During standard Debian install i decided to go with implementing additional security factor which is /boot on separate USB key. In Debian guide I've found it is only put this way.


if you don't like the unencrypted /boot partition, you could boot the system off a USB key, which you can keep separate from the system except for when booting and upgrading the kernel. All you need to do for that is install the bootloader and kernel onto the device and configure it to use the proper encryption volume on the harddisk as root filesystem.

I know how to install GRUB onto USB stick

grub-install --root-directory=/mnt /dev/sdb

but I don't know hot to copy kernel image from my current installation to USB stick. Everything is done here from live environment. On clean install, I setup partitions manually and then proceed with installation, after my /root and /home are ready to use and /boot is already specified on USB Key I choose to "Continue Testing" my live environment from which I install GRUB onto /boot partition but how do i put initial ramdisk there?

Because this is mandatory for system to boot. Also does this approach doesn't require my to edit my /etc/fstab or /etc/crypttab?

  • Interesting concept. Did you encrypt the other partitions? Aside from the encryption, I imagine you would be able to get this running by just choosing to install the bootloader on the USB drive during initial installation – Creek Jun 6 '14 at 11:57
  • Yes. Other partitions (including root) are encrypted. Bootloader is installed into /boot on USB Stick but it will not succed without initial ramdisk put into USB Stick (kernel image). Question is how to put initial ramdisk onto USB after succesful install. After that You can either remove LUKS header which will leave your HDD looking just like random noise or go with plain dm-crypt encryption which looks like random noise from start. For now i focus on LUKS but with presented problem solved i don't see any reason why not to go with plain dm-crypt. – MaxiSuper889 Jun 6 '14 at 12:44

Here's a slightly different way hitting the same goal, /boot on an external usb flash:

(1) Prepare your usb flash boot-device under existing Debian installation using package gnome-disk-utility the following way (which is not necessarily the only way but tested and works for me).

(1.1) Format device with MBR scheme.

(1.2) Create single ext2 partition making it occupy all available space.

(1.3) After step 1.2 completes go to "Edit partition" and set the bootable flag.

(2) Install Debian using its standard installer.

(2.1) Boot your installation media, i.e. Debian installation cd/dvd or another usb stick with .iso image written on it.

(2.2) Choose country/language, setup users and passwords, answer all the routine questions (no interest here) till disk partition dialog.

(2.3) Select manual partitioning.

(2.4) Create your raid/lvm/encrypted volumes on your main disk drive. On top of it there will be a file system, probably ext4.

(2.5) Go to properties of this file system and select mount as / and "done with this partition".

(2.7) Find the usb stick in the list, it should have ext2 on it.

(2.8) Go to its properties and select mount as /boot and optionally noatime in additional flags. There is an option of formatting the partiton, DO NOT do it! "Keep the files".

(2.9) Select "Done with this partition".

(2.10) Select "Finish partitioning" or similar, installation process should continue with some dialogs that are straightforward.

(2.11) After a few other dialog that are straightforward and not of our interest here, there will be a dialog with a question where to install GRUB, which you should agree to install in your /dev/sdX, where X is your usb boot flash.

After installation finishes, you should be able to boot from your flash selecting appropriate option in the BIOS.

Regarding your question of issuing a grub-install --root-directory=/mnt /dev/sdb command, prefer chroot /mnt grub-install /dev/sdb as --root-directory option is deprecated. Other than that, it would work provided:

(1) main file system (your encrypted HDD/SSD/etc) hierarchy is unencrypted and mounted under /mnt of a host OS (i.e. Debian livecd), boot partition is mounted under /mnt/boot;

(2) the new system was previously installed to that partition. That is, /mnt has something in it (/usr/bin, /usr/sbin etc);

(3) after grub-install you issue chroot /mnt update-grub;

(4) you edit /etc/fstab and /etc/crypttab.

Which is much more hassle than installing everything via Debian installer.

Now, I'd like to comment on steps 1, 1.1, 1.2 and 1.3. I'm using Debian 7.5 installer, which fails on grub-install step if the partition is created via its own installer. It doesn't mean that there is a bug in the installer, could be me doing it wrong way. Partition created via gnome-disk-utility works well. Right now I have a dm-crypt/luks volume on top of LVM which is on top of software RAID (an md device), which in turn is on physical drives.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.