I'v set up a debian install like this :

  • /dev/sdb5 is /boot
  • /dev/sdb6 is LUKS encrypted /
  • /dev/sdb7 is LUKS encrypted swap

This works well however I need to enter 2 passphrases at each boot.

Is there a way to modify this setup so as to use only one passphrase without wiping the disk?

I used to have a system where (if I remember well) there was an encrypted key file on the boot partition. I enter one phrase to decrypt it and it would be used to decrypt all the partitions.

  • Have a look at crypttab for auto-unlocking the other LUKS containers on boot. I'd advise redoing the whole thing and setting up LVM for / and swap inside the LUKS container instead. – Mioriin Jan 2 '18 at 22:10
  • Do they both have the same passphrase? If Debian uses systemd early boot, that should work as systemd cryptsetup reuses passphrases and only asks for new ones, when the old one didn't work. So systemd can open any number of LUKS containers with a single passphrase (as long as all containers have the same one). – frostschutz Jan 2 '18 at 22:11
  • Add the key to the swap partition to /etc/crypttab – jasonwryan Jan 2 '18 at 22:11
  • If you don't use suspend to disk, you could encrypt swap without passphrase (random key on each boot) but I don't know how to implement that in current Debian, sorry. – frostschutz Jan 2 '18 at 22:12
  • I may use suspend to disk. They actually have the same passphrase. I would need to set up swap encryption with a key instead of passphrase and follow the arch doc ? I don't get where is the key safely stored if /etc/crypttab is read before the filesystem is mounted. – Lich4r Jan 2 '18 at 22:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.