[{"data":1,"prerenderedAt":597},["ShallowReactive",2],{"blog-luks-usb-key":3},{"id":4,"title":5,"body":6,"date":589,"description":590,"extension":591,"meta":592,"navigation":363,"path":593,"seo":594,"stem":595,"__hash__":596},"blog\u002Fblog\u002Fluks-usb-key.md","Nośnik USB jako klucz do LUKS'a",{"type":7,"value":8,"toc":584},"minimark",[9,13,18,22,59,62,91,94,119,123,126,142,145,176,179,200,224,227,250,253,309,313,316,340,347,524,530,539,542,561,580],[10,11,5],"h1",{"id":12},"nośnik-usb-jako-klucz-do-luksa",[14,15,17],"h2",{"id":16},"tworzenie-klucza","Tworzenie klucza",[19,20,21],"p",{},"Tworzymy ram disk na potrzeby wygenerowania klucz:",[23,24,29],"pre",{"className":25,"code":26,"language":27,"meta":28,"style":28},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","mount -t tmpfs -o uid=root,gid=root,mode=1700,size=10M tmpfs \u002Fmnt\n","bash","",[30,31,32],"code",{"__ignoreMap":28},[33,34,37,41,45,48,51,54,56],"span",{"class":35,"line":36},"line",1,[33,38,40],{"class":39},"sBMFI","mount",[33,42,44],{"class":43},"sfazB"," -t",[33,46,47],{"class":43}," tmpfs",[33,49,50],{"class":43}," -o",[33,52,53],{"class":43}," uid=root,gid=root,mode=1700,size=10M",[33,55,47],{"class":43},[33,57,58],{"class":43}," \u002Fmnt\n",[19,60,61],{},"Generujemy losowy klucz:",[23,63,65],{"className":25,"code":64,"language":27,"meta":28,"style":28},"dd if=\u002Fdev\u002Frandom of=\u002Fmnt\u002Fkeyfile bs=1 count=4096\n",[30,66,67],{"__ignoreMap":28},[33,68,69,72,75,78,81,85,88],{"class":35,"line":36},[33,70,71],{"class":39},"dd",[33,73,74],{"class":43}," if=\u002Fdev\u002Frandom",[33,76,77],{"class":43}," of=\u002Fmnt\u002Fkeyfile",[33,79,80],{"class":43}," bs=",[33,82,84],{"class":83},"sbssI","1",[33,86,87],{"class":43}," count=",[33,89,90],{"class":83},"4096\n",[19,92,93],{},"Dodajemy klucz do nagłówka LUKS:",[23,95,97],{"className":25,"code":96,"language":27,"meta":28,"style":28},"cryptsetup luksAddKey \u002Fdev\u002Fsda3 \u002Fmnt\u002Fkeyfile --hash sha512\n",[30,98,99],{"__ignoreMap":28},[33,100,101,104,107,110,113,116],{"class":35,"line":36},[33,102,103],{"class":39},"cryptsetup",[33,105,106],{"class":43}," luksAddKey",[33,108,109],{"class":43}," \u002Fdev\u002Fsda3",[33,111,112],{"class":43}," \u002Fmnt\u002Fkeyfile",[33,114,115],{"class":43}," --hash",[33,117,118],{"class":43}," sha512\n",[14,120,122],{"id":121},"zapisanie-klucza-w-mbr-gap","Zapisanie klucza w MBR-GAP",[19,124,125],{},"MBR-GAP to przestrzeń za tablicą partycji (pierwszym sektorem nośnika), której granicę wyznacza początek pierwszej partycji dysku. Zwykle partycje są równane do 1MiB, więc MBR-GAP w takim przypadku to 2047 sektorów 512-bajtowych. Tę przestrzeń trzeba zapisać losowymi danymi, po czym w którymś miejscu umieścić wcześniej wygenerowany keyfile. By mieć pewność, że to właśnie ten obszar trzeba wyczyścić, najlepiej sprawdzić offset pierwszej partycji przez fdisk:",[23,127,129],{"className":25,"code":128,"language":27,"meta":28,"style":28},"fdisk -l \u002Fdev\u002Fsdb\n",[30,130,131],{"__ignoreMap":28},[33,132,133,136,139],{"class":35,"line":36},[33,134,135],{"class":39},"fdisk",[33,137,138],{"class":43}," -l",[33,140,141],{"class":43}," \u002Fdev\u002Fsdb\n",[19,143,144],{},"Czyścimy 2047 sektorów przy pomocy dd z pominięciem pierwszego, na którym znajduje się tablica partycji:",[23,146,148],{"className":25,"code":147,"language":27,"meta":28,"style":28},"dd if=\u002Fdev\u002Furandom of=\u002Fdev\u002Fsdb bs=512 count=2047 seek=1\n",[30,149,150],{"__ignoreMap":28},[33,151,152,154,157,160,162,165,167,170,173],{"class":35,"line":36},[33,153,71],{"class":39},[33,155,156],{"class":43}," if=\u002Fdev\u002Furandom",[33,158,159],{"class":43}," of=\u002Fdev\u002Fsdb",[33,161,80],{"class":43},[33,163,164],{"class":83},"512",[33,166,87],{"class":43},[33,168,169],{"class":83},"2047",[33,171,172],{"class":43}," seek=",[33,174,175],{"class":83},"1\n",[19,177,178],{},"Wczytajmy tablicę partycji na nowo, by sprawdzić czy wszystko z nią jest w porządku:",[23,180,182],{"className":25,"code":181,"language":27,"meta":28,"style":28},"partprobe && fdisk -l \u002Fdev\u002Fsdb\n",[30,183,184],{"__ignoreMap":28},[33,185,186,189,193,196,198],{"class":35,"line":36},[33,187,188],{"class":39},"partprobe",[33,190,192],{"class":191},"sMK4o"," &&",[33,194,195],{"class":39}," fdisk",[33,197,138],{"class":43},[33,199,141],{"class":43},[23,201,205],{"className":202,"code":203,"language":204,"meta":28,"style":28},"language-console shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","...\nDevice     Boot Start      End  Sectors  Size Id Type\n\u002Fdev\u002Fsdb1        2048 30433279 30431232 14.5G  c W95 FAT32 (LBA)\n","console",[30,206,207,212,218],{"__ignoreMap":28},[33,208,209],{"class":35,"line":36},[33,210,211],{},"...\n",[33,213,215],{"class":35,"line":214},2,[33,216,217],{},"Device     Boot Start      End  Sectors  Size Id Type\n",[33,219,221],{"class":35,"line":220},3,[33,222,223],{},"\u002Fdev\u002Fsdb1        2048 30433279 30431232 14.5G  c W95 FAT32 (LBA)\n",[19,225,226],{},"Wgrywamy teraz plik klucz gdzieś w obrębie tej przestrzeni MBR-GAP, np. na offset 100:",[23,228,230],{"className":25,"code":229,"language":27,"meta":28,"style":28},"dd if=\u002Fmnt\u002Fkeyfile of=\u002Fdev\u002Fsdb bs=512 seek=100\n",[30,231,232],{"__ignoreMap":28},[33,233,234,236,239,241,243,245,247],{"class":35,"line":36},[33,235,71],{"class":39},[33,237,238],{"class":43}," if=\u002Fmnt\u002Fkeyfile",[33,240,159],{"class":43},[33,242,80],{"class":43},[33,244,164],{"class":83},[33,246,172],{"class":43},[33,248,249],{"class":83},"100\n",[19,251,252],{},"Sprawdzamy czy udało się wgrać klucz w MBR-GAP:",[23,254,256],{"className":25,"code":255,"language":27,"meta":28,"style":28},"diff --report-identical-files \u003C(cat \u002Fmnt\u002Fkeyfile) \u003C(dd if=\u002Fdev\u002Fsdb bs=512 skip=100 count=8 status=none | cat)\n",[30,257,258],{"__ignoreMap":28},[33,259,260,263,266,269,272,274,277,279,281,284,286,289,292,294,297,300,303,306],{"class":35,"line":36},[33,261,262],{"class":39},"diff",[33,264,265],{"class":43}," --report-identical-files",[33,267,268],{"class":191}," \u003C(",[33,270,271],{"class":39},"cat",[33,273,112],{"class":43},[33,275,276],{"class":191},")",[33,278,268],{"class":191},[33,280,71],{"class":39},[33,282,283],{"class":43}," if=\u002Fdev\u002Fsdb bs=",[33,285,164],{"class":83},[33,287,288],{"class":43}," skip=",[33,290,291],{"class":83},"100",[33,293,87],{"class":43},[33,295,296],{"class":83},"8",[33,298,299],{"class":43}," status=none ",[33,301,302],{"class":191},"|",[33,304,305],{"class":39}," cat",[33,307,308],{"class":191},")\n",[14,310,312],{"id":311},"skrypt-odblokowujący-partycję","Skrypt odblokowujący partycję",[19,314,315],{},"Tworzymy skrypt, który posłuży nam do wykrywania i automatycznego odblokowywania partycji LUKS:",[23,317,319],{"className":25,"code":318,"language":27,"meta":28,"style":28},"touch \u002Fusr\u002Fsbin\u002Funlock-luks && chmod +x \u002Fusr\u002Fsbin\u002Funlock-luks\n",[30,320,321],{"__ignoreMap":28},[33,322,323,326,329,331,334,337],{"class":35,"line":36},[33,324,325],{"class":39},"touch",[33,327,328],{"class":43}," \u002Fusr\u002Fsbin\u002Funlock-luks",[33,330,192],{"class":191},[33,332,333],{"class":39}," chmod",[33,335,336],{"class":43}," +x",[33,338,339],{"class":43}," \u002Fusr\u002Fsbin\u002Funlock-luks\n",[19,341,342,343,346],{},"Zawartość pliku ",[30,344,345],{},"\u002Fusr\u002Fsbin\u002Funlock-luks",":",[23,348,352],{"className":349,"code":350,"language":351,"meta":28,"style":28},"language-sh shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","#!\u002Fbin\u002Fsh\n\nusbkey=\u002Fdev\u002Fdisk\u002Fby-id\u002Fusb-Generic_Flash_Disk_61BCB9FD1EA4-0:0\n\n# Waiting for the USB key will become available on the first unlock attempt\nif [ ! -e \u002Ftmp\u002Funlock-luks-first-attempt ]; then\n    touch \u002Ftmp\u002Funlock-luks-first-attempt\n\n    for i in `seq 1 10`; do\n        if [ -b $usbkey ]; then\n            break\n        fi\n\n        echo \"Waiting for USB key...\" >&2\n        sleep 1\n    done\nfi\n\n# Attempting to unlock with a USB key\nif [ -b $usbkey ]; then\n    echo \"Loading USB key...\" >&2\n\n    dd if=$usbkey bs=512 skip=100 count=8 | cat\n    exit\nfi\n\necho \"FAILED to get USB key...\" >&2\n\n# Fallback to askpass\n\u002Flib\u002Fcryptsetup\u002Faskpass \"Try LUKS password or insert USB key and press ENTER: \"\n","sh",[30,353,354,359,365,370,375,381,387,393,398,404,410,416,422,427,433,439,445,451,456,462,468,474,479,485,491,496,501,507,512,518],{"__ignoreMap":28},[33,355,356],{"class":35,"line":36},[33,357,358],{},"#!\u002Fbin\u002Fsh\n",[33,360,361],{"class":35,"line":214},[33,362,364],{"emptyLinePlaceholder":363},true,"\n",[33,366,367],{"class":35,"line":220},[33,368,369],{},"usbkey=\u002Fdev\u002Fdisk\u002Fby-id\u002Fusb-Generic_Flash_Disk_61BCB9FD1EA4-0:0\n",[33,371,373],{"class":35,"line":372},4,[33,374,364],{"emptyLinePlaceholder":363},[33,376,378],{"class":35,"line":377},5,[33,379,380],{},"# Waiting for the USB key will become available on the first unlock attempt\n",[33,382,384],{"class":35,"line":383},6,[33,385,386],{},"if [ ! -e \u002Ftmp\u002Funlock-luks-first-attempt ]; then\n",[33,388,390],{"class":35,"line":389},7,[33,391,392],{},"    touch \u002Ftmp\u002Funlock-luks-first-attempt\n",[33,394,396],{"class":35,"line":395},8,[33,397,364],{"emptyLinePlaceholder":363},[33,399,401],{"class":35,"line":400},9,[33,402,403],{},"    for i in `seq 1 10`; do\n",[33,405,407],{"class":35,"line":406},10,[33,408,409],{},"        if [ -b $usbkey ]; then\n",[33,411,413],{"class":35,"line":412},11,[33,414,415],{},"            break\n",[33,417,419],{"class":35,"line":418},12,[33,420,421],{},"        fi\n",[33,423,425],{"class":35,"line":424},13,[33,426,364],{"emptyLinePlaceholder":363},[33,428,430],{"class":35,"line":429},14,[33,431,432],{},"        echo \"Waiting for USB key...\" >&2\n",[33,434,436],{"class":35,"line":435},15,[33,437,438],{},"        sleep 1\n",[33,440,442],{"class":35,"line":441},16,[33,443,444],{},"    done\n",[33,446,448],{"class":35,"line":447},17,[33,449,450],{},"fi\n",[33,452,454],{"class":35,"line":453},18,[33,455,364],{"emptyLinePlaceholder":363},[33,457,459],{"class":35,"line":458},19,[33,460,461],{},"# Attempting to unlock with a USB key\n",[33,463,465],{"class":35,"line":464},20,[33,466,467],{},"if [ -b $usbkey ]; then\n",[33,469,471],{"class":35,"line":470},21,[33,472,473],{},"    echo \"Loading USB key...\" >&2\n",[33,475,477],{"class":35,"line":476},22,[33,478,364],{"emptyLinePlaceholder":363},[33,480,482],{"class":35,"line":481},23,[33,483,484],{},"    dd if=$usbkey bs=512 skip=100 count=8 | cat\n",[33,486,488],{"class":35,"line":487},24,[33,489,490],{},"    exit\n",[33,492,494],{"class":35,"line":493},25,[33,495,450],{},[33,497,499],{"class":35,"line":498},26,[33,500,364],{"emptyLinePlaceholder":363},[33,502,504],{"class":35,"line":503},27,[33,505,506],{},"echo \"FAILED to get USB key...\" >&2\n",[33,508,510],{"class":35,"line":509},28,[33,511,364],{"emptyLinePlaceholder":363},[33,513,515],{"class":35,"line":514},29,[33,516,517],{},"# Fallback to askpass\n",[33,519,521],{"class":35,"line":520},30,[33,522,523],{},"\u002Flib\u002Fcryptsetup\u002Faskpass \"Try LUKS password or insert USB key and press ENTER: \"\n",[19,525,526,527,346],{},"Przykładowy fragment ",[30,528,529],{},"\u002Fetc\u002Fcrypttab",[23,531,533],{"className":202,"code":532,"language":204,"meta":28,"style":28},"sda3_crypt UUID=8dea5878-fdf0-4cd2-bafc-b14f249c9436 none luks,discard,keyscript=\u002Fusr\u002Fsbin\u002Funlock-luks\n",[30,534,535],{"__ignoreMap":28},[33,536,537],{"class":35,"line":36},[33,538,532],{},[19,540,541],{},"Zapisujemy zmiany i aktualizujemy obraz initramfs:",[23,543,545],{"className":25,"code":544,"language":27,"meta":28,"style":28},"update-initramfs -k all -u\n",[30,546,547],{"__ignoreMap":28},[33,548,549,552,555,558],{"class":35,"line":36},[33,550,551],{"class":39},"update-initramfs",[33,553,554],{"class":43}," -k",[33,556,557],{"class":43}," all",[33,559,560],{"class":43}," -u\n",[562,563,564,567],"tip",{},[19,565,566],{},"Dowiedz się więcej:",[568,569,570],"ul",{},[571,572,573],"li",{},[574,575,579],"a",{"href":576,"rel":577},"https:\u002F\u002Fmorfikov.github.io\u002Fpost\u002Fwykorzystanie-nosnika-usb-jako-klucz-do-odszyfrowania-raspberry-pi\u002F",[578],"nofollow","Wykorzystanie nośnika USB jako klucz do odszyfrowania Raspberry Pi (LUKS)",[581,582,583],"style",{},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}",{"title":28,"searchDepth":214,"depth":214,"links":585},[586,587,588],{"id":16,"depth":214,"text":17},{"id":121,"depth":214,"text":122},{"id":311,"depth":214,"text":312},"2026-04-27","Jak użyć nośnika USB jako fizycznego klucza do odszyfrowania dysku LUKS przy użyciu MBR-GAP.","md",{},"\u002Fblog\u002Fluks-usb-key",{"title":5,"description":590},"blog\u002Fluks-usb-key","0_4jK2NcUhH3L5r1ogFEz6R2mxC1rlB1PQYSEfnDzV4",1779389569823]