Comment 2 for bug 1827501

Revision history for this message
apt-ghetto (apt-ghetto) wrote :

Thank you for reporting this issue.

I have made a new installation of Lubuntu 19.04 in a virtual machine (Fedora 30 with Gnome Boxes). I choose the automatic installation with full disk encryption in BIOS mode (legacy mode: bootloader in the MBR). Calamares creates one encrypted LUKS container.

After rebooting, Grub asks for the passphrase to unlock the encrypted LUKS container. I don't see any asterisks. How did you install Lubuntu 19.04?

Grub uses by default the American keyboard layout (it is Grub, that opens the LUKS containter, not the kernel from an unencrypted /boot, like the other flavours).
Let's assume, the passphrase contains a 'z', but with the American keyboard layout, it is a 'y'. After entering the "wrong" passphrase, I was dropped into the Grub rescue shell, which is a bug, in my opinion. At least it should permit, for example, 3 attempts to enter the passphrase before dropping into the Grub rescue shell. The error messages (UUID shortened) are:
error: access denied.
error: no such cryptodisk found.
error: disk `cryptouid/ad25aed...` not found.
Entering rescue mode

Possible workaround/solution: LUKS allows you to define up to 8 different passphrases. Let's assume, the LUKS container is on /dev/sda1. You can check first, how many key slots are free:
sudo cryptsetup luksDump /dev/sda1

There are normally 6 free key slots. Then add a passphrase, which you would receive if you use the American keyboard layout:
sudo cryptsetup luksAddKey /dev/sda1

After rebooting, you can enter the "wrong" passphrase and be able to unlock the LUKS container.