1

Running Debian 11 with grub, full disk encryption (no LVM) on /dev/sdb2, unencrypted /boot/efi on /dev/sdb1.

At boot, I want two options:

  1. typing password
  2. plugging an encrypted USB key (which stores a LUKS key-file in order to unlock /dev/sdb2).

(same use case as Luks encrypted USB startup key - except I want no password typing at all when I insert USB key).

My USB key is encrypted, so I need to automatically unlock it at boot. For this purpose, I have created a LUKS key-file which is stored in /boot/efi.

Here is my resulting /etc/crypttab:

USB-KEY /dev/disk/by-label/USB-KEY_LUKSCONTAINER  /boot/efi/USB-KEY.key  luks,keyscript=/bin/cat
cryptroot UUID=xxxx-xxxx--xxxx-xxx  /dev/disk/by-label/USB-KEY:/secret.key:20 luks,discard,keyscript=/lib/cryptsetup/scripts/passdev

I've updated /etc/fstab for USB-KEY to be automatically mounted :

/dev/mapper/USB-KEY
UUID=yyyy-yyyy-yyyy-yyyy  /mnt/USB-KEY  ext4  nosuid,rw  0 0

At boot, although USB key is inserted, I am stuck on cryptsetup prompt - and if I type my LUKS password I obtain this message: "cryptsetup failed, bad password or options?". Where am I wrong?

Improve this question
5
  • which is stored in /etc/keys/ is that file in the USB drive or ... where?
    – Jaromanda X
    Commented Apr 5, 2023 at 6:47
  • /etc/keys/ is on /dev/sb2 (root filesystem)
    – secu4tux
    Commented Apr 5, 2023 at 7:12
  • So, the key to unlocking the USB is on sdb2 and the key to unlocking sdb2 is on the USB?
    – Jaromanda X
    Commented Apr 5, 2023 at 7:20
  • Aha! you're rightI The key should be on unencrypted /bot/efi (/dev/sdb1).
    – secu4tux
    Commented Apr 5, 2023 at 9:02
  • I have edited my post with correct folder for secret.key. Still same error message.
    – secu4tux
    Commented Apr 5, 2023 at 10:46

1 Answer 1

Reset to default
0

In fstab, only the first field specifies the file system and second is mount point (from man fstab), so fix the fstab format.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .