3

I have 3 encrypted partitions, one for /, one for /home, and one for swap.

It seemed silly to me to type in my password 3 times, so I replaced the swap partition with a swap file on the encrypted drive. However, even though I removed the entry from fstab, I am still being prompted for my password for the old swap partition on boot.

When I boot, the OS asks me for the password for sda7_crypt which I would expect. However, after that, it asks me for the password for sda5_crypt. How do I disable sda5_crypt?

/etc/fstab:

/dev/mapper/sda7_crypt       /     ext4 errors=remount-ro 0 1
UUID=xxxxxxxxxxxxxxxxxxxxxxx /boot ext4 defaults 0 2
/dev/mapper/sdb5_crypt       /home ext4 defaults 0 2
/myswapfile                  swap  swap defaults 0 0

/etc/cryptsetup:

sda7_crypt UUID=xxxxxxxxxxxxxxxxxxxxx none luks,discard 
sdb5_crypt UUID=xxxxxxxxxxxxxxxxxxxxx /keyfile luks,discard



Update: more information to answer questions in the comments:

System: Ubuntu 14.04 64-bit Desktop

/boot/grub/grub.cfg:

#
# DO NOT EDIT THIS FILE
#
# It is automatically generated by grub-mkconfig using templates
# from /etc/grub.d and settings from /etc/default/grub
#

### BEGIN /etc/grub.d/00_header ###
if [ -s $prefix/grubenv ]; then
  set have_grubenv=true
  load_env
fi
if [ "${next_entry}" ] ; then
   set default="${next_entry}"
   set next_entry=
   save_env next_entry
   set boot_once=true
else
   set default="0"
fi

if [ x"${feature_menuentry_id}" = xy ]; then
  menuentry_id_option="--id"
else
  menuentry_id_option=""
fi

export menuentry_id_option

if [ "${prev_saved_entry}" ]; then
  set saved_entry="${prev_saved_entry}"
  save_env saved_entry
  set prev_saved_entry=
  save_env prev_saved_entry
  set boot_once=true
fi

function savedefault {
  if [ -z "${boot_once}" ]; then
    saved_entry="${chosen}"
    save_env saved_entry
  fi
}
function recordfail {
  set recordfail=1
  if [ -n "${have_grubenv}" ]; then if [ -z "${boot_once}" ]; then save_env recordfail; fi; fi
}
function load_video {
  if [ x$feature_all_video_module = xy ]; then
    insmod all_video
  else
    insmod efi_gop
    insmod efi_uga
    insmod ieee1275_fb
    insmod vbe
    insmod vga
    insmod video_bochs
    insmod video_cirrus
  fi
}

if loadfont unicode ; then
  set gfxmode=auto
  load_video
  insmod gfxterm
  set locale_dir=$prefix/locale
  set lang=en_US
  insmod gettext
fi
terminal_output gfxterm
if [ "${recordfail}" = 1 ] ; then
  set timeout=-1
else
  if [ x$feature_timeout_style = xy ] ; then
    set timeout_style=hidden
    set timeout=0
  # Fallback hidden-timeout code in case the timeout_style feature is
  # unavailable.
  elif sleep --interruptible 0 ; then
    set timeout=0
  fi
fi
### END /etc/grub.d/00_header ###

### BEGIN /etc/grub.d/05_debian_theme ###
set menu_color_normal=white/black
set menu_color_highlight=black/light-gray
if background_color 44,0,30; then
  clear
fi
### END /etc/grub.d/05_debian_theme ###

### BEGIN /etc/grub.d/10_linux ###
function gfxmode {
    set gfxpayload="${1}"
    if [ "${1}" = "keep" ]; then
        set vt_handoff=vt.handoff=7
    else
        set vt_handoff=
    fi
}
if [ "${recordfail}" != 1 ]; then
  if [ -e ${prefix}/gfxblacklist.txt ]; then
    if hwmatch ${prefix}/gfxblacklist.txt 3; then
      if [ ${match} = 0 ]; then
        set linux_gfx_mode=keep
      else
        set linux_gfx_mode=text
      fi
    else
      set linux_gfx_mode=text
    fi
  else
    set linux_gfx_mode=keep
  fi
else
  set linux_gfx_mode=text
fi
export linux_gfx_mode
menuentry 'Ubuntu' --class ubuntu --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-simple-c3444e01-a00a-4e4b-a73e-d213dc913a1e' {
    recordfail
    load_video
    gfxmode $linux_gfx_mode
    insmod gzio
    insmod part_msdos
    insmod ext2
    set root='hd0,msdos6'
    if [ x$feature_platform_search_hint = xy ]; then
      search --no-floppy --fs-uuid --set=root --hint-bios=hd0,msdos6 --hint-efi=hd0,msdos6 --hint-baremetal=ahci0,msdos6  52381e81-2730-434f-93be-e8223c4aa95c
    else
      search --no-floppy --fs-uuid --set=root 52381e81-2730-434f-93be-e8223c4aa95c
    fi
    linux   /vmlinuz-3.13.0-35-generic root=UUID=xxxxxxxxxxxxxxxxxxxxxxx ro  quiet splash $vt_handoff
    initrd  /initrd.img-3.13.0-35-generic
}
submenu 'Advanced options for Ubuntu' $menuentry_id_option 'gnulinux-advanced-c3444e01-a00a-4e4b-a73e-d213dc913a1e' {
    menuentry 'Ubuntu, with Linux 3.13.0-35-generic' --class ubuntu --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-3.13.0-35-generic-advanced-c3444e01-a00a-4e4b-a73e-d213dc913a1e' {
        recordfail
        load_video
        gfxmode $linux_gfx_mode
        insmod gzio
        insmod part_msdos
        insmod ext2
        set root='hd0,msdos6'
        if [ x$feature_platform_search_hint = xy ]; then
          search --no-floppy --fs-uuid --set=root --hint-bios=hd0,msdos6 --hint-efi=hd0,msdos6 --hint-baremetal=ahci0,msdos6  52381e81-2730-434f-93be-e8223c4aa95c
        else
          search --no-floppy --fs-uuid --set=root 52381e81-2730-434f-93be-e8223c4aa95c
        fi
        echo    'Loading Linux 3.13.0-35-generic ...'
        linux   /vmlinuz-3.13.0-35-generic root=UUID=xxxxxxxxxxxxxxxx ro  quiet splash $vt_handoff
        echo    'Loading initial ramdisk ...'
        initrd  /initrd.img-3.13.0-35-generic
    }
    menuentry 'Ubuntu, with Linux 3.13.0-35-generic (recovery mode)' --class ubuntu --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-3.13.0-35-generic-recovery-c3444e01-a00a-4e4b-a73e-d213dc913a1e' {
        recordfail
        load_video
        insmod gzio
        insmod part_msdos
        insmod ext2
        set root='hd0,msdos6'
        if [ x$feature_platform_search_hint = xy ]; then
          search --no-floppy --fs-uuid --set=root --hint-bios=hd0,msdos6 --hint-efi=hd0,msdos6 --hint-baremetal=ahci0,msdos6  52381e81-2730-434f-93be-e8223c4aa95c
        else
          search --no-floppy --fs-uuid --set=root 52381e81-2730-434f-93be-e8223c4aa95c
        fi
        echo    'Loading Linux 3.13.0-35-generic ...'
        linux   /vmlinuz-3.13.0-35-generic root=UUID=c3444e01-a00a-4e4b-a73e-d213dc913a1e ro recovery nomodeset 
        echo    'Loading initial ramdisk ...'
        initrd  /initrd.img-3.13.0-35-generic
    }
    menuentry 'Ubuntu, with Linux 3.13.0-34-generic' --class ubuntu --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-3.13.0-34-generic-advanced-c3444e01-a00a-4e4b-a73e-d213dc913a1e' {
        recordfail
        load_video
        gfxmode $linux_gfx_mode
        insmod gzio
        insmod part_msdos
        insmod ext2
        set root='hd0,msdos6'
        if [ x$feature_platform_search_hint = xy ]; then
          search --no-floppy --fs-uuid --set=root --hint-bios=hd0,msdos6 --hint-efi=hd0,msdos6 --hint-baremetal=ahci0,msdos6  52381e81-2730-434f-93be-e8223c4aa95c
        else
          search --no-floppy --fs-uuid --set=root 52381e81-2730-434f-93be-e8223c4aa95c
        fi
        echo    'Loading Linux 3.13.0-34-generic ...'
        linux   /vmlinuz-3.13.0-34-generic root=UUID=xxxxxxxxxxxxxxxxx ro  quiet splash $vt_handoff
        echo    'Loading initial ramdisk ...'
        initrd  /initrd.img-3.13.0-34-generic
    }
    menuentry 'Ubuntu, with Linux 3.13.0-34-generic (recovery mode)' --class ubuntu --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-3.13.0-34-generic-recovery-c3444e01-a00a-4e4b-a73e-d213dc913a1e' {
        recordfail
        load_video
        insmod gzio
        insmod part_msdos
        insmod ext2
        set root='hd0,msdos6'
        if [ x$feature_platform_search_hint = xy ]; then
          search --no-floppy --fs-uuid --set=root --hint-bios=hd0,msdos6 --hint-efi=hd0,msdos6 --hint-baremetal=ahci0,msdos6  52381e81-2730-434f-93be-e8223c4aa95c
        else
          search --no-floppy --fs-uuid --set=root 52381e81-2730-434f-93be-e8223c4aa95c
        fi
        echo    'Loading Linux 3.13.0-34-generic ...'
        linux   /vmlinuz-3.13.0-34-generic root=UUID=xxxxxxxxxxxxxxxxxxxxxxxxx ro recovery nomodeset 
        echo    'Loading initial ramdisk ...'
        initrd  /initrd.img-3.13.0-34-generic
    }
    menuentry 'Ubuntu, with Linux 3.13.0-33-generic' --class ubuntu --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-3.13.0-33-generic-advanced-c3444e01-a00a-4e4b-a73e-d213dc913a1e' {
        recordfail
        load_video
        gfxmode $linux_gfx_mode
        insmod gzio
        insmod part_msdos
        insmod ext2
        set root='hd0,msdos6'
        if [ x$feature_platform_search_hint = xy ]; then
          search --no-floppy --fs-uuid --set=root --hint-bios=hd0,msdos6 --hint-efi=hd0,msdos6 --hint-baremetal=ahci0,msdos6  52381e81-2730-434f-93be-e8223c4aa95c
        else
          search --no-floppy --fs-uuid --set=root 52381e81-2730-434f-93be-e8223c4aa95c
        fi
        echo    'Loading Linux 3.13.0-33-generic ...'
        linux   /vmlinuz-3.13.0-33-generic root=UUID=xxxxxxxxxxxxxxxxx ro  quiet splash $vt_handoff
        echo    'Loading initial ramdisk ...'
        initrd  /initrd.img-3.13.0-33-generic
    }
    menuentry 'Ubuntu, with Linux 3.13.0-33-generic (recovery mode)' --class ubuntu --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-3.13.0-33-generic-recovery-c3444e01-a00a-4e4b-a73e-d213dc913a1e' {
        recordfail
        load_video
        insmod gzio
        insmod part_msdos
        insmod ext2
        set root='hd0,msdos6'
        if [ x$feature_platform_search_hint = xy ]; then
          search --no-floppy --fs-uuid --set=root --hint-bios=hd0,msdos6 --hint-efi=hd0,msdos6 --hint-baremetal=ahci0,msdos6  52381e81-2730-434f-93be-e8223c4aa95c
        else
          search --no-floppy --fs-uuid --set=root 52381e81-2730-434f-93be-e8223c4aa95c
        fi
        echo    'Loading Linux 3.13.0-33-generic ...'
        linux   /vmlinuz-3.13.0-33-generic root=UUID=xxxxxxxxxxxxxxxxxxx ro recovery nomodeset 
        echo    'Loading initial ramdisk ...'
        initrd  /initrd.img-3.13.0-33-generic
    }
    menuentry 'Ubuntu, with Linux 3.13.0-32-generic' --class ubuntu --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-3.13.0-32-generic-advanced-c3444e01-a00a-4e4b-a73e-d213dc913a1e' {
        recordfail
        load_video
        gfxmode $linux_gfx_mode
        insmod gzio
        insmod part_msdos
        insmod ext2
        set root='hd0,msdos6'
        if [ x$feature_platform_search_hint = xy ]; then
          search --no-floppy --fs-uuid --set=root --hint-bios=hd0,msdos6 --hint-efi=hd0,msdos6 --hint-baremetal=ahci0,msdos6  52381e81-2730-434f-93be-e8223c4aa95c
        else
          search --no-floppy --fs-uuid --set=root 52381e81-2730-434f-93be-e8223c4aa95c
        fi
        echo    'Loading Linux 3.13.0-32-generic ...'
        linux   /vmlinuz-3.13.0-32-generic root=UUID=xxxxxxxxxxxxxxxxxxxx ro  quiet splash $vt_handoff
        echo    'Loading initial ramdisk ...'
        initrd  /initrd.img-3.13.0-32-generic
    }
    menuentry 'Ubuntu, with Linux 3.13.0-32-generic (recovery mode)' --class ubuntu --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-3.13.0-32-generic-recovery-c3444e01-a00a-4e4b-a73e-d213dc913a1e' {
        recordfail
        load_video
        insmod gzio
        insmod part_msdos
        insmod ext2
        set root='hd0,msdos6'
        if [ x$feature_platform_search_hint = xy ]; then
          search --no-floppy --fs-uuid --set=root --hint-bios=hd0,msdos6 --hint-efi=hd0,msdos6 --hint-baremetal=ahci0,msdos6  52381e81-2730-434f-93be-e8223c4aa95c
        else
          search --no-floppy --fs-uuid --set=root 52381e81-2730-434f-93be-e8223c4aa95c
        fi
        echo    'Loading Linux 3.13.0-32-generic ...'
        linux   /vmlinuz-3.13.0-32-generic root=UUID=xxxxxxxxxxxxxxxxxxxxx ro recovery nomodeset 
        echo    'Loading initial ramdisk ...'
        initrd  /initrd.img-3.13.0-32-generic
    }
}

### END /etc/grub.d/10_linux ###

### BEGIN /etc/grub.d/20_linux_xen ###

### END /etc/grub.d/20_linux_xen ###

### BEGIN /etc/grub.d/20_memtest86+ ###
menuentry 'Memory test (memtest86+)' {
    insmod part_msdos
    insmod ext2
    set root='hd0,msdos6'
    if [ x$feature_platform_search_hint = xy ]; then
      search --no-floppy --fs-uuid --set=root --hint-bios=hd0,msdos6 --hint-efi=hd0,msdos6 --hint-baremetal=ahci0,msdos6  52381e81-2730-434f-93be-e8223c4aa95c
    else
      search --no-floppy --fs-uuid --set=root 52381e81-2730-434f-93be-e8223c4aa95c
    fi
    knetbsd /memtest86+.elf
}
menuentry 'Memory test (memtest86+, serial console 115200)' {
    insmod part_msdos
    insmod ext2
    set root='hd0,msdos6'
    if [ x$feature_platform_search_hint = xy ]; then
      search --no-floppy --fs-uuid --set=root --hint-bios=hd0,msdos6 --hint-efi=hd0,msdos6 --hint-baremetal=ahci0,msdos6  52381e81-2730-434f-93be-e8223c4aa95c
    else
      search --no-floppy --fs-uuid --set=root 52381e81-2730-434f-93be-e8223c4aa95c
    fi
    linux16 /memtest86+.bin console=ttyS0,115200n8
}
### END /etc/grub.d/20_memtest86+ ###

### BEGIN /etc/grub.d/30_os-prober ###
### END /etc/grub.d/30_os-prober ###

### BEGIN /etc/grub.d/30_uefi-firmware ###
### END /etc/grub.d/30_uefi-firmware ###

### BEGIN /etc/grub.d/40_custom ###
# This file provides an easy way to add custom menu entries.  Simply type the
# menu entries you want to add after this comment.  Be careful not to change
# the 'exec tail' line above.
### END /etc/grub.d/40_custom ###

### BEGIN /etc/grub.d/41_custom ###
if [ -f  ${config_directory}/custom.cfg ]; then
  source ${config_directory}/custom.cfg
elif [ -z "${config_directory}" -a -f  $prefix/custom.cfg ]; then
  source $prefix/custom.cfg;
fi
### END /etc/grub.d/41_custom ###

/etc/default/grub

# If you change this file, run 'update-grub' afterwards to update
# /boot/grub/grub.cfg.
# For full documentation of the options in this file, see:
#   info -f grub -n 'Simple configuration'

GRUB_DEFAULT=0
GRUB_HIDDEN_TIMEOUT=0
GRUB_HIDDEN_TIMEOUT_QUIET=true
GRUB_TIMEOUT=10
GRUB_DISTRIBUTOR=`lsb_release -i -s 2> /dev/null || echo Debian`
GRUB_CMDLINE_LINUX_DEFAULT="quiet splash"
GRUB_CMDLINE_LINUX=""

# Uncomment to enable BadRAM filtering, modify to suit your needs
# This works with Linux (no patch required) and with any kernel that obtains
# the memory map information from GRUB (GNU Mach, kernel of FreeBSD ...)
#GRUB_BADRAM="0x01234567,0xfefefefe,0x89abcdef,0xefefefef"

# Uncomment to disable graphical terminal (grub-pc only)
#GRUB_TERMINAL=console

# The resolution used on graphical terminal
# note that you can use only modes which your graphic card supports via VBE
# you can see them in real GRUB with the command `vbeinfo'
#GRUB_GFXMODE=640x480

# Uncomment if you don't want GRUB to pass "root=UUID=xxx" parameter to Linux
#GRUB_DISABLE_LINUX_UUID=true

# Uncomment to disable generation of recovery mode menu entries
#GRUB_DISABLE_RECOVERY="true"

# Uncomment to get a beep at grub start
#GRUB_INIT_TUNE="480 440 1"
  • If you're using an initrd or initramfs, did you rebuild it? What's your kernel command line — does it include resume=…? If you don't understand these questions, what distribution are you running, and what is the content of /boot/grub/grub.cfg, /etc/default/grub.cfg or whatever your bootloader configuration file is? By the way, you could set up your boot system to ask your passphrase once and use it for several encrypted volumes, some distributions do that automatically. – Gilles Sep 21 '14 at 22:37
  • I have updated the question with the information from the files. – Daniel Sep 22 '14 at 11:39
2

Encrypted volumes are listed in /etc/crypttab. You need to update that file, to remove the volume that you no longer want mounted.

After doing this, you need to rebuild the initramfs, by running

sudo update-initramfs -u

If you want to have three encrypted partitions on the same disk, then you should have a single encrypted volume instead of three, and create partitions inside it (with LVM: make the encrypted volume a physical volume, create a volume group containing that physical volume, and create a logical volume for /, one for /home and one for swap). Ubuntu's startup scripts don't handle sharing the passphrase between volumes, though you can tweak them to do that; see bug #1022815.

By the way, you can use a random key (generated at each boot) for the swap volume, if you don't use hibernation.

  • Just a note, if you run "sudo update-initramfs" it will complain about bad usage. I ran it with the "-c" parameter and it did the job. Thanks for the help! – Daniel Sep 23 '14 at 11:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.