Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
Hi my crypttab looks as follows:
crypt_device /dev/sda luks,header=/boot/header.img
update-initramfs -u -k all works with success, but for some reason cryptsetup will not find the header.img which resides on the usb stick (that also contains the boot partition) during boot. It is stored on /boot/header.img
(using luks encryption with detached header, and seperate boot partition on usb, os: lubuntu 18)
Unless you've taken special steps to mount the /boot filesystem under initramfs, it won't be mounted yet. In a default boot sequence, the system only cares about the root filesystem (and possibly the swap partition) while executing in initramfs.
Once the real root filesystem has been checked (if applicable) and mounted, the rest of the filesystems, normally including /boot, are mounted. You would need to make some special arrangement to mount the /boot filesystem while still in initramfs to gain access to /boot/header.img. Or you could just include your header.img into initramfs.
Since your USB drive is also your boot drive, the system only loads the initramfs image to memory until the root partition is decrypted and newroot is remapped. This is where manual mount of the USB drive would be necessary from within the initramfs or an update to fstab needs to be made to mount the partition which contains the key file. Although you mentioned that that during boot it is stored in /boot/header.img it's because the USB is no longer mounted when the initramfs is loaded into RAM for the boot processs. Therefore when crypttab initiates, cryptsetup cant find the /boot/header.img file because the directory for /boot on the USB hasn't been mounted within the initramfs environment which is currently loaded to decrypt your hard drive's root folder.
To be sure, as telcoM explained, if you previously booted into your system and created a keyfile while the OS was unlocked and the partition was decrypted and then placing a copy of the keyfile.img within your /boot directory at that point in time (and again, and this is while the system is unencrypted and you're already accessing the system) then it's not the same /boot directory you find when you're booting up and the USB contains the boot drive; that's what we're both trying to say. This is because during the boot process, it has opened and copied the initrd-4.15.33-generic image (for example) and does not mount automatically the USB device as a storage container.
So to resolve, you need fstab to mount the USB to the /boot directory so that crypttab can locate the directory when it's called for by cryptsetup
See the fstab man page for explanations if needed for below: e.g.
# First find the UUID of the partition holding your USB thumb drive
$ blkid
# You can also use grep or whatever you're more comfortable with as a text editor
$ nano /etc/fstab
# then add a line for your USB device
UUID={device partition UUID} {mount point} {filesystem} {mount options} {dump order}{fsck order}
# Example
UUID=66E53SSD988 /boot ext4 defaults 0 1
However, I would suggest mounting the drive somewhere other than in the /boot directory unless that's just the directory within the USB and then modifying crypttab so that there's less confusion between what folder the header.img file is in.
i.e.
UUID=66E53SSD988 /mnt/usb ext4 defaults 0 1
Then, in the case of the changed mount point, crypttab would in turn need to be changed to the following :
crypt_device /dev/sda luks,header=/mnt/usb/boot/header.img
