I'm currently running Unraid 7 with 3 array drives and 2 cache drives. I have enabled LUKS + password and I'm pretty happy with it. I now want to:

* Backup the LUKS encryption headers with the `cryptsetup luksHeaderBackup` command

* Add a keyfile so that I can decrypt the array with password or file

* Ultimately follow this guide on auto decrypting the array https://weirdion.github.io/posts/automating-unraid-array-decryption/

 

I'm struggling on the first step, trying to find the logical LUKS devices. I've run `cryptsetup luksDump` on a few drives in /dev as well as /dev/disk/ and can't seem to find any valid LUKS device.

 

Can anyone help me out?

15 minutes ago, acid2000 said:

I've run `cryptsetup luksDump` on a few drives in /dev as well as /dev/disk/ and can't seem to find any valid LUKS device.

Note that if the array is running, the sdX device won't be available, also note that you need to specify the partition, so with the array stopped you can use

 

cryptsetup luksDump /dev/sdX1

Replace X with the correct letter, note the 1 in the end

 

with the array running

 

cryptsetup luksDump /dev/md#p1 

replace # with disk number

Great, I've been able to find a LUKS header on /dev/md1p1 which I've backed up. I do have some other questions before I start adding keys though as I don't want to screw this up.

 

I have another device, /dev/md2p1 which is mounted at /mnt/disk2. This looks like it may be the second drive in my array. This doesn't have a LUKS header and I was kinda expecting it to. It my head I'm expecting to find at least two LUKS headers, one for my array and the other on my cache.

 

Is this not the case? Is there only one LUKS drive for all my disks?

52 minutes ago, acid2000 said:

This doesn't have a LUKS header

It should have if it's also encrypted, post a screenshot from Main.

Great catch, the second drive in my array wasn't encrypted. Luckily it was empty, formatted it and now I can confirm the following devices have LUKS headers:

* cache drive - /dev/nvme0n1p1

* cache drive - /dev/nvme1n1p1

* array drive - /dev/md1p1

* array drive - /dev/md2p1

 

Is it now as simple as adding a new key to each of those drives?

1 hour ago, acid2000 said:

Is it now as simple as adding a new key to each of those drives?

Not sure I follow, Unraid uses the same key for all encrypted devices.

So i should add my new key to all encrypted devices?

I'm still not understanding, what new key? The encryption key/passphrase is set in the GUI.

I want to use a passphrase and a key. The link here has reasons why https://weirdion.github.io/posts/automating-unraid-array-decryption/

Cannot help with that, I don't use encryption, maybe someone else can.

I am curious about this as well.

I am running an encrypted array and set it up with a passphrase, but would like to add a keyfile as well now. LUKS typically has a keyfile or passphrase for each drive you encrypt, makes sense. When you want to add another passphrase or keyfile on the drive, you simply use luksAddKey via terminal.

However, because unRAID uses the one passphrase for all the drives in your encrypted array (you don't make a new one each time you add a new encrypted drive); When you unlock the array upon boot, the one passphrase unlocks all drives at once (not sure if unraid just runs LUKS encryption and uses existing passphrase in backend)

To add a keyfile to one of the remaining keyslots on the headers (0 being used by my passphrase), I can use luksAddKey, BUT when I do this do I simply point the command to the same keyfile for each drive? That is, do I:

1. make the random keyfile

2. iterate through each drive in my array runningcryptsetup luksAddKey command via terminal pointing to the same keyfile each time?

3. will this keyfile now unlock the entire array at once after a boot?

P.S. @acid2000 I did some work and understand LUKS backup and restore and shared it here https://forums.unraid.net/topic/198159-a-walkthrough-my-luks-header-backup-corruption-and-restore/

Edited April 14Apr 14 by mikescott
clarification