How to open all LUKS volumes with use of a single password?

Question

I'm using EndeavorOS (basically Arch), but with systemd-boot and dracut for initrd. I have a simple setup with an unencrypted boot partition and LUKS-encrypted root and swap partitions. Specifically, the setup is described in the output below:

$ cat /etc/fstab
# <file system>             <mount point>  <type>  <options>  <dump>  <pass>
UUID=8A2F-4076                            /efi           vfat    defaults,noatime 0 2
/dev/mapper/luks-81733cbe-81f5-4506-8369-1c9b62e7d6be /              ext4    defaults,noatime 0 1
/dev/mapper/luks-9715a3f9-f701-47b8-9b55-5143ca88dcd8 swap           swap    defaults   0 0
tmpfs                                     /tmp           tmpfs   defaults,noatime,mode=1777 0 0

$ lsblk -f
NAME                                          FSTYPE      FSVER LABEL       UUID                                 FSAVAIL FSUSE% MOUNTPOINTS
nvme0n1                                                                                                                         
├─nvme0n1p1                                   vfat        FAT32             8A2F-4076                             915.6M     8% /efi
├─nvme0n1p2                                   crypto_LUKS 1                 81733cbe-81f5-4506-8369-1c9b62e7d6be                
│ └─luks-81733cbe-81f5-4506-8369-1c9b62e7d6be ext4        1.0   endeavouros d8d14c59-8704-4fb8-ad02-7d20a26bc1e1  843.6G     2% /
└─nvme0n1p3                                   crypto_LUKS 1                 9715a3f9-f701-47b8-9b55-5143ca88dcd8                
  └─luks-9715a3f9-f701-47b8-9b55-5143ca88dcd8 swap        1     swap        b003ea64-a38d-464c-8609-7278e21f8a0f                [SWAP]

The problem is that each time I boot up the computer, I need to enter my password twice; once for the root partition and once of the swap (note I use the same password for both if that helps). This has become nuisance. So my question is: Is there a way to automatically decrypt my swap partition upon a successful passphrase for the root?

There has been a question very similar to this with a sensible answer, but did not work. The first part of the answer is Debian-centric with a script option not present in other distributions. The second part uses crypttab to specify the location of a keyfile used to decrypt other partitions.

As of now, my crypttab in initrd looks like this, which specifies a /crypto_keyfile.bin that exists in the root partition to open either of the partitions:

$ lsinitrd --file /etc/crypttab
luks-81733cbe-81f5-4506-8369-1c9b62e7d6be /dev/disk/by-uuid/81733cbe-81f5-4506-8369-1c9b62e7d6be /crypto_keyfile.bin luks
luks-9715a3f9-f701-47b8-9b55-5143ca88dcd8 /dev/disk/by-uuid/9715a3f9-f701-47b8-9b55-5143ca88dcd8 /crypto_keyfile.bin luks

This approach does not work for two reasons:

1. Contrary to what the linked answer suggests (being that the user is queried for the partitions by the order of crypttab entries), the order is random at each boot. Even if I could automatically open my swap partition after opening the root, if swap comes first, then I am still forced to enter the password for root since keyfile is on root.
2. It seems to me that after entering password for root, the filesystem is not mounted immediately. The /crypto_keyfile.bin is actually searched inside the initrd filesystem, which explains the following errors in journal appearing twice: systemd-cryptsetup[460]: Failed to activate, key file '/crypto_keyfile.bin' missing.

So if I am on the right track, how could I ensure systemd-cryptsetup to query me first for the root partition and second for the swap each time, and how can I ensure that after opening root, the filesystem is mounted and /crypto_keyfile.bin is successfully found to open the swap partition?

Otherwise, if I am completely off track here, is there a way to achieve what I want?

Thanks.

Answer 1

Not an Arch expert, the Debian-centic script works well for me on Debian, but according to this Archwiki page should, or at least is expected to work.

Passwords entered during boot are cached in the kernel keyring by systemd-cryptsetup(8), so if multiple devices can be unlocked with the same password (this includes devices in crypttab that are unlocked after boot), then you will only need to input each password once.

What seems wrong in your setup is that you have your crypttab configured to use a keyfile for the root partition while the keyfile is stored in the encrypted root partition. Since you don't mind to enter a password and use the same password for both, setting none as keyfile in crypttab might solve your problem.

The systemd-cryptsetup manpage also explicit mentions password caching so the order in which they are opened should not matter for you.

Just in case: if you do not use hibernate/resume you could also encrypt the swap partition with a random key.