This is relevant to Arch Linux (and perhaps other distributions using systemd). I want to mount a TrueCrypt partition at boot. With the old sysvinit, this was pretty straight forward with a script called by rc.local.

I got to my current by hijacking an Arch forum thread. There's another thread where this systemd-devel thread is talked about as "having the solution," however it's not apparent to me what it actually is, and the OP has the last post stating that he wasn't able to accomplish his goal.

From the looks of it this person is doing it, but was looking for a way to turn off continuous boot messages while he types the password. I posted there as well asking for him to post his actual .service file.

In searching quite a bit, people mention that they have been successful or that it's possible, but don't spell out exactly what the solution was.

I'm as far as being able to unlock the partition from the command line via a systemd service (which in turn gives me the ability to automatically dismount it on shutdown/reboot), but I have to do it manually once logged in. I'd really like the boot process to pause and ask me for the password.

Here's my current script:

Description=Truecrypt Setup for vault
#After=systemd-readahead-collect.service systemd-readahead-replay.service

ExecStart=/bin/sh -c '/usr/bin/truecrypt -t --protect-hidden=no -k "" --filesystem=none --slot=1 -p `systemd-ask-password "Enter password for truecrypt volume: "` /dev/sda4'
ExecStop=/usr/bin/truecrypt --filesystem=none -d /dev/sda4


I left the commented stuff in [Unit], as at some point I ran into suggestions that it should be there, but I had problems with it. The above seems to work just fine after booting/logging in... just not during.

  • As far as I understand, if you don't want to be interrupted by logging messages, you need to create a barrier in the unit file - meaning, that it will require all services started before it to finish (initialization) and it will block any services running after it. Is that what you are trying to achieve? – peterph Oct 10 '13 at 7:50
  • @peterph I don't think it matters as long as whatever is required by TrueCrypt is running by the time I get the prompt. Other things don't depend on this since it's just a volume for storing files; thus, other things could load on in the background while I input the password. At present, I wait to login, then manually start with sudo systemctl start truecrypt-vault, enter su password, enter TC Volume password, then startx. Surely I could have the password prompt presented to me during boot to avoid the extra steps after login? – Hendy Oct 14 '13 at 20:48
  • That was my point and actually yours as well (it's even in the question subject) - to get the password prompt during boot. If you are not using graphical boot like plymouth, any password prompt on the console is likely to be lost in services starting in parallel. – peterph Oct 14 '13 at 21:42
  • Oh. I thought you were asking if I need to stop services after or to make sure all previous services had started... I'm not sure and tried to answer as best as I could. I only boot to runlevel 3 with a text login and startx manually. No login manager. But yes, I do need to stop the boot messages while I enter the text, otherwise it'll just vanish off the screen. – Hendy Oct 15 '13 at 20:45
  • 8
    Well, systemd has an agent that is able to request a password, so youmight look in that direction. – peterph Oct 15 '13 at 21:19
  • Write a wrapper script and put it in ExecStart=
  • From the wrapper script, use systemd-ask-password <PROMPT>, read password from its stdout and feed it to truecrypt in whatever way is required
  • Don't forget to exec truecrypt from the end of your script in order not to leave an extra bash process hanging around

This will make systemd query the password immediately (if you start apache using systemctl) or using one of so-called agents (there are default ones which ask passwords using wall or directly on the console during system bootup). This is the best thing you can do to stay compliant.

| improve this answer | |

I found this post on Unix StackExchange: rc.local with read will not echo key strokes
I think you could try the solution used

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.