I have one physical server and would like to configure full disk encryption for it.

First I was playing around with an virtual machines (CentOS7) and have enabled it during installation:

enter image description here

On reboot I get the following prompt and can successfully unlock the drive:enter image description here

[root@srv~]# lsblk
NAME                                          MAJ:MIN RM  SIZE RO TYPE  MOUNTPOINT
sda                                             8:0    0   20G  0 disk
├─sda1                                          8:1    0    1G  0 part  /boot
└─sda2                                          8:2    0   19G  0 part
  └─luks-9ca13c53-317d-42c5-a3ea-c6039274bf38 253:0    0   19G  0 crypt
    ├─centos_otrs-root                        253:1    0   17G  0 lvm   /
    └─centos_otrs-swap                        253:2    0    2G  0 lvm   [SWAP]
sr0                                            11:0    1 1024M  0 rom

AFAICS the bootpartition is not encrypted. How could I possibly perform a true full disk encryption and still be able to use the crypt-ssh dracut module for remote unlocking of systems with disk encryption via ssh.


  • You get a chicken-and-egg problem: how to decrypt the code that will decrypt the next stage since that code is encrypted? At which layer will you stop? – A.B Apr 17 at 17:24

From https://mirrors.edge.kernel.org/pub/linux/utils/boot/dracut/dracut.html#_crypto_luks

dracut --add ssh initramfs.img
dracut --add crypt initramfs.img

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.