Basically what I need is to decrypt root device automatically with a keyfile stored on a usb with a partition scheme (ext3, ext4 I don't mind).
I successfully implemented the script method with
dd command, which basically stores the key in the padding between the start of the (usb) memory and the first partition (eg, the first 2048 bits of the device). Basically this method uses a udev rule to link
/dev/usbkey with e.g.
/dev/sdc and a script which reads (with
dd) the first 2048 bits of the former device to decipher the partition. See here.
Sadly this is not a viable method for me, I really need to mount the usb filesystem (possibly
ro), read the file, unlock the encrypted device and unmount the filesystem.
I've tried different methods, like the one detailed on arch documentation, without success. Even more I cannot figure out what is explained here, some steps seems missing to me. For example in the script method if the usb key is not present, it prompts for the passphrase; on the arch method this seems unimplemented, or implemented implicitly.
With the arch method my system seems just unable to find the key (even if I've added the modules ext3 and ext4 to the initramfs) and it hangs.
So here's my question: how does ones decrypt (luks) the root partition, using a keyfile stored on a partition on a usb key?
Where may I find information about this stuff, aka where should I start?
My partition scheme looks like this:
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT sdb 8:16 0 465.8G 0 disk ├─sdb1 8:17 0 243M 0 part /boot ├─sdb2 8:18 0 1K 0 part └─sdb5 8:21 0 465.5G 0 part └─cryptroot 254:0 0 465.5G 0 crypt ├─debian--vg-root 254:1 0 450G 0 lvm / └─debian--vg-swap_1 254:2 0 15.6G 0 lvm [SWAP]