I've setup a server with luks devices (not used for root partition), they are listed in /etc/crypttab this way

# <target name> <source device>      <key file>   <options>
luks_device_1  /dev/mapper/vg-lv_1   none         luks

I've also setup a tang server and bound the devices to tang using the command

clevis luks bind -d /dev/mapper/vg-lv_1 tang '{"url":"http://svr"}'

finally I enable the units clevis-luks-askpass.path and clevis-luks-askpass.service to have the automatic unlocking mechanism working at boot.

However the devices are not unlocked at boot, the password is asked on the console, unless I add in the file /etc/crypttab the string _netdev in the options section. But I'm not really fond of that because _netdev is supposed to be used for network devices.

Did I miss something ?


Actually, according the manpage clevis-luks-unlockers(7) having the option _netdev in /etc/crypttab is necessary to trigger the automatic unlocking.

After a reboot, Clevis will attempt to unlock all _netdev devices listed in /etc/crypttab when systemd prompts for their passwords. This implies that systemd support for _netdev is required.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.