Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an old desktop computer that I want to start using as a headless server.

With a monitor and a screen attached, I installed Ubuntu Server edition with encrypted LVM on the machine. After installation I rebooted and, still with the monitor and keyboard attached, filled out the passphrase and was able to login. I was able to login to the server from my laptop. So far so good.

Then I disconnected the monitor and keyboard and rebooted the desktop remotely over ssh from the laptop. Upon rebooting I heard two beeps. When I tried to login again via ssh I got the message:

$ ssh plectrophenax.local

ssh: Could not resolve hostname plectrophenax.local: Name or service not known

When I reattached the monitor to the server, I saw the message

Grub loading

Unlocking the disk /dev/disk/by-uuid/de99e2c0-56d7-473b-f134FF5bd634 (sda1_crypt)

Enter passphrase:

So apparently it was waiting for me to enter my passphrase before it would boot up.

So how do I enter this passphrase remotely?

share|improve this question

You can't. The passphrase is here precisely to make it impossible.

share|improve this answer
Makes me wonder why they offerd encryption during the installation process if I can't use it. Anyway, how do I remove the encryption so that I can login remotely? – BioGeek Dec 21 '09 at 12:41
You can use it. It's meant to be used this way. What is the point of having disk encryption if it is automatically decrypted without any sort of user secret? – sybreon Dec 21 '09 at 13:49
Encryption is a tool, it's up to you knowing why and when to use it. However, you can unlock the encrypted device, copy its content elsewhere, then reformat the device and copy back. AFAIK this is the only option. – wazoox Dec 21 '09 at 22:52
Actually, its possible. – Laurent Parenteau Dec 22 '09 at 22:44

You shouldn't have your OS to boot on an encrypted partion. Just encrypt /home, /var/www or whatever else. Make sure you can login as root if you've encrypted /home.

To easily mount your partition but only after boot, add "noauto" to its fstab line in the options column, eg.

/dev/sda2 /home ext3 defaults,noauto 1 1

Alternatively, if you want to whole server to be on encrypted partion, you could virtualize it with openvz or kvm, and then mount manually the partition, and finally starting the virtual server.

Not so good for uptime though. Why do you want to encrypt a server partition?

share|improve this answer

You can do so by installing an SSH server into your initramfs. One easy possibility is to use early-ssh. It installs a Dropbear SSH server right into your initramfs. With that server running you can log into your server before the root fs mount and enter the LUKS password.

share|improve this answer

You could modify initramfs so it enter the password itself. Like wazoox and sybreon said, this goes against the goal of encrypting the partition.

But if that is what you want, look at the 2nd post here.

share|improve this answer

Well, this question is quite old, but since many others like myself could be still now looking for a good solution to this same problem, here there are 2 of the best ones I've managed to found so far (after spending lots of hours trying out multiple impossible configurations ¬¬):

After configuring the servers that way, one can decrypt the LUKS partition via SSH (using password or rsa-key) or an USB flash drive and let the system boot as usual. Quite useful in my case.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .