I'm running DietPi (Debian) on a raspberry pi where I've mounted an external drive encrypted with LUKS. I use a USB drive to decrypt the LUKS device at boot/login using:

a /etc/crypttab as such:

<mapper name> UUID=<uuid of luks-part> /mnt/key-usb/my_keyfile

a /etc/cryptdisks like so:


and finally a /etc/fstab like this:

UUID=<mapper\decrypted device> /mnt/decrypted auto defaults,rw,noatime,nofail, x-systemd.automount 0 0
UUID=<uuid of key USB> /mnt/key-usb auto auto defaults,rw,noatime,nofail, x-systemd.automount,x-systemd.device-timeout=5 0 0

This unlocks/decrypts the LUKS partition on boot and I can access my files. But if I remove the usb mounted to /mnt/key-usb I cannot access the files anymore. Is there a way to keep the device unlocked without the USB present until the user logs off or reboots the machine?

I've seen some setups where a fourth column is added to the etc/crypttab such as keyscript=devpass|decrypt_keyctl, I tried that but it did nothing. It seems this script should be located in /lib/cryptdisks/scripts/ but on my machine these seem to be located in /lib/cryptsetup/scripts/. How would one (could one?) make this possible with a custom script?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.