2

I am trying to encrypt my laptop with an external USB disk. However, every time I boot up grub prompts me with a 'Enter passphrase for $DISK ($UUID):'. This prompt allows me to unlock the disk with the temporary password I have setup. However, it ignores the USB.

The /boot partition is not encrypted. I have added the entry to the crypttab.

Is there any way of getting grub to read the keyfile off the usb, or leave decryption to the Linux boot?

2

Have you set up dm-crypt to use the keyfile?

# cryptsetup luksAddKey /dev/sda2 /etc/mykeyfile

https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption#Keyfiles

Once you've done that (and tested it manually), you need to get the removable drive recognized at boot:

https://wiki.archlinux.org/index.php/Dm-crypt/Device_encryption#With_a_keyfile_stored_on_an_external_media

I apologize for just giving you links, but the alternative is to copy that wiki page verbatim.

3
  • Yes, I have tried the ubuntu equivalent (initramfs), which means I do not have to enter the key twice, but still forces me to enter it with the grub2 bootloader. – Cyclic3 Apr 20 '17 at 17:18
  • 1
    When at the grub menu, if you hit 'e' to see which grub config is about to launch (brings up a basic text editor), do you see the 'cryptkey' kernel parameter? – ctag Apr 20 '17 at 20:27
  • No. However, I changed this through nano /etc/default/grub && update-grub, and it made no difference to the cmdline. Adding cryptkey=/dev/sdb1:vfat:/key in manually on the grub edit prompt gets luks to prompt me for a password – Cyclic3 Apr 21 '17 at 8:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.