1

I have a fresh install of Debian using sda2_crypt as swap. When I set it up I used a passphrase, but I would like to move to a random keyfile instead so that it won't prompt to unlock at every boot. My partition table looks like this:

Encrypted volume (sda2_crypt) - 2.0 GB Linux device-mapper (crypto)
    #1 2.0 GB f swap swap
Encrypted volume (sda3_crypt) - 125.0 GB Linux device-mapper (cryo)
    #1 125.0 GB f ext4 /
SCSI6 (0,0,0) (sda) - 128 GB ATA TS128GSSD340
    #1 primary 999.3 MB B F ext4 /boot
    #2 primary 2.0 GB K crypto (sda2_crypt)
    #3 primary 125.0 GB K crypto (sda3_crypt)

I tried the method outlined in this blog, but when I use cryptsetup luksAddKey /dev/sda2 /etc/keys/sda2.key I am prompted to enter another passphrase. I know that this passphrase is not used to unlock the partition because, upon rebooting, I was again asked to enter a passphrase for sda2 and the one I entered did not work, forcing me to reinstall.

Apparently luks is not supposed to ask for a passphrase when adding a keyfile in the first place, so I do not know what to do.

Improve this question
1
  • Adding a new key always requires entering the passphrase of an existing key. That's by design. Otherwise, if someone gets a hold of your drive, all they'd have to do is add a keyfile to unlock the whole thing.
    – Emmanuel Rosa
    Commented Apr 9, 2017 at 1:41

0

Reset to default

You must log in to answer this question.