I am running Debian Jessie. I have 2 hard drives with my various partitions spread across both (not RAID). Both of them are separately LUKS encrypted, and LVMs sit upon both of those. My /boot partition is the only partition not included on the two hard drives; instead, it is located on an unencrypted USB stick. On the /boot partition is myKeyfile.key which should unlock both of the hard drives [but doesn't]. My goal is to have fully inaccessible/useless disks whenever the system boots without the USB stick.

Here is what I have done to accomplish this. I used this answer on StackOverflow as a guide.


# Mountpoints to mount, before cryptsetup is invoked at initscripts. Takes
# mountpoints which are configured in /etc/fstab/ as arguments. Separate
# mountpoints by space.  

# original: CRYPTDISKS_MOUNT=""

According to the comment, I just have to make sure I have the proper mountpoint name as described in fstab. For completeness, here is the relevant line:


# <file system> <mount point> <type> <options> <dump> <pass>
 UUID=<usb uuid>    /boot      ext4   defaults    0     2


sda1_crypt  UUID=<disk uuid>  /boot/myKeyfile.key  luks,keyscript=/bin/passphrase-from-usb
sda2_crypt  UUID=<disk uuid>  /boot/myKeyfile.key  luks,keyscript=/bin/passphrase-from-usb

I could specify the UUID of the USB drive (instead of /boot/myKeyfile.key), but then I'm not sure how I would specify that myKeyfile.key is the file I'm interested in.




prereqs() {
        echo "$PREREQ"

case "$1" in
                exit 0

. "${CONFDIR}/initramfs.conf"
. /usr/share/initramfs-tools/hook-functions

copy_exec /bin/passphrase-from-usb /bin



set -e

    if ! [ -e "$CRYPTTAB_KEY" ]; then
        echo "Waiting for USB stick to be recognized..." >&2
        sleep 5
    if [ -e "$CRYPTTAB_KEY" ]; then
        echo "Unlocking the disk $CRYPTTAB_SOURCE ($CRYPTTAB_NAME) from USB key" >&2
        echo "Using $CRYPTTAB_KEY as the key source" >&2
        dd if="$CRYPTTAB_KEY" bs=1 count=256 2>/dev/null
        echo "Can't find $CRYPTTAB_KEY; USB stick not present." >&2

/lib/cryptsetup/askpass "Manually unlock the disk ($CRYPTTAB_NAME)\nEnter passphrase: "

This is what I am greeted with upon booting:

Loading, please wait...
   Volume group "vg-root" not found
   Skipping volume group vg-root
Unable to find LVM volume vg-root/lv-root
   Volume group "vg-other" not found
   Skipping volume group vg-other
Unable to find LVM volume vg-other/lv-swap

Waiting for USB stick to be recognized...
[   3.159979] sd 7:0:0:0: [sdd] No Caching mode page found
[   3.160152] sd 7:0:0:0: [sdd] Assuming drive cache: write through

Can't find /boot/myKeyfile.key; USB stick not present. 

Manually unlock the disk (sda1_crypt)
Enter passphrase:

After I enter the passphrase, the same exchange happens for the second disk, sdb1_crypt.

I'm doing something wrong, but I'm not sure what. Since CRYPTDISKS_MOUNT "specifies the mountpoints that are mounted before cryptdisks is invoked", I thought adding /boot to it would make /boot available before the unlocking procedure began. However, it does not appear to be mounted when /bin/passphrase-from-usb runs.

I am sure that myKeyfile.key is added as a LUKS key to both drives, and I have updated the initramfs via update-initramfs -u.


during boot, initramfs doesn't mount /boot. if you want use the file in /boot, you may mount the /boot manually. may add following commands to the script passphrase-from-usb.

mkdir -p /tmp-boot
mount <usb uuid> /tmp-boot -t ext4
dd if=/tmp-boot/myKeyfile.key bs=1 count=256 2>/dev/null
umount /tmp-boot

Also, this http://wejn.org/how-to-make-passwordless-cryptsetup.html will be very helpful.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.