tang / clevis: automatic unlocking for luks device not triggered unless defined as _netdev

Question

I've setup a server with luks devices (not used for root partition), they are listed in /etc/crypttab this way

# <target name> <source device>      <key file>   <options>
luks_device_1  /dev/mapper/vg-lv_1   none         luks
...

I've also setup a tang server and bound the devices to tang using the command

clevis luks bind -d /dev/mapper/vg-lv_1 tang '{"url":"http://svr"}'

finally I enable the units clevis-luks-askpass.path and clevis-luks-askpass.service to have the automatic unlocking mechanism working at boot.

However the devices are not unlocked at boot, the password is asked on the console, unless I add in the file /etc/crypttab the string _netdev in the options section. But I'm not really fond of that because _netdev is supposed to be used for network devices.

Did I miss something ?

Answer 1

Actually, according the manpage clevis-luks-unlockers(7) having the option _netdev in /etc/crypttab is necessary to trigger the automatic unlocking.

After a reboot, Clevis will attempt to unlock all _netdev devices listed in /etc/crypttab when systemd prompts for their passwords. This implies that systemd support for _netdev is required.