0

I'm trying to setup grub to boot from encrypted /boot on BTRFS based RAID1 array. However, I'm cannot find a way to force grub to unlock both disks. GRUB asks for key twice to unlock /boot, but I don't know how to ask it to unlock two cryptdevices after that. Here the boot process:

Unlock /dev/sda2: /dev/sda2 Unlock /dev/sdb2: /dev/sdb2 grub asks for /dev/sdb2 password grub asks for /dev/sdb2 password and fails since /dev/mapper/root1 is not found and fails since /dev/mapper/root1 is not found

Here is how relevant parts of config files look like:

/etc/default/grub.cfg:

...
GRUB_CMDLINE_LINUX_DEFAULT="cryptdevice=/dev/sda2:root1 cryptkey=rootfs:/cryptfile.bin cryptdevice=/dev/sdb2:root2 cryptkey=rootfs:/cryptfile.bin root=/dev/mapper/root1 rootfstype=btrfs rootflags=device/dev/mapper/root1,device=/dev/mapper/root2,defaults"
GRUB_ENABLE_CRYPTODISK=y
...

Disk partitioning looks like:

/sda
    /sda1 - SWAP
    /sda2 - dmcrypt
        /root1 - / (RAID1)
/sdb
    /sdb1 - SWAP
    /sdb2 - dmcrypt
        /root2 - / (RAID1)

Any help please?

0

Working advice from reddit:

  1. Find the encrypt boot hook (the one that is bundled inside your initramfs)
  2. copy it and create encrypt2 from it. Remove some sanitation lines from it (like clearing some files or folders)
  3. add encrypt2 to your hooks (mkinitcpio.conf(5)), encrypt2_* arguments to your kernel cmdline, rebuild the initramfs.
  4. reboot?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.