2

I am on the latest OpenSUSE Tumbleweed and this guide has not worked for me.

I did everything like in the guide except I did not generate a new random key and added it to the harddisk but used the passphrase I always used and wrote that into /.root.key.

But I am still asked for the password but it seems cryptsetup or whatever is smart enough to automatically try it for all my other HDDs that also use the same passphrase as the SSD. So I have to enter it for Grub, then I am asked again to unlock the SSD again during boot.

How can I see if the /.root.key is added to the initramfs?

3

I did everything like in the guide except I did not generate a new random key and added it to the harddisk but used the passphrase I always used and wrote that into a file.

Passphrase in file works fine, but it must not have newline at the end.

Verify that it works with --key-file option:

cryptsetup open --verbose --key-file yourfile --test-passphrase /dev/yourdevice

How can I see if the /.root.key is added to the initramfs?

Use one of lsinitrd, lsinitramfs, lsinitcpio or just unpack it yourself.

mkdir /tmp/initramfs
cd /tmp/initramfs
gunzip < /boot/initrd.gz | cpio -div -H newc --no-absolute-filenames

This command may be different if e.g. it's not gzip compressed but xz or something else. Adapt as you see fit.

Alternatively, if the initrd drops you to a emergency shell, you can of course also use that to explore the initrd state then.

ls -al
hexdump -C .root.key # or similar

it seems cryptsetup or whatever is smart enough to automatically try it for all my other HDDs that also use the same passphrase as the SSD

This is a systemd feature, systemd-ask-password --accept-cached (accept cached passwords, i.e. passwords previously entered). Maybe it has found its way into other flavors of initramfs as well. It's a good solution, typing passphrase twice is still somewhat acceptable, typing it 10 times in a row...

Not all distributions use this feature and I do not know if it cooperates with the keyfile approach as outlined in your guide. You'll have to debug that yourself.

  • 1
    Damn I think the newline was the issue, I am going like this for weeks because I was to lazy to open a question and got no help on the SUSE Subreddit. I used gnome-disks that edited keyfiles with a different setup on Ubuntu in the past this time I wrote it myself with nano and it adds that newline. nano --nonewlines fixes it. Passphrase test went well, will do a reboot check later but I guess this is fixed. – redanimalwar Aug 1 at 16:50
  • K, rebooting works - yey. – redanimalwar Aug 2 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.