I have installed 12.10 on a machine with two disks. The root partition is on one disk, the swap partition on the other. Both disks are encrypted and I have added the corresponding entries to /etc/crypttab.

During boot, it asks for the passphrase for the disk with the root filesystem. Then it continues booting and gets to the login screen before I get a chance to enter the passphrase for the other disk. After logging in, I verified that it was actually waiting for me to enter the passphrase for that second partition (askpass process is running). But at that point, I have no way of entering the passphrase anymore.

The manpage for crypttab suggests that the order in which the volumes are specified matters, so I changed it to have the swap disk first. I updated the initramfs and grub afterwards, but it didn't make any difference.

How can I specify the order in which the encrypted partitions are unlocked? I'm looking for a solution that either asks for the swap passphrase first or tells the system to wait until all encrypted partitions are unlocked before displaying the login screen.

Ideally I want to be able to use hibernation, i.e. neither use a random key for swap nor encode the key in crypttab.

  • 1
    The method I used to encrypt my system and swap was that I set up an LVM logical disk on a partition encrypted with LUKS. When I enter a single password, the LVM volume appears and each of the partitions pop up in /dev/mapper. Not what you're asking, I know, but if you don't have a ton of time invested in your setup, it's something to consider. – thirtythreeforty Oct 27 '12 at 22:22
  • Thanks for your suggestion, but in my case it's two physical disks so I can't use one passphrase -- I would actually prefer that though! – Lars Kotthoff Oct 27 '12 at 22:27
  • @Lars Kotthoff LVM allows you to combine multiple disks together – Tomasz Zieliński Oct 10 '13 at 0:36
  • Thanks for your comment, but in this case one is an HDD and the other one an SSD and I'd like to control which one is used for what. – Lars Kotthoff Oct 10 '13 at 11:38

After some more digging, I found the decrypt_derived script. It allows to derive the passphrase from another encrypted partition. I set up the swap partition in this way, made the necessary changes to /etc/crypttab and it works! I only need to enter one passphrase, the second partition is unlocked automatically during boot and hibernation works.

More details e.g. here.


If you don't care about hibernation, you can put the password for the encrypted swap partition into a file on the root partition. /etc/crypttab can then point to that file, and you can bypass this issue altogether. This isn't a security risk, since your root drive is encrypted. As a bonus, since you don't plan on using hibernation, you can actually have the swap file use a random key each time by setting this file to /dev/urandom. If you'll post your crypttab I'd be happy to show you the modifications you need to make.

  • Thanks for your suggestion, but I do want hibernation support. I'll modify the question to reflect this. – Lars Kotthoff Oct 28 '12 at 11:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.