4

I want to set up a headless GNU/Linux (Ubuntu 20.04) PC with full disk encryption, with the ability to unlock the disks either with a USB drive, or by entering a passphrase by keyboard. My starting point is a fresh install using the basic full disk encryption option in the installer, which manages everything besides /boot as a LUKS-encrypted logical volume group and gives me the keyboard option.

It would be ideal to me if I could simply have a small USB stick containing a passphrase that will unlock the disks. Not only would that be handy for servers (where you could leave the USB stick in the server - the goal is to be able to return broken harddisks without having to worry about confidential data), it would also be great for my laptop: Insert the USB stick when booting and remove it after unlocking the cryptodisk. And if the USB-disk breaks, use the keyboard.

How can this be done in a way that will work on a system that runs systemd?

(And if this question seems familiar it is due to: https://stackoverflow.com/a/23451824/363028 - which solved the problem, but is incompatible with systemd.)

Background

On my non-systemd system I use this patch https://gitlab.com/ole.tange/tangetools/tree/master/decrypt-root-with-usb

It searches the root dir of all devices for the file 'cryptkey.txt' and try decrypting with each line as a key. If that fails: Revert to typing in the pass phrase.

And it works exactly how I want, but systemd breaks this, so I cannot use this (at least not directly).

  • From reading the question, you know what you're talking about, so I don't think I have anything to add. One thing got me curious though - why did you want this solved by systemd? How would you want to use it to help with this problem? I'm not sure how you would see this being automated -- would be interesting to find out. – Pedro Apr 29 at 16:30
  • seems too obvious but would this be of use to you? discussion.fedoraproject.org/t/… (the method, not the specifics) – Pedro Apr 29 at 16:35
  • @Pedro I have updated the question: I do not need systemd to do the work. I just need a solution that works on a system running systemd. – Ole Tange Apr 29 at 16:42
  • @Pedro The discussion on Fedora seems to have no fall back to keyboard. – Ole Tange Apr 29 at 16:44
  • Checkout dracut and clevis it should have what you need or at least a good place to put the scritps that you'd need to use. Has fallback keyboard examples as well. github.com/latchset/clevis – Livinglifeback Apr 29 at 17:12
0

Digging deeper into the actual boot process I do not even need systemd, but can use my patch with few changes. So here is the updated version for Ubuntu 20.04 LTS: https://gitlab.com/ole.tange/tangetools/-/tree/master/decrypt-root-with-usb/ubuntu-20.04

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.