I have used GRUB_ENABLE_CRYPTODISK=y in /etc/default/grub to allow LUKS encryption of everything except my EFI partition, which I mount to /boot/efi. This works fine. The only admittedly small problem is that, if I happen to mistype my password, I don't get a second chance. Instead, after 10 seconds or so, I'm left on a GRUB rescue> prompt. Is there anything I can type at this prompt to try again, or must I power off and on?

  • the long wait for authentication is caused by a high default value of iter-time. this can be changed using cryptsetup luksChangeKey
    – Toothrot
    Jan 1, 2020 at 13:49

1 Answer 1


The simplest way is to just hit ctrl+alt+del to soft reset, but you do have to go through the POST again.

Another way to go, from the rescue prompt:

replace hd0,gpt2 with the appropriate value for your machine - on my system it is shown as part of the password prompt. I'm using btrfs without any lvm (and no separate /boot partition), so your cryptomount and prefix parameters may differ somewhat from mine:

cryptomount hd0,gpt2
set prefix=(crypto0)/__active/boot/grub
insmod normal
  • 1
    on my system, the first argument can be replaced by -a (since i only have one encrypted device), and the second line can be omitted.
    – Toothrot
    Jan 1, 2020 at 5:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.