11

I have a full disk encryption using ecryptfs, after upgrading to 18.10 a warning message started to appearing at boot:

cryptsetup: WARNING: Option 'size' missing in crypttab for plain dm-crypt mapping root. Please read /usr/share/doc/cryptsetup/README.initramfs and add the correct 'size' option to your crypttab(5).

From what I see at /usr/share/doc/cryptsetup-initramfs/README.initramfs.gz I should edit /etc/cryptsetup and set the correct size, but how should this size be calculated for my system?

This is the content of /etc/crypttab:

 cryptswap1 UUID=1d1XXXXXXXXXXXX /dev/urandom swap,offset=1024,cipher=aes-xts-plain64

4 Answers 4

10

Add the size like size=256 to /etc/crypttab configuration:

cryptswap1 UUID=1d1XXXXXXXXXXXX /dev/urandom swap,offset=1024,cipher=aes-xts-plain64,size=256
1
  • 3
    You ask how this size should be calculated and then post an answer that does not explain how to calculate this at all and mark it as the correct answer? So far no one has answered in this thread how to calculate this size. Please add this to your answer :) Commented May 10, 2022 at 8:01
5

Editing the 'crypttab' file was not enough in my case (upgraded to Ubuntu 20.04).

After editing the file, I had to disable (temporary) the swap file and re-generate the initramfs image:

sudo swapoff -a
sudo update-initramfs -c -k all
sudo swapon -a

Unfortunately, that step should be repeated after every kernel update.

4
5

(In order to come up with a complete answer to this question, I'm posting this one, as an extension to marcanuy's own answer.)

Note: The warning considered (above) stems from the Debian Cryptsetup Initramfs integration.

  1. Find the size of the encryption key in question. Therefor, let's ask cryptsetup itself (for me, the problem has shown up regarding the encrypted swap partition on /dev/sda5):

    $ sudo cryptsetup status cryptswap1  
    /dev/mapper/cryptswap1 is active and is in use.  
    type: PLAIN  
    cipher: aes-xts-plain64  
    keysize: 256 bits
    key location: dm-crypt
    device: /dev/sda5  
    [...]  
    
  2. Read keysize (and type).

  3. If type: PLAIN, add the size (taken from above) to the corresponding entry in /etc/crypttab (as sudo):

    cryptroot /dev/sda5 none cipher=aes-xts-plain64,size=256,hash=sha1
    

    For a swap partition, the entry might look slightly different (eg., using /dev/urandom as (random) key file)

  4. Re-generate initramfs (does not have to be re-done by you on kernel update):

    $ sudo update-initramfs -u
    

    This might throw a warning, which can be ignored to my best knowledge. The warning regarding missing size option missing while booting, however, should have disappeared.

  5. Finally, reboot to verify everything works as expected and the warning has gone.

Remark: For type: LUKS, /etc/crypttab should actually rather look as follows, as most of the information can be read from the mandatory LUKS header:

cryptroot /dev/sdaX none luks,discard

2

If you only have encrypted swap partitions, the correct way to prevent initramfs from using them for resume is to add:

RESUME=none into /etc/initramfs-tools/conf.d/resume

For example:

echo "RESUME=none" | sudo tee /etc/initramfs-tools/conf.d/resume

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .