I am trying to setup my initramfs with mkinitcpio -P so it decrypts my LUKS/LVM partition containing the root file system on startup.

I followed the steps on here . Everything already works fine, by adding HOOKs encrypt and lvm2 among others, see mkinitcpio.conf below.

Now I would like to have asterisk characters being echoed when I enter the password for the LUKS encrypted partition.

I found a nice command line tool for doing so: systemd-ask-password.

So I modified /etc/mkinitcpio.conf accordingly, so it adds systemd-ask-password as a binary, and /usr/lib/initcpio/hooks/encrypt to use systemd-ask-password for querying the password and pipe the output to cryptsetup and ran mkinitcpio -P.

But it does not mask the password characters with asterisks! It echoes them one by one, which is not secure and not what I intended. In a readily booted system, in a regular terminal and bash, it works perfectly fine. But it seems like the "terminal" during bootup behaves differently. Or the systemd-ask-password command behaves differently in that environment.

How can I get systemd-ask-password to work properly in the boot terminal environment?

Or: Is there a better way to achieve what I want, to echo the password characters as asterisks?



run_hook() {
    modprobe -a -q dm-crypt >/dev/null 2>&1
    [ "${quiet}" = "y" ] && CSQUIET=">/dev/null"

    # Get keyfile if specified
    if [ -n "$cryptkey" ]; then
        IFS=: read ckdev ckarg1 ckarg2 <<EOF

        if [ "$ckdev" = "rootfs" ]; then
        elif resolved=$(resolve_device "${ckdev}" ${rootdelay}); then
            case ${ckarg1} in
                    # Use a file on the device
                    # ckarg1 is not numeric: ckarg1=filesystem, ckarg2=path
                    mkdir /ckey
                    mount -r -t "$ckarg1" "$resolved" /ckey
                    dd if="/ckey/$ckarg2" of="$ckeyfile" >/dev/null 2>&1
                    umount /ckey
                    # Read raw data from the block device
                    # ckarg1 is numeric: ckarg1=offset, ckarg2=length
                    dd if="$resolved" of="$ckeyfile" bs=1 skip="$ckarg1" count="$ckarg2" >/dev/null 2>&1
        [ ! -f ${ckeyfile} ] && echo "Keyfile could not be opened. Reverting to passphrase."

    if [ -n "${cryptdevice}" ]; then
        IFS=: read cryptdev cryptname cryptoptions <<EOF

    # This may happen if third party hooks do the crypt setup
    if [ -b "/dev/mapper/${cryptname}" ]; then
        echo "Device ${cryptname} already exists, not doing any crypt setup."
        return 0

    warn_deprecated() {
        echo "The syntax 'root=${root}' where '${root}' is an encrypted volume is deprecated"
        echo "Use 'cryptdevice=${root}:root root=/dev/mapper/root' instead."

    set -f
    OLDIFS="$IFS"; IFS=,
    for cryptopt in ${cryptoptions}; do
        case ${cryptopt} in
                cryptargs="${cryptargs} --allow-discards"
                echo "Encryption option '${cryptopt}' not known, ignoring." >&2
    set +f
    unset OLDIFS

    if resolved=$(resolve_device "${cryptdev}" ${rootdelay}); then
        if cryptsetup isLuks ${resolved} >/dev/null 2>&1; then
            [ ${DEPRECATED_CRYPT} -eq 1 ] && warn_deprecated
            # If keyfile exists, try to use that
            if [ -f ${ckeyfile} ]; then
                if eval cryptsetup --key-file ${ckeyfile} open --type luks ${resolved} ${cryptname} ${cryptargs} ${CSQUIET}; then
                    echo "Invalid keyfile. Reverting to passphrase."
            # Ask for a passphrase
            if [ ${dopassphrase} -gt 0 ]; then
                echo ""
                echo "A password is required to access the ${cryptname} volume:"

                #loop until we get a real password
                while ! eval systemd-ask-password | cryptsetup open --type luks ${resolved} ${cryptname} ${cryptargs} ${CSQUIET}; do
                    sleep 2;
            if [ -e "/dev/mapper/${cryptname}" ]; then
                if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
                    export root="/dev/mapper/root"
                err "Password succeeded, but ${cryptname} creation failed, aborting..."
                return 1
        elif [ -n "${crypto}" ]; then
            [ ${DEPRECATED_CRYPT} -eq 1 ] && warn_deprecated
            msg "Non-LUKS encrypted device found..."
            if echo "$crypto" | awk -F: '{ exit(NF == 5) }'; then
                err "Verify parameter format: crypto=hash:cipher:keysize:offset:skip"
                err "Non-LUKS decryption not attempted..."
                return 1
            exe="cryptsetup open --type plain $resolved $cryptname $cryptargs"
            IFS=: read c_hash c_cipher c_keysize c_offset c_skip <<EOF
            [ -n "$c_hash" ]    && exe="$exe --hash '$c_hash'"
            [ -n "$c_cipher" ]  && exe="$exe --cipher '$c_cipher'"
            [ -n "$c_keysize" ] && exe="$exe --key-size '$c_keysize'"
            [ -n "$c_offset" ]  && exe="$exe --offset '$c_offset'"
            [ -n "$c_skip" ]    && exe="$exe --skip '$c_skip'"
            if [ -f "$ckeyfile" ]; then
                exe="$exe --key-file $ckeyfile"
                echo ""
                echo "A password is required to access the ${cryptname} volume:"
            eval "$exe $CSQUIET"

            if [ $? -ne 0 ]; then
                err "Non-LUKS device decryption failed. verify format: "
                err "      crypto=hash:cipher:keysize:offset:skip"
                return 1
            if [ -e "/dev/mapper/${cryptname}" ]; then
                if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
                    export root="/dev/mapper/root"
                err "Password succeeded, but ${cryptname} creation failed, aborting..."
                return 1
            err "Failed to open encryption mapping: The device ${cryptdev} is not a LUKS volume and the crypto= paramater was not specified."
    rm -f ${ckeyfile}

# vim: set ft=sh ts=4 sw=4 et:


# vim:set ft=sh
# The following modules are loaded before any boot hooks are
# run.  Advanced users may wish to specify all system modules
# in this array.  For instance:
#     MODULES=(piix ide_disk reiserfs)

# This setting includes any additional binaries a given user may
# wish into the CPIO image.  This is run last, so it may be used to
# override the actual binaries included by a given hook
# BINARIES are dependency parsed, so you may safely ignore libraries

# This setting is similar to BINARIES above, however, files are added
# as-is and are not parsed in any way.  This is useful for config files.

# This is the most important setting in this file.  The HOOKS control the
# modules and scripts added to the image, and what happens at boot time.
# Order is important, and it is recommended that you do not change the
# order in which HOOKS are added.  Run 'mkinitcpio -H <hook name>' for
# help on a given hook.
# 'base' is _required_ unless you know precisely what you are doing.
# 'udev' is _required_ in order to automatically load modules
# 'filesystems' is _required_ unless you specify your fs modules in MODULES
# Examples:
##   This setup specifies all modules in the MODULES setting above.
##   No raid, lvm2, or encrypted root is needed.
#    HOOKS=(base)
##   This setup will autodetect all modules for your system and should
##   work as a sane default
#    HOOKS=(base udev autodetect block filesystems)
##   This setup will generate a 'full' image which supports most systems.
##   No autodetection is done.
#    HOOKS=(base udev block filesystems)
##   This setup assembles a pata mdadm array with an encrypted root FS.
##   Note: See 'mkinitcpio -H mdadm' for more information on raid devices.
#    HOOKS=(base udev block mdadm encrypt filesystems)
##   This setup loads an lvm2 volume group on a usb device.
#    HOOKS=(base udev block lvm2 filesystems)
##   NOTE: If you have /usr on a separate partition, you MUST include the
#    usr, fsck and shutdown hooks.
HOOKS=(base udev autodetect keyboard keymap consolefont modconf block encrypt lvm2 filesystems fsck)

# Use this to compress the initramfs image. By default, zstd compression
# is used. Use 'cat' to create an uncompressed image.

# Additional options for the compressor
  • Not directly answering your question, but an alternative you have is to switch to systemd init (see Mkinitcpio). You may then replace the mkinitcpio encrypt hook with the sd-encrypt one, which behaves the way you are looking for by default.
    – fra-san
    May 24, 2021 at 10:40
  • I tried your suggestion, sorry it took so long. Replaced the following lines as follows: BINARIES=() ... `HOOKS=(base systemd autodetect keyboard sd-vconsole modconf block sd-encrypt lvm2 filesystems fsck)' And it works fine, exactly as I wanted it. Thank you! Yes, it did not directly answer my question, but pointed me towards this good solution.
    – Bernd
    Jun 23, 2021 at 13:31

1 Answer 1


I still don't have a direct answer to the first of my exact original questions (how to get systemd-ask-password to work properly in a busybox environment), but achieved what I wanted by using systemd instead of busybox for booting. For this, I modified the following lines in the files:


HOOKS=(base systemd autodetect keyboard sd-vconsole modconf block sd-encrypt lvm2 filesystems fsck)

And now it behaves exactly as I wanted it: When I enter the LUKS passphrase, it echoes every character that I type as an asterisk *, so I have my deisred visual feedback now.

Thank you very much @fra-san for pointing me towards this solution!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.