getting KVM finnix kernel to work with LUKS disk encryption
It seems required crypto API's are either not compiled into the finnix KVM kernel, or module loading does not work.
Example session:
# cryptsetup luksFormat -v /dev/sdc3
WARNING!
========
This will overwrite data on /dev/sdc3 irrevocably.
Are you sure? (Type uppercase yes): YES
Enter passphrase:
Verify passphrase:
device-mapper: reload ioctl on failed: No such file or directory
Failed to open temporary keystore device.
device-mapper: remove ioctl on temporary-cryptsetup-3692 failed: No such device or address
device-mapper: reload ioctl on temporary-cryptsetup-3692 failed: No such device or address
device-mapper: remove ioctl on temporary-cryptsetup-3692 failed: No such device or address
device-mapper: remove ioctl on temporary-cryptsetup-3692 failed: No such device or address
device-mapper: remove ioctl on temporary-cryptsetup-3692 failed: No such device or address
device-mapper: remove ioctl on temporary-cryptsetup-3692 failed: No such device or address
Command failed with code 5: Input/output error
Also, the kernel modules directory seem to be mismatched to the finnix KVM kernel:
Linux finnix 3.16.1-kvmnode #1 SMP Mon Apr 27 15:07:17 EDT 2015 x86_64 GNU/Linux
# ls -l /lib/modules/
total 0
drwxr-xr-x 1 root root 220 Jun 17 10:13 3.10.0-1-amd64-finnix
drwxr-xr-x 1 root root 380 Sep 15 2013 3.10.0-1-x86-finnix
# modprobe dm_crypt
libkmod: ERROR ../libkmod/libkmod.c:554 kmod_search_moddep: could not open moddep file '/lib/modules/3.16.1-kvmnode/modules.dep.bin'
5 Replies
Looks like finnix in KVM has the wrong modules under /lib/modules and they don't match the current kernel.
I have the LUKS setup myself so I don't want to take the risk in moving to KVM if I can't fix any issues in finnix.
There's a workaround (if you don't have the disk allocated to 100%), just deploy a debian/ubuntu imate in a 1GB disk and boot from there (apt-get install cryptsetup-bin of course after initial boot).
caker
Linode Staff
Up next (within a few days), is an updated Finnix image, and kernel - which we will make sure has all of the needful.
Thanks,
-Chris
@tcpdump:
There's a workaround (if you don't have the disk allocated to 100%), just deploy a debian/ubuntu imate in a 1GB disk and boot from there (apt-get install cryptsetup-bin of course after initial boot).
That's what i did for a new instance, and I wrote a memo to myself to never fully allocate the diskspace in the future, to be flexible in situations such as this
@caker:
Ignore the modules - they are not used, anyhow.
Yes, i figured that most of the stuff was compiled into the kernel. Looking forward to the new finnix release!
Thanks for the quick reply!
Should I go back to Xen?
Thanks.