I already asked once about LUKS unlocking of multiple HDDs in Linux: LUKS and multiple hard drives.
Now I would like to know how to secure store the keyfile used for the automatic unlock of the associated partitions.
My plan is (if possible):
Encrypt a small USB drive with LUKS that requires a passphrase
Unlock it at boot as the first drive by using the passphrase
Mount it to a given mount point, for instance /test (is this possible ?)
Now the keyfile can be safely read: /test/keyfile
Use the keyfile to unlock other drives without needing to ask password for them
LuksClose the USB drive in order to assure a certain degree of safety as soon as other drives have been unlocked
Automount /, /usr, /var and other mount-points as usual
Can this work? Basically I store the LUKS keyfile on a password-encrypted LUKS USB drive that only asks for passphrase once, while all other drives can be unlocked without further action. I'm not sure if there is some way to make the USB drive be unlocked first, then be mounted and only then the other drives try to access the keyfile. Furthermore in what concerns automation I suppose /etc/fstab and /etc/crypttab should be accessible BEFORE the other drives can be mounted, but this is not possible if the whole / file system is LUKS encrypted.
Unless there is the possibility of fully manually configure how LUKS works:
LuksOpen /dev/sdc1 usb_keyfile
mount /dev/mapper/usb_keyfile /keyfile (is this possible ?)
LuksOpen --keyfile /keyfile/key /dev/sda1 disk1
LuksOpen --keyfile /keyfile/key /dev/sdb1 disk2
LuksClose /dev/sdc1
Basically being able to run a shell script just after the required modules have been loaded and disable automatic LUKS password prompt.
Additionnal details
- Distribution used: Gentoo GNU/Linux (amd64) or Debian GNU/Linux (amd64) because I'd like to apply this procedure to multiple installations
/
gets mounted. One critical piece of information that's missing for your question to be properly answerable though is what distribution are you using?.