I have a system with an unencrypted
/ partition on Ubuntu 16.04, but with a LUKS encrypted ZFS zpool on 3 partitions. In order for the system to boot properly I want for the LUKS encrypted volumes to be unlocked before ZFS and other services (like database, web, email etc.) start, and this needs to be able to done remotely, through SSH.
With the 3 partitions added to the
/etc/crypttab, the system boots and just after the
initramfs stage will wait for unlock (and prompt for passwords). However, the usual way of accomplishing LUKS unlock at boot remotely is done through
initramfs, however because the 3 partitions are not in
fstab the system will 'fall through'
initramfs so to speak and continue to
systemd. This is undesirable in this case as
crypttab over the
dropbear meaning remote unlocking is disabled.
A dirty hack that works is simply adding a
sleep 300 in initramfs, giving you time to login through
dropbear and unlock, however this too is undesirable. I see foresee two options to fix this, but am not sure which would be best and I do not know how to implement either:
systemdboot order, to make sure something like
OpenSSHare up before
crypttab, enabling remote or local unlocking.
initramfswait for non-trivial partitions to be unlocked before proceeding to