Swap and Encfs mounting on Startup in Ubuntu

I use Ubuntu 14.04 on my laptop and I have a somewhat unique setup, whereby I use DRBD and encfs to mirror and secure my data as I understand that when SSD drives fail they tend to do so catastrophically and without warning.   I thus have a rather complex boot process.

I spent the morning tidying up the boot process so it looks professional (* which is not to say that this is the professional or best way to do it – but it works)

I discovered there is a dearth of information on the kinds of things I want to do, but needed to become familiar with the following –

Plymouth – The fancy boot screen that Ubuntu throws up when it boots – thats run by plymouthd. It is possible to interact with plymouthd by using plymouth.  Your mileage may vary, but i discovered that when plymouthd is running it has a pid file in /dev/.initramfs/plymouth.pid – so by checking for that file I can request the passphrase using plymouth or a command prompt as appropriate.

encfs – Using the -S switch allows the command prompt to be read from stdin. rc.local – I run this entire script from rc.local – because its easy enough to do, and happens automatically and before plymouth exits.

The script is as follows:

#! /bin/bash
ifconfig eth0 my.internal.ip
/etc/init.d/drbd start
/bin/mount /dev/drbd0 /media/drbd0

if [ -f "/dev/.initramfs/plymouth.pid" ]
then
        /bin/plymouth ask-for-password --prompt "Passphrase: " | /usr/bin/encfs /media/drbd0/ /data/ssd --public -S -o nonempty
else
        /usr/bin/encfs /media/drbd0/ /data/ssd --public -o nonempty
fi

while [ $? -ne 0 ]
do
        if [ -f "/dev/.initramfs/plymouth.pid" ]
        then
                /bin/plymouth ask-for-password --prompt "Passphrase was not accepted.  Please enter Passphrase: " | /usr/bin/encfs /media/drbd0/ /data/ssd --public -S -o nonempty
        else
                echo "Incorrect Password"
                /usr/bin/encfs /media/drbd0/ /data/ssd --public -o nonempty
        fi
done

# We have all sorts of problems if /tmp is not mounted before X
# but we want to ensure its encrypted !!

#echo "Note: We destroy /tmp on restart as good Linux systems do, but "
#echo "there is a backup of the last boot at /data/ssd/tmp-old"

echo "Stopping services that need /tmp or a network and fixing these"
/etc/init.d/openvpn stop
/etc/init.d/ssh stop

rm -r /data/ssd/tmp-old
mv /data/ssd/tmp /data/ssd/tmp-old
mkdir /data/ssd/tmp
chmod 777 /data/ssd/tmp
rm -r /tmp
ln -s /data/ssd/tmp /tmp

dhclient eth0 &

echo "Restarting services that need /tmp  or a network"
/etc/init.d/ssh start
/etc/init.d/openvpn start

/usr/sbin/lxdm

In addition I did the following:

Stopped display managers from starting under system control on boot. This is a bit weird because they exist in /etc/init, rather then /etc/init.d where I would have expected. Anyway, I moved gdm.conf, lightdm.conf and lxdm.conf out of /etc/init (and into a new directory called /etc/notinit which I created).

I also took steps to encrypt the swap space on startup.  This does not appear to be well documented, but is quite easy.  Simply make the following modifications to

/etc/crypttab  (Create it if it does not exist)

swap /dev/mapper/ubuntu--vg-swap_1	/dev/urandom swap,cipher=aes-cbc-essiv:sha256

This line creates “/dev/mapper/swap” using the backing device “/dev/mapper/ubuntu–vg-swap_1”, along with a random password it creates on the fly

and /etc/fstab

/dev/mapper/swap none            swap    sw              0       0

Which mounts /dev/mapper/swap  (Remember to comment out the old swap)

If you look through my rc.local script, you will see I jump through all kinds of hoops to move /tmp into encrypted space after startup.  An easy alternative might be to do something similar for /tmp as I did for /swap above – the downside being that it requires a fixed amount of diskspace which is carved out of my ssd.

Its worth noting that all sorts of wonderfully weird and non-obvious failures occur if /tmp is not mounted and readable by all (including X window managers crashing and issues with sound).  /tmp really needs to be useable BEFORE X is loaded.