Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a fairly standard disk encryption setup in Debian 5.0.5: unencrypted /boot partition, and encrypted sdaX_crypt that contains all other partitions.

Now, this is a headless server installation and I want to be able to boot it without a keyboard (right now I can boot it only with a keyboard and a monitor attached).

So far I have an idea of moving /boot partition to an USB drive and make slight modifications to auto-enter the key (I think there is just a call to askpass in the boot script somewhere). This way I can boot headless, just need to have a flash drive in at boot time.

As I see it, the problem with it is that

  1. I need to invest time into figuring out all bits and pieces to make it work,
  2. If there is an update, which regenerates initrd, I need to regenerate the boot partition on the USB, which seems tedious.

The question: is there a standard low-upkeep solution available for what I want to do? Or should I be looking elsewhere altogether?

share|improve this question
up vote 7 down vote accepted

You can setup your system to require a key instead of a password and change some scripts to search for this key on a USB stick. I found a detailed explanation for this process on Debian Lenny. There are some notes in the end that describe necessary changes for newer versions of Debian.

share|improve this answer
Sounds like what I need. I first need to see how much effort it is to keep things working between updates before I accept the answer. – Alex B Aug 21 '10 at 11:34
OK, though there isn't a "standard" solution, this seems to have worked. – Alex B Aug 22 '10 at 11:41

But then what is the point of having full disk encryption, if you're just leaving the keys laying around in plaintext?

For that to work, you'd need something like what the Trusted Computing Platform was supposed to be before Microsoft and Big Media hijacked it for their own evil user-subduing purposes.

The idea is have a chip holding the keys in the motherboard, and having it give the keys only when it's verified that the software running was properly signed by a trusted authority (you). This way you don't leave the keys in plain sight and you don't have to boot the server interactively.

It's a pity I've never seen Trusted Computing put to any good use, which could actually be useful for the end user.

share|improve this answer
The key is no more laying around in plaintext than your SSH key laying around in plaintext in ~/.ssh. I just want to be able to boot a headless server with full disk encryption and take the key out. I realize that attacker can modify the unencrypted boot partition and steal the key (like with a software-based regular password version anyway), but I'm just protecting against casual theft. – Alex B Mar 28 '11 at 3:33
Actually the TPM has come back away from DRM and to government and enterprises uses lately. There are plenty of OSes that can use it to store secret keys, I don't know of any that offers integrity protection (i.e. not allowing an attacker to insert a keylogger in /boot). – Gilles Mar 28 '11 at 7:21
@AlexB: Does your server have a TPM? If so, you can probably do what you want with Trusted Grub. – Gilles Mar 28 '11 at 7:22
Note that there is a benefit of leaving keys in plaintext, which would be that you could completely wipe sensitive data on a disk without zeroing out the whole disk. Yes, you could zero out the superblock or the partition table, but as we all know, data is still recoverable from those operations. – strugee Aug 28 '13 at 20:57
@strugee: if you're using LUKS, zeroing out the LUKS header makes the entire volume unrecoverable. If your using plain headerless dm-crypt, then yes, it is still recoverable later on with a password. – Jay Sullivan Jan 31 '15 at 20:22

Mandos (which I and others have written) solves this very problem:

Mandos is a system for allowing servers with encrypted root file systems to reboot unattended and/or remotely. See the intro manual page for more information, including an FAQ list.

In short, the booting server gets the password over the network, in a secure fashion. See the README for details.

share|improve this answer
Even if this free software, stating that this is your product would be appreciated if not actually required. A more readable README/FAQ link and a short explanation of how Mandos works would also be appreciated. – Gilles Apr 28 '11 at 21:11
@Gilles: Done now. – Teddy May 3 '11 at 11:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.