Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just tried to set up Debian in a VM (just testing, before installing it on a real system).

I have set up 4 drives in total. 2 drives that simulate pen drives, on which I want to install the boot loader and boot file system later, and another 2 drives. Every drive is configured as encrypted RAID1 (md0_crypt and md1_crypt). However, I can't put the boot filesystem on my md0_crypt, because I get the warning that one cannot store the /boot FS on an encrypted partition, because it needs to load the kernel and initrd.

So, do I stand correctly that I cannot encrypt my /boot FS? Is the boot FS only for the boot loader (grub) or is there anything else? I would like to have the scenario that if I unplug my pen drive that the system can't be started anymore, since the /boot FS is installed on the pen drive.

share|improve this question
up vote 2 down vote accepted

As the message describes you can't put /boot in an encryption container. For unlocking the encryption container you need to access some utilities. If these utilities are inside the encryption container you are in a deadlock situation.

As a work-around use a unencrypted small 3rd raid container holding only the /boot file system.

From the security perspective this isn't a big loss. The /boot should only contain technical data. There is a small caveat: If you use a password for GRUB, it should be different from the pass-phrase for the encryption container.

share|improve this answer
re plaintext /boot not a big loss: how would i notice if someone patched my unencrypted /boot to keylog my password? i think it is a considerable loss of security. – Attila Lendvai Feb 12 '15 at 23:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.