0

I have some systems configured using GRUB as my bootloader, with an unencrypted boot partition and everything else using LVM-on-LUKS. Right now, the only way to unlock the system is for me to physically go to the keyboard and enter the password. I would like to make it possible to store a key file on a USB drive and have the system boot automatically if the USB drive is present.

This blog post (archive), this SO post and this forum post (archive) each explain ways to do this, but in each case there is a step that basically says "edit your /etc/crypttab configuration", but when I open /etc/crypttab, the comment at the top says:

# NOTE: Do not list your root (/) partition here, it must be set up
        beforehand by the initramfs (/etc/mkinitcpio.conf)

And indeed my system does not have an entry for root here. Instead, that is set up in the grub configuration, which has the line:

GRUB_CMDLINE_LINUX="... root=/dev/mapper/vg-root cryptdevice=UUID={uuid}:cryptlvm"

Is the notice in /etc/crypttab incorrect? Or is it possible that the people who seem to think that these methods that involve editing /etc/crypttab have a different boot configuration? If the notice is correct, what is the correct way to get GRUB to look for a keyfile in a USB drive?

Note: this question also resolves in favor of the /etc/crypttab method.

1 Answer 1

0

I don't know if the /etc/crypttab stuff actually would work, but I did manage to get this working using just the grub configuration. It turns out that this was actually quite well documented on the ArchLinux Wiki (as is usually the case). In my case, I had an ext4-formatted USB drive, so I went into /etc/mkinitcpio.conf and added ext4 to MODULES:

MODULES=(ext4)

Then in /etc/default/grub, I changed GRUB_CMDLINE_LINUX to add the cryptkey parameter, like so:

GRUB_CMDLINE_LINUX="quiet ... cryptkey=LABEL=my_usb_label:ext4:/path/to/keyfile

Where /path/to/keyfile is the path to the keyfile on the USB drive, with / as the root of the USB drive. You can find more information about using the encrypt hook here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .