I have a fresh install of Debian using sda2_crypt as swap. When I set it up I used a passphrase, but I would like to move to a random keyfile instead so that it won't prompt to unlock at every boot. My partition table looks like this:
Encrypted volume (sda2_crypt) - 2.0 GB Linux device-mapper (crypto) #1 2.0 GB f swap swap Encrypted volume (sda3_crypt) - 125.0 GB Linux device-mapper (cryo) #1 125.0 GB f ext4 / SCSI6 (0,0,0) (sda) - 128 GB ATA TS128GSSD340 #1 primary 999.3 MB B F ext4 /boot #2 primary 2.0 GB K crypto (sda2_crypt) #3 primary 125.0 GB K crypto (sda3_crypt)
I tried the method outlined in this blog, but when I use
cryptsetup luksAddKey /dev/sda2 /etc/keys/sda2.key I am prompted to enter another passphrase. I know that this passphrase is not used to unlock the partition because, upon rebooting, I was again asked to enter a passphrase for sda2 and the one I entered did not work, forcing me to reinstall.
Apparently luks is not supposed to ask for a passphrase when adding a keyfile in the first place, so I do not know what to do.