0

I have LVM partitions which are encrypted using LUKS. My root partition is /dev/HDD/root:

LVM group "HDD" (at /dev/HDD):
  Encrypted LUKS device "root" at /dev/HDD/root

I'm trying to decrypt it via grub parameters, GRUB_CMDLINE_LINUX:

dolvm crypt_root=/dev/HDD/root root=/dev/mapper/root root_keydev=UUID=<usb-uuid> root_key=hdd.key

The key for LUKS is located on usb-device at /hdd.key

But when it is loading, it shows error message:

>> Scanning for and activating Volume Groups
  Reading all physical volumes. This may take a while...
  Found volume group "HDD" using metadata type lvm
  3 logical volume(s) in volume group "HDD" now active
>> Using key device /dev/sdc2.
>> Removable device /dev/sdc2 mounted.
>> hdd.key on device /dev/sdc2 found
No key available with this passphrase.
!! Failed to open LUKS device /dev/HDD/root
!! Could not find the root in /dev/HDD/root.
!! Please specify another value or:
!! - press Enter for the same
!! - type "shell" for a shell
!! - type "q" to skip...

According to logs the volume group was found, the device with key was mounted successfully, the key on the device was found, but then it failed to open it using LUKS.

Then I'm using shell option to fix it manually. Device with the key is mounted to /mnt/key, so I can find it here and open LUKS device with this key:

cat /mnt/key/hdd.key | cryptsetup luksOpen /dev/HDD/root root

this command opens LUKS device at /dev/mapper/root, so I can exit the shell and press q to skip this error. After that the system is booting successfully.

It seems that something is wrong with my grub configuration, because it is possible to open LUKS device and mount it using my key manually, so my question is how to fix it to open LUKS device automatically on boot using grub2?

0

The issue was that I used a key as a passphrase for LUKS instead of keyfile. To convert it to keyfile it's needed to add a keyfile via cryptsetup and remove passphrase for it:

cat /bood/hdd.key | cryptsetup luksAddKey -d /bood/hdd.key /dev/root
cat /bood/hdd.key | cryptsetup luksRemoveKey /dev/root
0

A well explained article is here to setup with a LUKS partition.

Creating Encrypted file system in Red Hat Enterprise Linux 7 and Variants

Moreover, We may in need to remove the LUKS, in case use below steps for the same.

How to Safely remove a Luks encrypted disk from Red Hat 6, 7 Linux and variants

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.