I'm running DietPi (Debian) on a raspberry pi where I've mounted an external drive encrypted with LUKS. I use a USB drive to decrypt the LUKS device at boot/login using:
/etc/crypttab as such:
<mapper name> UUID=<uuid of luks-part> /mnt/key-usb/my_keyfile
/etc/cryptdisks like so:
and finally a
/etc/fstab like this:
... UUID=<mapper\decrypted device> /mnt/decrypted auto defaults,rw,noatime,nofail, x-systemd.automount 0 0 UUID=<uuid of key USB> /mnt/key-usb auto auto defaults,rw,noatime,nofail, x-systemd.automount,x-systemd.device-timeout=5 0 0 ...
This unlocks/decrypts the LUKS partition on boot and I can access my files. But if I remove the usb mounted to
/mnt/key-usb I cannot access the files anymore. Is there a way to keep the device unlocked without the USB present until the user logs off or reboots the machine?
I've seen some setups where a fourth column is added to the
etc/crypttab such as
keyscript=devpass|decrypt_keyctl, I tried that but it did nothing. It seems this script should be located in
/lib/cryptdisks/scripts/ but on my machine these seem to be located in
/lib/cryptsetup/scripts/. How would one (could one?) make this possible with a custom script?