Encryption key nagging problem

[PerfMonk]

Hi all,

I'm an experimented linux user but new to Zorin. Been distro hopping for long time from Mandrake, Ubuntu, Debian, Gentoo, Funtoo, OpenSUSE, Arch, Manjaro, ...

I have tried the zorin 17 liveusb and fell in love with the distro. I use to be a KDE user but I find Zorin gnome interface very attractive and it can be easily customized to my liking. So I gave some money to help funding and got a nice Zorin Pro to install.

I have installed it on my laptop zorin 17 pro with encryption and ZFS (I'm new to zfs but want to learn about it at the same time ).

My language is french and my keyboard layout is fr_CA (I'm in Quebec city).

At boot time I get a graphic prompt to enter my passphrase. My passphrase contain some special character correctly mapped on fr_CA keyboard but not at the same place on the US keyboard. But Zorin got it right by setting my keyboard to the good layout BEFORE asking for the passphrase. But I constantly get errors entering the passphrase since I sometime hit the "caps lock" that is just over the caps key. Would it be possible that a "caps lock" warning shows on the passphrase window ? And also a "Show text" button to check what is typed would be very usefull since the passphrase is hidden.

Congratulation to the team for the nice work of putting together all pieces of a nice distribution

Regards,
BT

Some info on my laptop:

bt@zero:~$ inxi -Faz
System:
  Kernel: 6.2.0-39-generic x86_64 bits: 64 compiler: N/A
    parameters: BOOT_IMAGE=/BOOT/ubuntu_hwmpxp@/vmlinuz-6.2.0-39-generic
    root=ZFS=rpool/ROOT/ubuntu_hwmpxp ro quiet splash vt.handoff=1
  Desktop: GNOME 43.9 tk: GTK 3.24.33 wm: gnome-shell dm: GDM3 42.0
    Distro: Zorin OS 17 base: Ubuntu 22.04 LTS Jammy
Machine:
  Type: Laptop System: ASUSTeK product: VivoBook_ASUSLaptop X513UA_M513UA
    v: 1.0 serial: <superuser required>
  Mobo: ASUSTeK model: X513UA v: 1.0 serial: <superuser required>
    UEFI: American Megatrends LLC. v: X513UA.305 date: 03/12/2021
Battery:
  ID-1: BAT0 charge: 33.4 Wh (100.0%) condition: 33.4/42.1 Wh (79.3%)
    volts: 11.8 min: 11.8 model: ASUSTeK ASUS Battery type: Li-ion serial: N/A
    status: Not charging cycles: 75
  Device-1: hidpp_battery_0 model: Logitech Wireless Mouse M325
    serial: <filter> charge: 100% (should be ignored) rechargeable: yes
    status: Discharging
CPU:
  Info: model: AMD Ryzen 7 5700U with Radeon Graphics bits: 64 type: MT MCP
    arch: Zen 2 family: 0x17 (23) model-id: 0x68 (104) stepping: 1
    microcode: 0x8608103
  Topology: cpus: 1x cores: 8 tpc: 2 threads: 16 smt: enabled cache:
    L1: 512 KiB desc: d-8x32 KiB; i-8x32 KiB L2: 4 MiB desc: 8x512 KiB
    L3: 8 MiB desc: 2x4 MiB
  Speed (MHz): avg: 1442 high: 1800 min/max: 1400/4370 boost: enabled
    scaling: driver: acpi-cpufreq governor: schedutil cores: 1: 1400 2: 1400
    3: 1397 4: 1397 5: 1397 6: 1397 7: 1400 8: 1400 9: 1400 10: 1400 11: 1700
    12: 1397 13: 1397 14: 1400 15: 1800 16: 1400 bogomips: 57490
  Flags: avx avx2 ht lm nx pae sse sse2 sse3 sse4_1 sse4_2 sse4a ssse3 svm
  Vulnerabilities:
  Type: gather_data_sampling status: Not affected
  Type: itlb_multihit status: Not affected
  Type: l1tf status: Not affected
  Type: mds status: Not affected
  Type: meltdown status: Not affected
  Type: mmio_stale_data status: Not affected
  Type: retbleed
    mitigation: untrained return thunk; SMT enabled with STIBP protection
  Type: spec_rstack_overflow mitigation: safe RET
  Type: spec_store_bypass
    mitigation: Speculative Store Bypass disabled via prctl
  Type: spectre_v1
    mitigation: usercopy/swapgs barriers and __user pointer sanitization
  Type: spectre_v2 mitigation: Retpolines, IBPB: conditional, STIBP:
    always-on, RSB filling, PBRSB-eIBRS: Not affected
  Type: srbds status: Not affected
  Type: tsx_async_abort status: Not affected
Graphics:
  Device-1: AMD Lucienne vendor: ASUSTeK driver: amdgpu v: kernel pcie:
    gen: 3 speed: 8 GT/s lanes: 16 link-max: gen: 4 speed: 16 GT/s ports:
    active: eDP-1 empty: HDMI-A-1 bus-ID: 03:00.0 chip-ID: 1002:164c
    class-ID: 0300
  Device-2: Quanta USB2.0 HD UVC WebCam type: USB driver: uvcvideo
    bus-ID: 3-3:3 chip-ID: 0408:30d4 class-ID: 0e02 serial: <filter>
  Display: wayland server: X.org v: 1.21.1.4 with: Xwayland v: 22.1.1
    compositor: gnome-shell driver: gpu: amdgpu display-ID: 0
  Monitor-1: eDP-1 built: 2018 res: 1920x1080 dpi: 142 gamma: 1.2
    size: 344x194mm (13.5x7.6") diag: 395mm (15.5") ratio: 16:9 modes:
    max: 1920x1080 min: 640x480
  OpenGL: renderer: RENOIR (renoir LLVM 15.0.7 DRM 3.49 6.2.0-39-generic)
    v: 4.6 Mesa 23.0.4-0ubuntu1~22.04.1 direct render: Yes
Audio:
  Device-1: AMD Renoir Radeon High Definition Audio driver: snd_hda_intel
    v: kernel pcie: gen: 3 speed: 8 GT/s lanes: 16 link-max: gen: 4
    speed: 16 GT/s bus-ID: 03:00.1 chip-ID: 1002:1637 class-ID: 0403
  Device-2: AMD Raven/Raven2/FireFlight/Renoir Audio Processor
    vendor: ASUSTeK driver: N/A alternate: snd_pci_acp3x, snd_rn_pci_acp3x,
    snd_pci_acp5x, snd_pci_acp6x, snd_acp_pci, snd_rpl_pci_acp6x, snd_pci_ps,
    snd_sof_amd_renoir, snd_sof_amd_rembrandt
    pcie: gen: 3 speed: 8 GT/s lanes: 16 link-max: gen: 4 speed: 16 GT/s
    bus-ID: 03:00.5 chip-ID: 1022:15e2 class-ID: 0480
  Device-3: AMD Family 17h HD Audio vendor: ASUSTeK driver: snd_hda_intel
    v: kernel pcie: gen: 3 speed: 8 GT/s lanes: 16 link-max: gen: 4
    speed: 16 GT/s bus-ID: 03:00.6 chip-ID: 1022:15e3 class-ID: 0403
  Sound Server-1: ALSA v: k6.2.0-39-generic running: yes
  Sound Server-2: PulseAudio v: 15.99.1 running: yes
  Sound Server-3: PipeWire v: 0.3.48 running: yes
Network:
  Device-1: Intel Wi-Fi 6 AX200 driver: iwlwifi v: kernel pcie: gen: 2
    speed: 5 GT/s lanes: 1 bus-ID: 01:00.0 chip-ID: 8086:2723 class-ID: 0280
  IF: wlp1s0 state: up mac: <filter>
  Device-2: Realtek RTL8153 Gigabit Ethernet Adapter type: USB
    driver: r8152 bus-ID: 1-1.3:4 chip-ID: 0bda:8153 class-ID: 0000
    serial: <filter>
  IF: enx00e04c68397d state: up speed: 1000 Mbps duplex: full mac: <filter>
Bluetooth:
  Device-1: Intel AX200 Bluetooth type: USB driver: btusb v: 0.8
    bus-ID: 3-2:5 chip-ID: 8087:0029 class-ID: e001
  Report: hciconfig ID: hci0 rfk-id: 4 state: up address: <filter>
    bt-v: 3.0 lmp-v: 5.2 sub-v: 237e hci-v: 5.2 rev: 237e
  Info: acl-mtu: 1021:4 sco-mtu: 96:6 link-policy: rswitch sniff
    link-mode: peripheral accept
    service-classes: rendering, capturing, audio, telephony
RAID:
  Device-1: bpool type: zfs status: ONLINE level: linear raw: size: 1.88 GiB
    free: 1.73 GiB allocated: 147 MiB zfs-fs: size: 1.75 GiB free: 1.61 GiB
  Components: Online: N/A
  Device-2: rpool type: zfs status: ONLINE level: linear raw: size: 944 GiB
    free: 757 GiB allocated: 187 GiB zfs-fs: size: 914.75 GiB free: 727.19 GiB
  Components: Online: N/A
Drives:
  Local Storage: total: raw: 953.87 GiB usable: 1.83 TiB
    used: 187.2 GiB (10.0%)
  SMART Message: Required tool smartctl not installed. Check --recommends
  ID-1: /dev/nvme0n1 maj-min: 259:0 vendor: Western Digital
    model: PC SN530 SDBPNPZ-1T00-1002 size: 953.87 GiB block-size:
    physical: 512 B logical: 512 B speed: 31.6 Gb/s lanes: 4 type: SSD
    serial: <filter> rev: 21106000 temp: 33.9 C scheme: GPT
Partition:
  ID-1: / raw-size: N/A size: 733.01 GiB used: 5.82 GiB (0.8%) fs: zfs
    logical: rpool/ROOT/ubuntu_hwmpxp
  ID-2: /boot raw-size: N/A size: 1.75 GiB used: 146.1 MiB (8.2%) fs: zfs
    logical: bpool/BOOT/ubuntu_hwmpxp
  ID-3: /boot/efi raw-size: 512 MiB size: 511 MiB (99.80%)
    used: 18.4 MiB (3.6%) fs: vfat dev: /dev/nvme0n1p1 maj-min: 259:1
  ID-4: /var/log raw-size: N/A size: 727.2 GiB used: 11.4 MiB (0.0%)
    fs: zfs logical: rpool/ROOT/ubuntu_hwmpxp/var/log
Swap:
  Kernel: swappiness: 10 (default 60) cache-pressure: 100 (default)
  ID-1: swap-1 type: partition size: 2 GiB used: 0 KiB (0.0%) priority: -2
    dev: /dev/dm-1 maj-min: 253:1 mapped: cryptoswap
Sensors:
  System Temperatures: cpu: 44.0 C mobo: N/A gpu: amdgpu temp: 41.0 C
  Fan Speeds (RPM): cpu: 0
Info:
  Processes: 550 Uptime: 1h 34m wakeups: 7 Memory: 15.02 GiB
  used: 4.97 GiB (33.1%) Init: systemd v: 249 runlevel: 5 tool: systemctl
  Compilers: gcc: 11.4.0 alt: 11/12 Packages: 2303 apt: 2231 lib: 1091
  flatpak: 72 Shell: Bash v: 5.1.16 running-in: gnome-terminal inxi: 3.3.13
bt@zero:~$ 

[zenzen]

Hi, and welcome!

Are you referring to any particular screen? At the login stage I do get to see both the caps lock warning and the "show password" button. Also when I try to do some action that requires authorization.

[PerfMonk]

I mean the first screen that ask for the encryption passphrase before anything is started. I have encrypted the disk, it has to be decrypted with the passphrase before. This is not the login screen. I will post a photograph of it. I can't print any screen before the OS is started.

[PerfMonk]

Here is the screen that ask for unlocking the keystore-rpool (thus the disk) :

[Aravisian]

That is your LUKS password prompt.
You are not alone in your request:

Caps Lock indicator before OS load

Does your keyboard also not light the capslock indicator?

[PerfMonk]

Yes, it's exactly the same situation.

[Aravisian]

This may be a Motherboard Firmware issue - as you are acting on frivers loaded before Zorin OS initializes. Can you check your Motherboard BIOS / EFI settings for peripheral devices?

[PerfMonk]

I have used same BIOS/EFI settings since long and didn't have any problem in many other distros I tested. Is there anything particular in the BIOS that could cause a problem with LUKS password ? I have a NixOS on a separate SSD disk that boot without problem and also I didn't have any problem with Arch before I switched to Zorin. But if the problem is in BIOS and not in LUKS, it would be the same for any distro isn't it ??? I rather think that the problem might be in the initramfs ? What is exactly running when we get asked for the LUKS passphrase ??? The way Zorin and Ubuntu does the ZFS setup is to have a zfs keystore that is LUKS encrypted. It has to be decrypted to have access to the keys for the root zfs pool. But there is another pool "bpool" that is not encrypted with all the stuff you need to start the laptop : initramfs, kernel, ... Only the rpool is really encrypted with LUKS for the keystore and ZFS encryption for the rest of the root.

Another possibility is I used systemd-boot on my other distros usually. Could the culprit be hidden in GRUB ??? Since Zorin use grub ??? Is it grub that ask for the passphrase firstly ???

[Aravisian]

@PerfMonk

Another possibility is I used systemd-boot on my other distros usually. Could the culprit be hidden in GRUB ??? Since Zorin use grub ??? Is it grub that ask for the passphrase firstly ???

This is possible.
Checking your BIOS settings is a suggestion, not an implication that must be where the issue is.
You can use SystemD-Boot on Zorin OS:

[HOW TO] Speed up boot using Systemd-boot

Some say that Gummiboot or Systemd-boot makes for a much faster boot time than Grub2 does. I have not tested this recently, but I can confirm it does work on Zorin OS 15 and on Zorin OS 16. Some users post on the forum looking for a way of speeding up boot time. Often, there is not a lot we can offer... aside from disabling a service here or there are recommending removing Snapd, which some users may prefer to not do. This is intended to be a linkable guide that such users may be directed to …

[PerfMonk]

I haven't installed systemd-boot because I wanted to keep the possibility to boot from a snapshot in the boot menu. I will search a bit. If my memory is good there was a guy that was working on a systemd-snapshot-menu generator but it was for btrfs, not zfs.

Edit: It's snapper
but it does not have support for zfs yet.