I'm using EndeavorOS (basically Arch), but with systemd-boot and dracut for initrd. I have a simple setup with an unencrypted boot partition and LUKS-encrypted root and swap partitions. Specifically, the setup is described in the output below:
$ cat /etc/fstab # <file system> <mount point> <type> <options> <dump> <pass> UUID=8A2F-4076 /efi vfat defaults,noatime 0 2 /dev/mapper/luks-81733cbe-81f5-4506-8369-1c9b62e7d6be / ext4 defaults,noatime 0 1 /dev/mapper/luks-9715a3f9-f701-47b8-9b55-5143ca88dcd8 swap swap defaults 0 0 tmpfs /tmp tmpfs defaults,noatime,mode=1777 0 0 $ lsblk -f NAME FSTYPE FSVER LABEL UUID FSAVAIL FSUSE% MOUNTPOINTS nvme0n1 ├─nvme0n1p1 vfat FAT32 8A2F-4076 915.6M 8% /efi ├─nvme0n1p2 crypto_LUKS 1 81733cbe-81f5-4506-8369-1c9b62e7d6be │ └─luks-81733cbe-81f5-4506-8369-1c9b62e7d6be ext4 1.0 endeavouros d8d14c59-8704-4fb8-ad02-7d20a26bc1e1 843.6G 2% / └─nvme0n1p3 crypto_LUKS 1 9715a3f9-f701-47b8-9b55-5143ca88dcd8 └─luks-9715a3f9-f701-47b8-9b55-5143ca88dcd8 swap 1 swap b003ea64-a38d-464c-8609-7278e21f8a0f [SWAP]
The problem is that each time I boot up the computer, I need to enter my password twice; once for the root partition and once of the swap (note I use the same password for both if that helps). This has become nuisance. So my question is: Is there a way to automatically decrypt my swap partition upon a successful passphrase for the root?
There has been a question very similar to this with a sensible answer, but did not work. The first part of the answer is Debian-centric with a script option not present in other distributions. The second part uses crypttab to specify the location of a keyfile used to decrypt other partitions.
As of now, my crypttab in initrd looks like this, which specifies a
/crypto_keyfile.bin that exists in the root partition to open either of the partitions:
$ lsinitrd --file /etc/crypttab luks-81733cbe-81f5-4506-8369-1c9b62e7d6be /dev/disk/by-uuid/81733cbe-81f5-4506-8369-1c9b62e7d6be /crypto_keyfile.bin luks luks-9715a3f9-f701-47b8-9b55-5143ca88dcd8 /dev/disk/by-uuid/9715a3f9-f701-47b8-9b55-5143ca88dcd8 /crypto_keyfile.bin luks
This approach does not work for two reasons:
- Contrary to what the linked answer suggests (being that the user is queried for the partitions by the order of crypttab entries), the order is random at each boot. Even if I could automatically open my swap partition after opening the root, if swap comes first, then I am still forced to enter the password for root since keyfile is on root.
- It seems to me that after entering password for root, the filesystem is not mounted immediately. The
/crypto_keyfile.binis actually searched inside the initrd filesystem, which explains the following errors in journal appearing twice:
systemd-cryptsetup: Failed to activate, key file '/crypto_keyfile.bin' missing.
So if I am on the right track, how could I ensure
systemd-cryptsetup to query me first for the root partition and second for the swap each time, and how can I ensure that after opening root, the filesystem is mounted and
/crypto_keyfile.bin is successfully found to open the swap partition?
Otherwise, if I am completely off track here, is there a way to achieve what I want?