1

I have a specific situation. On Debian there are additional 3 disks and they are Luks encrypted. After decryption these disks are configured to ZFS pool RAIDZ (Raid5). After server reboot I need to unlock these three disks one by one and after 2nd disk is unlocked ZFS pool comes online but in degraded state because 3rd disk is not reachable and it stays in that condition despite I unlock the 3rd drive also. I have to manually run command:

zpool online <pool> <device>

And after that zpool becomes okay. I would like to somehow unlock all three disks at once do bypass this situation of going ZFS pool to degraded state. I found this post: Using a single passphrase to unlock multiple encrypted disks at boot

And answered solution works perfect but the problem is that the passphrase needs to be inputted during boot and in my environment there are some servers where I don't have access to console so I would not be able to enter my passphrase on these. That's why I'm looking for a solution to unlock these drives after system boots and I can access it via SSH.

Improve this question

1 Answer 1

Reset to default
2

This doesn’t answer your titular question, but it will allow you to unlock your LUKS devices via SSH before the system has finished booting. If you install dropbear-initramfs, you’ll get a lightweight SSH server in early boot. This only supports key-based logins, and you’ll have to add authorized public keys to /etc/dropbear/initramfs/authorized_keys. You’ll also need to ensure that the modules required for your network hardware are available in your initramfs (add them to /etc/initramfs-tools/modules). See /usr/share/doc/dropbear-initramfs/README.Debian for details.

Install cryptsetup-initramfs to also get cryptsetup support in the initramfs. With that in place, you can run

ssh -t [email protected] cryptroot-unlock

to unlock the LUKS devices on the target system. See /usr/share/doc/cryptsetup/README.Debian section 8 for details.

Improve this answer
1
  • Thanks for your answer Stephen. Your post looks very promising. It would solve my problem and I'm testing it now but currently I'm still failing, can't connect via SSH despite seeing correct network configuration on console and also can't type unlock passphrase via console. Still trying and will update after success
    – RegPab
    Commented Nov 24, 2023 at 12:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .