Basically what I need is to decrypt root device automatically with a keyfile stored on a usb with a partition scheme (ext3, ext4 I don't mind).

I successfully implemented the script method with dd command, which basically stores the key in the padding between the start of the (usb) memory and the first partition (eg, the first 2048 bits of the device). Basically this method uses a udev rule to link /dev/usbkey with e.g. /dev/sdc and a script which reads (with dd) the first 2048 bits of the former device to decipher the partition. See here.

Sadly this is not a viable method for me, I really need to mount the usb filesystem (possibly ro), read the file, unlock the encrypted device and unmount the filesystem.

I've tried different methods, like the one detailed on arch documentation, without success. Even more I cannot figure out what is explained here, some steps seems missing to me. For example in the script method if the usb key is not present, it prompts for the passphrase; on the arch method this seems unimplemented, or implemented implicitly.

With the arch method my system seems just unable to find the key (even if I've added the modules ext3 and ext4 to the initramfs) and it hangs.

So here's my question: how does ones decrypt (luks) the root partition, using a keyfile stored on a partition on a usb key?

Where may I find information about this stuff, aka where should I start?



My partition scheme looks like this:

sdb                       8:16   0 465.8G  0 disk  
├─sdb1                    8:17   0   243M  0 part  /boot
├─sdb2                    8:18   0     1K  0 part  
└─sdb5                    8:21   0 465.5G  0 part  
  └─cryptroot           254:0    0 465.5G  0 crypt 
    ├─debian--vg-root   254:1    0   450G  0 lvm   /
    └─debian--vg-swap_1 254:2    0  15.6G  0 lvm   [SWAP]
  • Did you forget the usb storage module? If you want to solve it yourself, perhaps these might get you started: wiki.debian.org/initramfs - manpages.debian.org/stretch/initramfs-tools/… - wiki.gentoo.org/wiki/Custom_Initramfs Sep 27, 2018 at 15:42
  • On a sidenote, cryptsetup is perfectly able to read a key from a raw device at an offset, no need for dd. Only reason to use dd anyway is if the cryptsetup call is hidden so deep in the initramfs that you can't modify it, and doesn't already support these options. I think debian's crypttab does have keyfile, keyfile-size, and keyfile-offset support though, so you could get away without writing a custom hook - but I'm not sure. Sep 27, 2018 at 15:45
  • Also found this, maybe it will help you: lists.debian.org/debian-user/2017/12/msg00523.html Sep 27, 2018 at 15:54
  • wow! this seems perfect for me, I'll try asap. Thanks!
    – LotoLo
    Sep 27, 2018 at 16:08
  • UPDATE: I've tried to use the method described on the mail, but sadly it does not work. Or at least it works partially. I mean with a LVM partition scheme (like the one I have described in the question) it does not work: hung at boot, can't find device mapper. BUT with a 'pure' ext4 partition scheme (without LVM) it DOES work! Now that's really strange and I'm currently working to understand why this flyer does not want to work with LVM. I think it may be because of a cmdline parameter.
    – LotoLo
    Oct 2, 2018 at 14:13


You must log in to answer this question.

Browse other questions tagged .