I am currently trying to achieve full disk encryption using dm-crypt in plain mode without LUKS header with a separate /boot on USB stick.

My main goal is to achive plausible deniability on a Debian-based distro. For now I've managed to encrypt partitions using cryptsetup and to install the /boot partition to a separate USB key. It all goes as it should and because the header for encryption is not stored in LUKS, I need to manually enter it at the initramfs screen, but at this step I simply get an error that indicates there's no cryptsetup in initramfs ("/bin/sh: cryptsetup: not found") while trying to parse the header.

In conclusion:

  • dev/sda encrypted using dm-crypt (/root and /home volumes) with:
cryptsetup --hash=sha512 --cipher=twofish-xts-plain64 create crypt /dev/sda
  • dev/sdb boot stick with grub installed

I can successfully boot from the bootstick. I see the Ubuntu splashscreen for about 20 seconds which is what I wanted to achive for plausible deniability and then it drops to the initramfs complaining about not being able to find /dev/mapper/root—which is also something I wanted to achieve.

The problem is that when I want to parse the cryptsetup line which would allow me to enter a password and continue with boot, then the initramfs complains about "cryptsetup: not found".

I guess this complaint is true. My question is: how to install cryptsetup into the initramfs so it would allow fruther booting for the password prompt?

Also, I know that I'm omitting something with adding the appropriate entries in /etc/fstab, /etc/crypttab and devices are not found during start up.

These are the guides I've found and used to setup all curent config, maybe this will clear up things I did not cover in my question:

The first one is a little outdated and the second one is for Arch Linux, but I've used two of them with newest Lubuntu instalation with little tweaking.

  • 1
    wait for the truecrypt fork and make a feature request... – RobotHumans Jun 4 '14 at 22:30

According to initramfs-tools(8), one can add programs to the initrd image by adding e.g. the following to a hook script:

copy_exec /sbin/cryptsetup /sbin

Example hook scripts can be found in /usr/share/initramfs-tools/hooks and on my Ubuntu system, /usr/share/initramfs-tools/hooks/cryptroot is indeed adding /sbin/cryptsetup to the initrd image.


$ gzip -dc /boot/initrd.img-`uname -r` | cpio -tv 2>/dev/null | grep cryptsetup
=> No cryptsetup included, yet.

$ cat /etc/initramfs-tools/hooks/fde

. /usr/share/initramfs-tools/hook-functions
copy_exec /sbin/cryptsetup /sbin

$ sudo chmod 0755 /etc/initramfs-tools/hooks/fde
$ sudo update-initramfs -u

$ gzip -dc /boot/initrd.img-`uname -r` | cpio -tv 2>/dev/null | grep cryptsetup
-rwxr-xr-x   1 root     root        59248 Aug 21 04:04 sbin/cryptsetup
-rw-r--r--   1 root     root       158848 Aug 21 04:04 lib/x86_64-linux-gnu/libcryptsetup.so.4

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.