I am currently trying to achieve full disk encryption using dm-crypt in plain mode without LUKS header with a separate /boot on USB stick.

My main goal is to achive plausible deniability on a Debian-based distro. For now I've managed to encrypt partitions using cryptsetup and to install the /boot partition to a separate USB key. It all goes as it should and because the header for encryption is not stored in LUKS, I need to manually enter it at the initramfs screen, but at this step I simply get an error that indicates there's no cryptsetup in initramfs ("/bin/sh: cryptsetup: not found") while trying to parse the header.

In conclusion:

  • dev/sda encrypted using dm-crypt (/root and /home volumes) with:
cryptsetup --hash=sha512 --cipher=twofish-xts-plain64 create crypt /dev/sda
  • dev/sdb boot stick with grub installed

I can successfully boot from the bootstick. I see the Ubuntu splashscreen for about 20 seconds which is what I wanted to achive for plausible deniability and then it drops to the initramfs complaining about not being able to find /dev/mapper/root—which is also something I wanted to achieve.

The problem is that when I want to parse the cryptsetup line which would allow me to enter a password and continue with boot, then the initramfs complains about "cryptsetup: not found".

I guess this complaint is true. My question is: how to install cryptsetup into the initramfs so it would allow fruther booting for the password prompt?

Also, I know that I'm omitting something with adding the appropriate entries in /etc/fstab, /etc/crypttab and devices are not found during start up.

These are the guides I've found and used to setup all curent config, maybe this will clear up things I did not cover in my question:

The first one is a little outdated and the second one is for Arch Linux, but I've used two of them with newest Lubuntu instalation with little tweaking.

  • 1
    wait for the truecrypt fork and make a feature request... Commented Jun 4, 2014 at 22:30

1 Answer 1


According to initramfs-tools(8), one can add programs to the initrd image by adding e.g. the following to a hook script:

copy_exec /sbin/cryptsetup /sbin

Example hook scripts can be found in /usr/share/initramfs-tools/hooks and on my Ubuntu system, /usr/share/initramfs-tools/hooks/cryptroot is indeed adding /sbin/cryptsetup to the initrd image.


$ gzip -dc /boot/initrd.img-`uname -r` | cpio -tv 2>/dev/null | grep cryptsetup
=> No cryptsetup included, yet.

$ cat /etc/initramfs-tools/hooks/fde

. /usr/share/initramfs-tools/hook-functions
copy_exec /sbin/cryptsetup /sbin

$ sudo chmod 0755 /etc/initramfs-tools/hooks/fde
$ sudo update-initramfs -u

$ gzip -dc /boot/initrd.img-`uname -r` | cpio -tv 2>/dev/null | grep cryptsetup
-rwxr-xr-x   1 root     root        59248 Aug 21 04:04 sbin/cryptsetup
-rw-r--r--   1 root     root       158848 Aug 21 04:04 lib/x86_64-linux-gnu/libcryptsetup.so.4

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .