7.2. 挂载加密卷

If you created encrypted volumes during the installation and assigned them mount points, you will be asked to enter the passphrase for each of these volumes during the boot.

通过 dm-crypt 加密的分区,启动的时候会有下面的提示信息:

Starting early crypto disks... part_crypt(starting)
Enter LUKS passphrase:

提示的第一行,part 是底下分区的名称,如:sda2 或 md0。您也许想知道输入密码的具体 是哪一卷。它是与 /home 相关?或者是 /var?当然,如果您只有一个加密卷,只需输入密码就可以轻松地建立起该卷。假如您在安装过程中建立了多个加密卷,把上一步 第 6.3.3.6 节 “配置加密卷” 里的记录放在手边。要是之前没有记下 part_crypt 和挂载点之间的映射关系,仍然可以在新系统的 /etc/crypttab/etc/fstab 里面找到它。

根文件系统加载的时候,提示信息或许会有些不同。这取决于使用了哪个 initamfs 生成器制作用于启动的 initrd。下面的例子是使用 initramfs-tools 生成的 initrd:

Begin: Mounting root file system... ...
Begin: Running /scripts/local-top ...
Enter LUKS passphrase:

输入密码时不会有字符(包括星号)回显。如果密码输错,您还有两次机会修正。第三次输错后,启动过程将跳过该卷进入到下一个文件系统。请参阅 第 7.2.1 节 “故障处理” 了解更多信息。

输入密码之后,启动过程与通常情况相同。

7.2.1. 故障处理

如果由于输错密码造成无法加载加密卷,您只能在启动以后手动加载。有下面这些情况。

  • 第一种情况是与根分区相关。如果它不能正确加载,启动过程将中止,您不得不重新启动计算机再试一次。

  • The easiest case is for encrypted volumes holding data like /home or /srv. You can simply mount them manually after the boot.

    However for dm-crypt this is a bit tricky. First you need to register the volumes with device mapper by running:

    # /etc/init.d/cryptdisks start
    

    This will scan all volumes mentioned in /etc/crypttab and will create appropriate devices under the /dev directory after entering the correct passphrases. (Already registered volumes will be skipped, so you can repeat this command several times without worrying.) After successful registration you can simply mount the volumes the usual way:

    # mount /mount_point
    

  • If any volume holding noncritical system files could not be mounted (/usr or /var), the system should still boot and you should be able to mount the volumes manually like in the previous case. However, you will also need to (re)start any services usually running in your default runlevel because it is very likely that they were not started. The easiest way is to just reboot the computer.