During installation, whenever I put /boot inside an LVM on top of LUKS along with swap, / and /home, afterwards when I try to boot into it, it only gives me the minimal bash-like grub terminal. This doesn't happen when /boot is left outside unencrypted.

I'm opting for FDE so I want /boot to be inside the LVM on LUKS. So what gives? I reckon Debian Installer uses LUKS 2 or otherwise it messes up the install in some other way that's beyond the scope of my knowledge. I tried to find similar threads but no luck.

  • 1
    you tell us... what does cryptsetup luksDump say – frostschutz Oct 10 '19 at 21:47

As of Debian Buster, the installer uses the LUKS2 format. As described in the release notes...

The cryptsetup version shipped with Debian buster uses the new on-disk LUKS2 format. New LUKS volumes will use this format by default.

Please note that the GNU GRUB bootloader doesn't support the LUKS2 format yet. See the corresponding documentation for further information on how to install Debian 10 with encrypted boot. -source: https://www.debian.org/releases/buster/amd64/release-notes/ch-whats-new.en.html#cryptsetup-luks2

The Debian documentation proceeds to describe work-arounds for getting full disk encryption to work on Buster.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.