Luks Encryption | ALERT! /dev/mapper/vgzorin-root does not exist

Tutorials & Guides
,
1

I've recently came across an issue with LUKS Encryption on one of our Company Devices. Luckily i managed to fix it myself, but thought it might be helpful to document here should someone else come accross the same issue

The issue
The Device seems to POST fine and prompts the User to enter their encryption key. After that the device is dropping you in a Shell.

Troubleshooting Steps
At this point it might not be clear what caused this issue.

To be able to see what Error caused this i edited the GRUB Settings temporarily:

  • Shut Down the Device by holding the power button for 10 seconds
  • Start the device again by pressing the power button
  • Hold down Shift when the post screen appears
  • The Grub Entry for Zorin should appear
  • Press e to edit this Grub Entry
  • Remove the keywords quietand splash
  • Press Ctrl+ Xto Boot with this adjusted Config

In my case the following error appeared:

image
image981×254 92.3 KB

Getting the Device to Boot again

  • Enter the command blkidYou should now be able to see multiple partitions. One of them should contain a label that starts withluks`
  • Enter the following command:
cryptsetup luksopen /dev/<yourLuksPartition> <yourLuksPartition>_crypt
  • exit the shell

This temporary fix is lost on the next reboot because the mapping isn't stored anywhere. To make it persist, the LUKS partition has to be registered in /etc/crypttab so the initramfs knows to unlock it during boot.

The Permanent Fix

  • Find the UUID of your LUKS partition. Run blkid again and look for the partition with TYPE="crypto_LUKS":
  blkid

Note down the UUID value of that partition (not the UUID of the unlocked _crypt mapping).

  • Open /etc/crypttab with your editor of choice (it may be empty or not exist yet):
  sudo nano /etc/crypttab
  • Add a line mapping the target name to the partition UUID. Replace the UUID with the one you noted from blkid:
  nvme0n1p3_crypt UUID=e4ae939c-74ff-43ac-8556-bdb8cf73f34d none luks,discard
  • Regenerate the initramfs so the new crypttab entry is baked in for all installed kernels:
  sudo update-initramfs -u -k all
  • Reboot the device to confirm it now boots normally:
  sudo reboot

The issue should be resolved on the next reboot.

2 Likes
2

Personally I avoid encryption as it creates more headaches than solutions. Probably best to have non-networked computer for critical data and use a verified clean USB for data transfer.

3

We're using Zorin OS for our Company Laptops. Traveling with unencrypted Laptops containing sensitive company data simply isnt an option for us.

2 Likes