{"id":16288123,"url":"https://github.com/barbarossatm/fluffy-unluks","last_synced_at":"2025-06-10T08:04:00.067Z","repository":{"id":206733988,"uuid":"717577963","full_name":"BarbarossaTM/fluffy-unluks","owner":"BarbarossaTM","description":"UnLUKS - Unlock yur LUKS encrypted drives remotely via SSH","archived":false,"fork":false,"pushed_at":"2023-12-30T22:12:05.000Z","size":12,"stargazers_count":4,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-04-03T09:51:00.443Z","etag":null,"topics":["debian","fde","full-disk-encryption","initrd","linux","luks","ssh"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/BarbarossaTM.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-11-11T22:24:39.000Z","updated_at":"2023-12-30T22:03:32.000Z","dependencies_parsed_at":null,"dependency_job_id":"e8ba9dd3-41a0-4a72-861f-68c0aa7f39d0","html_url":"https://github.com/BarbarossaTM/fluffy-unluks","commit_stats":null,"previous_names":["barbarossatm/fluffy-unluks"],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BarbarossaTM%2Ffluffy-unluks","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BarbarossaTM%2Ffluffy-unluks/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BarbarossaTM%2Ffluffy-unluks/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BarbarossaTM%2Ffluffy-unluks/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/BarbarossaTM","download_url":"https://codeload.github.com/BarbarossaTM/fluffy-unluks/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/BarbarossaTM%2Ffluffy-unluks/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":259033707,"owners_count":22795764,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["debian","fde","full-disk-encryption","initrd","linux","luks","ssh"],"created_at":"2024-10-10T19:47:20.042Z","updated_at":"2025-06-10T08:04:00.028Z","avatar_url":"https://github.com/BarbarossaTM.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# UnLUKS - unlock yur LUKS encrypted drives remotely via SSH\n\nThis repository contains to scripts to set up the initian-ramdisk of any Debian-based system\nso that it will configure a network interface and spawn an SSH server from within the initrd,\nwhich will allow you to unlock any LUKS-encrypted drives/RAIDs/... remotely.\n\n## Installation\n\nThe `add-unluks` script needs to installed into the `/etc/initramfs-tools/hooks/` directory,\nso it will be run when a new initrd is build for the system to set up all the necessary plumbing.\nThis includes installing `sshd`, `vconfig`, `killall` into the initrd\n \nThe `unluks` script needs to be installed into the `/etc/initramfs-tools/scripts/local-top/`\ndirectory, so it will be copied into the initrd into the same scripts structure, so it's executed\non bootup.\n\n## Requierments\n\nCurrently the scripts require that the `psmisc` and `vlan` packages are installed on the host system.\nIf you do not require VLANs you can update the `add-luks` script and remove the\n\n    copy_exec /sbin/vconfig\n\nline from the script to circumvent the requirement for the `vlan` package.\n\n## Configuration\n\nThe `unluks` script contains a configuration section on top, which contains of the follows parameters:\n\n    # The following two parameters control whether this script considers disks to be\n    # unlocked successfully.  At least one of the two variables needs to be set for\n    # this to work :)\n    \n    # Space separated list of block devices to wait for (if any)\n    wait_block_devs=\"\"\n    \n    # Space separated list of LVM VGs to wait for (if any)\n    wait_vgs=\"\"\n    \n\n    # The following parameter control the network configuration applied within the\n    # initrd, so you are able to access the machine to unlock its disks.\n    \n    # Physical NIC (e.g. eth0, enp1s0, ...) for a plain setup or name of the bonding\n    # interface to use (e.g. bond0), if a LAG shall be assembled.  If a LAG iface is\n    # to be used, bond_members also needs to be set.\n    iface=\"\"\n    \n    # Physical LAG member interface(s), if an 802.3ad/LACP LAG is desired (optional)\n    bond_members=\"\"\n    \n    # If the interface to this machine carries multiple VLANs, the desired VLAN for\n    # administrative access can be configured by setting the VLAN ID here.\n    # It will be configured on top of $iface configured above. (optional)\n    vlan_id=\"\"\n    \n    # The IP/netmask to be assigned to $iface (CIDR notation)\n    ip=\"\"\n    \n    # The default gateway to use, if any (optional)\n    gateway=\"\"\n    \n    # The safeword, which can be appened to the Kernel commmand line on boot-up to\n    # disable this script and use the regular interactive means of unlocking the\n    # disks. (optional)\n    safeword=\"red\"\n\n\n# Even more Convenience\n\nFor more convenience uncomment, and most likely edit, the example script add the end `add-unluks`.\nIt will create a shell script stored within `/unluks` which contains the commands necessary to unlock\nall existing LUKS volumes, `/dev/md1` - `/dev/md3` in this example, and run `pvscan` as well as `vgchange -ay`\nto find all PVs and activate all LVs in all VGs.\n\n    cat \u003c\u003c SCRIPT \u003e \"${DESTDIR}/unluks\"\n    #!/bin/sh\n    \n    cryptsetup luksOpen /dev/md1 md1_crypt\n    cryptsetup luksOpen /dev/md2 md2_crypt\n    cryptsetup luksOpen /dev/md3 md3_crypt\n    \n    lvm pvscan\n    \n    vgchange -ay\n    \n    echo \"Cool thanks, booting...\"\n    SCRIPT\n    \n    chmod 755 \"${DESTDIR}/unluks\"\n\nFor full convencience you can also change the root line of `/etc/passwd` within `add-unluks` to\n\n    root:x:0:0:root:/root:/unluks\n\nThis will cause above script to be used as the login shell for the `root` user, meaning you will be\ndirectly prompted to unlock the LUKS disk(s). The drawback however is that you don't get access to\nthe shell anymore, which you shouldn't be needing though if everything is as it should be.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbarbarossatm%2Ffluffy-unluks","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbarbarossatm%2Ffluffy-unluks","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbarbarossatm%2Ffluffy-unluks/lists"}