At the beginning of booting Linux a special program asking for passphrase is loaded if your linux is installed to encrypted-lvm, but this can be a security problem if the special program gets infection by virus of Microsoft Windows, maybe modified, sending passphrase to somewhere of Windows partition. But install the passphrase program to a USB stick is much safer due to it is more isolated than in the hard drive. I want to know how to make a bootable USB for entering the passphrase that I can login Linux?
The special program you're referring to is inside the Linux kernel's initramfs. The initramfs contains a temporary / filesystem with the extra goodies it needs to mount the real / filesystem. In your case, it contains, among other things, the cryptsetup tool and a script (the special program) to get your passphrase.
So, to accomplish what you're after you basically need to make your USB disk the /boot partition of your system. /boot contains your Linux kernel, the initramfs, GRUB2 stage2, etc.
To be clear, you'd still boot off your internal disk, but GRUB2 will be reinstalled so that it loads it's configuration, other stages, and your kernel from your USB disk. The process is shown below, but before you embark, make sure you have an alternative way to gain access to your system, such as via a LiveCD/USB drive. This process will change the way Linux is loaded, and if it goes south you'll be up the creek without a plan B.
fdisk /dev/sdX(where sdX is the USB disk), create a partition on your USB disk.
- Format the aforementioned partition with a Linux filesystem (such as ext2, 3, or 4). Ex.
- Take a backup of your existing /boot. It's important so better safe than sorry. For example,
pushd /boot; tar -cvzf /root/boot-backup.tar.gz .; popd
- Mount the new filesystem somewhere, and copy the contents of the current /boot to it.
- Unmount the new filesystem, and re-mount it as your new /boot, updating /etc/fstab while your at it. The new /boot needs to be mounted for the next step.
- Re-install GRUB2 using whatever MBR it's currently reinstalled at:
grub-install /dev/sdY. The reason it needs to be reinstalled is because you've changed where /boot is located. This command will also install files into /boot/grub, hence the need to have it mounted (and have a backup).
- Regenerate GRUB2's config file:
grub-mkconfig -o /boot/grub/grub.cfg
- Review the generated config file at /boot/grub/grub.cfg. You should see it reference the USB disk (I don't remember if it uses a disk or filesystem UID).
Test the setup by booting with the USB drive plugged in. Then try booting with out the USB drive; which should not work.