Your message dated Sat, 28 Apr 2007 21:02:02 +0000 with message-id <[EMAIL PROTECTED]> and subject line Bug#416528: fixed in cryptsetup 2:1.0.4+svn26-2 has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what I am talking about this indicates a serious mail system misconfiguration somewhere. Please contact me immediately.) Debian bug tracking system administrator (administrator, Debian Bugs database)
--- Begin Message ---Package: cryptsetup Version: 2:1.0.4+svn26-1 Severity: wishlist Tags: patch -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I've put together some scripts that work with cryptsetup and initramfs-tools that require a smartcard at boot to decrypt the key material for a dm-crypt volume. /lib/cryptsetup/scripts/decrypt_opensc: Waits for card reader to be attached and card inserted, then prompts for PIN and outputs the raw key material /etc/initramfs-tools/hooks/cryptopensc: Detects whether hooks/cryptroot has installed the decrypt_opensc script into the initramfs, and if so, installs additional binaries for reading smartcards at boot (binaries from pcscd and opensc pakcages). /etc/initramfs-tools/scripts/local-top/cryptopensc: Detects whether pcscd had been installed in the initramfs and starts this daemon. /etc/initramfs-tools/scripts/local-bottom/cryptopensc: Detects whether pcscd had been installed in the initramfs and stops this daemon. The following is an example /etc/crypttab: root /dev/md2 /boot/keys/root offset=2048,cipher=aes-cbc-essiv:sha256,size=256,hash=plain,check,keyscript=/lib/cryptsetup/scripts/decrypt_opensc The file /boot/keys/root contains the key material that has been encrypted with the RSA public key on the smart card. The following commands were used to create this file: $ dd if=/dev/random of=key_material bs=1 count=96 $ pkcs15-tool --read-public-key 45 --output public_key $ openssl rsautl -in key_material \ -pubin -inkey public_key \ -pkcs -out /boot/keys/root $ shred key_material The following pages have been very helpful in learning OpenSC in combination with dm-crypt: http://keitin.net/jarpatus/projects/usbtoken/index_fin.shtml http://www.saout.de/tikiwiki/tiki-index.php?page=RSAFirstSectorsMiniHOWTO Personally I created the private key with OpenSSL rather than let the card generate the key, this way I can store the same key on a backup smart card. Also I did not store the encrypted key in the first sectors of the disk, instead the key is read from an unencrypted /boot volume. Speaking of where to store the key, unfortunately LUKS cannot be used with the symmetric key stored on the smart card, however the following blog has some neat ideas about making that work: http://www.readingfordummies.com/blog/archives/2007/02/index.html Any feedback is welcome at Gerald Turner <[EMAIL PROTECTED]> - -- System Information: Debian Release: 4.0 APT prefers testing APT policy: (500, 'testing') Architecture: amd64 (x86_64) Shell: /bin/sh linked to /bin/bash Kernel: Linux 2.6.18-4-amd64 Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Versions of packages cryptsetup depends on: ii dmsetup 2:1.02.08-1 The Linux Kernel Device Mapper use ii libc6 2.3.6.ds1-13 GNU C Library: Shared libraries ii libdevma 2:1.02.08-1 The Linux Kernel Device Mapper use ii libgcryp 1.2.3-2 LGPL Crypto library - runtime libr ii libgpg-e 1.4-1 library for common error values an ii libpopt0 1.10-3 lib for parsing cmdline parameters ii libuuid1 1.39+1.40-WIP-2006.11.14+dfsg-2 universally unique id library cryptsetup recommends no packages. - -- no debconf information -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFGCrQMP6CBD/qM1tURAvHqAJ9gY7X7yiQ5XJVSN0A0r3JpA05uPwCfeVB0 Aft6p9xeVhTMu0T4OMCAB18= =s/zv -----END PGP SIGNATURE-----
cryptsetup-opensc.tar.gz
Description: Binary data
--- End Message ---
--- Begin Message ---Source: cryptsetup Source-Version: 2:1.0.4+svn26-2 We believe that the bug you reported is fixed in the latest version of cryptsetup, which is due to be installed in the Debian FTP archive: cryptsetup-udeb_1.0.4+svn26-2_amd64.udeb to pool/main/c/cryptsetup/cryptsetup-udeb_1.0.4+svn26-2_amd64.udeb cryptsetup_1.0.4+svn26-2.diff.gz to pool/main/c/cryptsetup/cryptsetup_1.0.4+svn26-2.diff.gz cryptsetup_1.0.4+svn26-2.dsc to pool/main/c/cryptsetup/cryptsetup_1.0.4+svn26-2.dsc cryptsetup_1.0.4+svn26-2_amd64.deb to pool/main/c/cryptsetup/cryptsetup_1.0.4+svn26-2_amd64.deb A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [EMAIL PROTECTED], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Jonas Meurer <[EMAIL PROTECTED]> (supplier of updated cryptsetup package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [EMAIL PROTECTED]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.7 Date: Sat, 28 Apr 2007 20:45:50 +0200 Source: cryptsetup Binary: cryptsetup cryptsetup-udeb Architecture: source amd64 Version: 2:1.0.4+svn26-2 Distribution: unstable Urgency: low Maintainer: Jonas Meurer <[EMAIL PROTECTED]> Changed-By: Jonas Meurer <[EMAIL PROTECTED]> Description: cryptsetup - configures encrypted block devices cryptsetup-udeb - configures encrypted block devices (udeb) Closes: 383808 397981 406837 410390 412064 414326 416528 420105 420399 Changes: cryptsetup (2:1.0.4+svn26-2) unstable; urgency=low . [ David Härdeman ] * Fix typo in crypttab(5), the ext checkscript is called ext2, not ext3. (closes: #410390) * Use the initramfs-tools keymap support instead of our own (requires initramfs-tools >= 0.87) * Add support for usplash password prompt (closes: #397981) * Remove the "ssl" and "gpg" options which are supported by keyscripts since October 2006 (see NEWS for details). * Spring cleaning of cryptdisks.functions, now supports multiple tries for keyscripts and uses lsb logging. (closes: #420105, #383808) . [ Jonas Meurer ] * Add 01_tries_fix.dpatch, makes the --tries commandline option work again. (closes: #414326, #412064) * Document the un_vol_id check script, remove the swap check script from documentation. The swap check indeed is rather useless, thanks to Frank Engler <[EMAIL PROTECTED]>. The script itself is kept for compability issues. (closes: #406837) * Add smartcard keyscript and initramfs-tools hooks/scripts. This adds support for disk encryption with smartcards, even for root disks. Thanks a lot to Gerald Turner <[EMAIL PROTECTED]> for the patch and a smartcard reader for testing this. (closes: #416528) * update copyright file: change "program" to "package", and mention GPL version 2. add a full disclaimer. * Add "--showkeys" to the dmsetup invocation in decrypt_derived script. (closes: #420399) * Fixes in cryptdisks.functions: - Don't suppress error messages at mount and unmount and don't break if 'mount $point' fails. - Fix handling of checks and prechecks, the vars somehow where mixed - Really use $CHECKARGS if it's defined - Rename "stopped" to "stopping" for devices which are shutdown at 'cryptdisks stop' (show a difference to already stopped devices). Files: cd4319dd4d3d86d60da595effc924597 831 admin optional cryptsetup_1.0.4+svn26-2.dsc 9b3a9d179d059a3f3d2b83e1eadea58b 45950 admin optional cryptsetup_1.0.4+svn26-2.diff.gz ca956b36045774b3ac59a9cf6cee99ed 265268 admin optional cryptsetup_1.0.4+svn26-2_amd64.deb f6dea6beeb15c3bb4935a7223b36dfda 184466 debian-installer optional cryptsetup-udeb_1.0.4+svn26-2_amd64.udeb Package-Type: udeb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFGM674d6lUs+JfIQIRAmBXAJ4sqVvj7Wf6h8VXgz1URirnLAHGhwCgiFgZ aKMjQcjMsNLenhqqO9iVFhM= =z5dB -----END PGP SIGNATURE-----
--- End Message ---
