3

After updating to Mint 18.1, I can't get initramfs to prompt for a password to unlock the volume with the root file system on it. I have to wait until initramfs times out to a prompt then run cryptsetup luksOpen manually.

I've tried running update-initramfs while the system is mounted and running (as well as from the live CD in chroot) and I have an entry in /etc/crypttab.

This was working for me before the Mint 18 upgrade, but for some reason I'm still not getting a password prompt now no matter what I try.

What should I check?

2 Answers 2

Reset to default
10

The UUID in /etc/crypttab has to be the UUID of the device that the crypt container sits on top of, not the UUID of the container. Or in other words, if you have /dev/sda1 with /dev/mapper/sda1_crypt on top of it, the /etc/crypttab file should contain the name of the mapper device, sda1_crypt with the UUID of /dev/sda1 not the UUID of /dev/mapper/sda1_crypt.

An /etc/crypttab entry should look like this (all four fields are required):

 mappedname UUID=12345678-9abc-def012345-6789abcdef01 none luks

You can get the UUID's from the blkid command.

After this, update-initramfs -u -k all.

2
  • This is good to know - is it possible do the unlocking directly in GRUB through the luks module? Additionally, it would allow the user to re-use the same image across multiple devices whilst only needing to update the parameters on the GRUB cmdline.
    – Walter
    Jul 26, 2019 at 2:18
  • 1
    Small addendum: if the underlying device is an SSD, you may want luks,discard in the last field rather than simply luks. (This leaks some usage-pattern metadata through the encryption; see warning in the manpage. But it can help out your SSD a lot.)
    – Greg Price
    Sep 10, 2019 at 22:46
2

I wrote a script to partially automate this by mounting the partition and checking this file and then unmounting and remounting the encrypted partition with the correct name so the update-initramfs call works correctly.

https://unix.stackexchange.com/a/467113/103652

I could paste that or the script here again, but I'd hate to start skewing the versions between Q&As. The gist where the script (and any updates to it) lives is https://gist.github.com/dragon788/e777ba64d373210e4f6306ad40ee0e80

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .