Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a system where all the partitions (/, /home, and swap) are encrypted except for /boot. /boot resides in an external device which also contains a set of encrypted key files used to automatically decrypt all of the partitions. In other words, my desired end result was to have 2-factor authentication using an external device and a password where the password would be entered once during boot and the boot scripts would use the password to decrypt all of the partitions.

I'm a newbie to Ubuntu (and Linux in general), but I did some trial and error modifying the various scripts found in initrd.img using update-initramfs. The cryptroot script seemed to be doing all the work mounting the partitions at first, but after some experimenting, it appears that it is only responsible for decrypting the root file system. I had modified a string in the script changing Enter the passphrase to simply Password, which appeared to work when decrypting the root file system, but used the old prompt again for decrypting the next partition. In other words, this is what I'm getting:

  1. cryptroot script loads.
  2. The script asks for a password to decrypt the key partition and mounts it.
  3. The script calls the setup_mapping function to decrypt the root file system.
  4. The script tries to read the key file from the key partition to decrypt the root file system.
  5. The root file system is decrypted and mounted.
  6. The system prompts to enter a passphrase to decrypt the next partition…

I think Ubuntu might be running another copy of the cryptroot script somewhere to decrypt all the other partitions after root, but I don't know what else to modify.

share|improve this question

First, find out where cryptroot is, what package provides cryptroot, and what else (source, documentation, examples, ...) is in the package. Thusly:

walt@squid:~(0)$ locate cryptroot
walt@squid:~(0)$ dpkg -S !$
dpkg -S cryptroot
cryptsetup: /usr/share/initramfs-tools/hooks/cryptroot
cryptsetup: /usr/share/initramfs-tools/scripts/local-top/cryptroot
walt@squid:~(0)$ dpkg -L cryptsetup
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.