3

After updating to Mint 18.1, I can't get initramfs to prompt for a password to unlock the volume with the root file system on it. I have to wait until initramfs times out to a prompt then run cryptsetup luksOpen manually.

I've tried running update-initramfs while the system is mounted and running (as well as from the live CD in chroot) and I have an entry in /etc/cryptab.

This was working for me before the Mint 18 upgrade, but for some reason I'm still not getting a password prompt now no matter what I try.

What should I check?

5

The UUID in /etc/crypttab has to be the UUID of the device that the crypt container sits on top of, not the UUID of the container. Or in other words, if you have /dev/sda1 with /dev/mapper/sda1_crypt on top of it, the /etc/crypttab file should contain the name of the mapper device, sda1_crypt with the UUID of /dev/sda1 not the UUID of /dev/mapper/sda1_crypt.

An /etc/crypttab entry should look like this (all four fields are required):

 mappedname UUID=12345678-9abc-def012345-6789abcdef01 none luks

You can get the UUID's from the blkid command.

After this, update-initramfs -u -k all.

  • This is good to know - is it possible do the unlocking directly in GRUB through the luks module? Additionally, it would allow the user to re-use the same image across multiple devices whilst only needing to update the parameters on the GRUB cmdline. – Walter Jul 26 at 2:18
  • Small addendum: if the underlying device is an SSD, you may want luks,discard in the last field rather than simply luks. (This leaks some usage-pattern metadata through the encryption; see warning in the manpage. But it can help out your SSD a lot.) – Greg Price Sep 10 at 22:46
2

I wrote a script to partially automate this by mounting the partition and checking this file and then unmounting and remounting the encrypted partition with the correct name so the update-initramfs call works correctly.

https://unix.stackexchange.com/a/467113/103652

I could paste that or the script here again, but I'd hate to start skewing the versions between Q&As. The gist where the script (and any updates to it) lives is https://gist.github.com/dragon788/e777ba64d373210e4f6306ad40ee0e80

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.