check_keys
 
-  add_checked_modules "/drivers/net/"
+  # Note: parts of this script (modules/binaries/files added) are the same than
-  # Note: parts of this script (modules/binaries added) are the same than the
+  # other install scripts (/usr/lib/initcpio/install/):
-  # 'encrypt' install script (/usr/lib/initcpio/install/encrypt) which is the
+  #   - 'encrypt': nominal support of encrypted volumes at boot time
-  # nominal one to deal with encrypted volumes at boot time.
+  #   - 'net': network tools
-  add_module dm-crypt
+
-  # Note: crypto modules are necessary
+  ## Modules
-  if [ -n "${CRYPTO_MODULES}" ]; then
+  # (from 'encrypt')
+  add_module 'dm-crypt'
+  add_module 'dm-integrity'
+  if [[ $CRYPTO_MODULES ]]; then
     local mod
-    for mod in ${CRYPTO_MODULES}; do
+    for mod in $CRYPTO_MODULES; do
-      add_module "${mod}"
+      add_module "$mod"
     done
   else
-    add_all_modules "/crypto/"
+    add_all_modules '/crypto/'
   fi
 
-  # Note: dmsetup is necessary for device mapper features
+  # (from 'net')
-  add_binary "cryptsetup"
+  add_checked_modules '/drivers/net/'
-  add_binary "dmsetup"
-  add_binary "dropbear"
-  add_binary "ip"
-  add_binary "/usr/lib/initcpio/ipconfig" "/bin/ipconfig"
-  add_binary "ethtool"
 
-  # Our hook files
+
+  ## Binaries
+  # (from 'encrypt')
+  add_binary 'cryptsetup'
+  # cryptsetup calls pthread_create(), which dlopen()s libgcc_s.so.1
+  # Note: at least necessary for LUKS v2 volumes.
+  # Also see similar/related bug reports (e.g. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=950254).
+  add_binary '/usr/lib/libgcc_s.so.1'
+
+  # (from 'net')
+  add_binary '/usr/lib/initcpio/ipconfig' '/bin/ipconfig'
+
+  # (ours)
+  # Note: dmsetup is necessary for device mapper features
+  add_binary 'dmsetup'
+  add_binary 'dropbear'
+  add_binary 'ip'
+  add_binary 'ethtool'
+
+
+  ## Other files
+  # (from 'encrypt')
+  # cryptsetup-related files
+  map add_udev_rule \
+      '10-dm.rules' \
+      '13-dm-disk.rules' \
+      '95-dm-notify.rules'
+
+  # (ours)
+  # Our script and options
   [ -e "${sshcs_env}" ] && add_file "${sshcs_env}"
   # Note: use /usr/local/bin, even though everything actually points to /usr/bin
   # in initramfs.
-  add_file "/usr/lib/initcpio/hooks/ssh-cryptsetup-tools" "/usr/local/bin/ssh-cryptsetup-tools"
+  add_file '/usr/lib/initcpio/hooks/ssh-cryptsetup-tools' '/usr/local/bin/ssh-cryptsetup-tools'
-
-  # auth-related files
-  add_file "/lib/libnss_files.so"
 
   # SSH-related files
-  add_file "${dropbear_authorized_keys}" "/root/.ssh/authorized_keys"
+  add_file "${dropbear_authorized_keys}" '/root/.ssh/authorized_keys'
   for keytype in "${dropbear_key_types[@]}"; do
     add_file "${dropbear_keyfile_prefix}${keytype}${dropbear_keyfile_suffix}"
   done
 
-  # cryptsetup-related files
+  # crypt partitions
   add_file "${etc_crypttab}"
-  add_file "/usr/lib/udev/rules.d/10-dm.rules"
-  add_file "/usr/lib/udev/rules.d/13-dm-disk.rules"
-  add_file "/usr/lib/udev/rules.d/95-dm-notify.rules"
-  add_file "/usr/lib/initcpio/udev/11-dm-initramfs.rules" "/usr/lib/udev/rules.d/11-dm-initramfs.rules"
-
-  # At least with LUKS v2 volumes, cryptsetup calls pthread_cancel(), which
-  # dlopen()s libgcc_s.so.1.
-  # See the nominal 'encrypt' module, and similar/related bug reports (e.g.
-  # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=950254).
-  add_binary "/usr/lib/libgcc_s.so.1"
 
   add_runscript
 }
@@ -115,15 +129,8 @@ Network is configured with 'ip=' kernel parameter (see 'mkinitcpio-nfs-utils').
 Authorized SSH key(s) must be present in '/etc/dropbear/initrd.authorized_keys'.
 LUKS encrypted devices to unlock are derived from '/etc/crypttab', which must
 be present.
-Some options can be set in '/etc/initcpio/sshcs_env' (file is sourced in
+Some options can be set in '/etc/initcpio/sshcs_env'.
-initrd shell):
+See the README for more details.
- * 'sshcs_opt_timeout_ipconfig': time (s) to configure IP
-   - default: 10 seconds
- * 'sshcs_opt_listen': listening port (22 by default)
- * 'sshcs_opt_timeout_poweroff': time (s) to unlock devices before automatic
-   powering off
-   - default (and minimum value): 2 minutes
-   - negative value to deactivate
 
 Each SSH server key ('dropbear_rsa_host_key', 'dropbear_ecdsa_host_key' and
 'dropbear_ed25519_host_key' in '/etc/dropbear' folder) is imported from OpenSSH