I have Xubuntu 14.04 on a SSD device (the HOME was encrypted correctly during intallation), additionally I have a HDD with a encrypted partition with extra data which I would like to mount in /mnt/hdd. For making these I followed the next steps:

(Previously I had encrypted the disk with LUKS following this post http://www.marclewis.com/2011/04/02/luks-encrypted-disks-under-ubuntu-1010/)

Check the UUID

sudo blkid 
/dev/sda1: UUID="b3024cc1-93d1-439f-80ce-1b1ceeafda1e" TYPE="crypto_LUKS"

Make a keyfile with the right passphrase and save it in my HOME (which is also encrypted).

sudo dd if=/dev/urandom of=/home/[USERNAME]/.keyfiles/key_luks bs=1024 count=4
sudo chmod 0400 .keyfiles/key_luks

Add the key

sudo cryptsetup luksAddKey /dev/sda1 /home/zeugor/.keyfiles/key_luks

New entry in /etc/crypttab

hddencrypted UUID=b3024cc1-93d1-439f-80ce-1b1ceeafda1e /home/[USERNAME]/.keyfiles/key_luks luks

Update the initial ramdisk

sudo update-initramfs -u -k all

Then, to test it, I used the follow command to start cryptdisks:

sudo cryptdisks_start hddencrypted 
 * Starting crypto disk...                                                       
 * hddencrypted (starting)..
 * hddencrypted (started)... 

To check hddencrypted was mapped:

ls /dev/mapper/
control  hddencrypted

Create a mount point

mkdir /mnt/hdd

New entry in /etc/fstab

/dev/mapper/hddencrypted /mnt/hdd ext4 defaults 0 2

Validate fstab without reboot:

sudo mount -a

Mount the encrypted partition on boot

Now I have mount it in/mnt/hdd as I proposed. But I wold like to make this automatically after reboot. But before I can log in, I get this error:

the disk drive for /mnt/hdd is not ready yet or not permit

All this makes me think that /etc/crypttab can't access to the keyfile which is located in my HOME (other encrypted partition). I don't know the order which the system follows to unencrypted and mounts the units. My HOME should be unencrypted before my HDD for giving access to read the keyfile.

I would appreciate any insight as to why this happens.

UPDATE: If I locate the keyfile in /boot (no encrypted), instead of in my /home/[USERNAME] (encrypted) the /dev/sda1 and update the entry in /etc/crypttab is perfectly mounted on boot time.

  • How is /home/$USER encrypted? A full disk encryption like LUKS or based of ecryptfs? Oct 21, 2014 at 1:27

3 Answers 3


A key file in the /boot directory can be read by any other operation system booted on your machine that is able to mount the filesystem on that /boot is located. Thus, encryption is not really effective. This argument applies to all key file locations on unencrypted file systems.

To avoid key files on unencrypted file systems a password can be used for decryption. Create a strong password for the device. Then, change the line in /etc/crypttab to

hddencrypted UUID=b3024cc1-93d1-439f-80ce-1b1ceeafda1e none luks

and keep the entry in /etc/fstab unmodified. Ubuntu 14.04/16.04/18.04 asks you for the password on startup.

  • combining @solt87's answer and this answer would complete this answer.
    – user383919
    Sep 12, 2018 at 22:33
  • It's effective if the boot drive is also encrypted, correct? Jul 24, 2021 at 20:57
  • Yes, if the boot drive is also encrypted, it is effective. But then, you need a key/password for your /boot partition. Where to put this key?
    – Dominik
    Jul 28, 2021 at 19:39

Does it work if you replace "defaults" in fstab with


(According to the mount man page, it's the same as "defaults" except for "user".)


Make sure the hddencrypted partition is listed after the home partition, in both /etc/fstab and /etc/crypttab. As the crypttab (5) manpage states:

The order of records in crypttab is important because the init scripts sequentially iterate through crypttab doing their thing.

Also you could try adding the noearly option to the latter partition in /etc/crypttab:

hddencrypted UUID=<...> /home/[USERNAME]/.keyfiles/key_luks luks,noearly

In a normal situation, you could indicate that the home partition must be mounted first by adding it to CRYPTDISKS_MOUNT in /etc/default/cryptdisks, but since it is itself encrypted, I have a feeling that would not be a good idea.

  • 1
    This will not work as ubuntu tries to decrypt all partitions and then mount them. Thus the key file will not be available. Feb 22, 2016 at 9:11
  • As of 2020 (Ubuntu 19.10) this works (noearly wasn't even necessary). I put the keyfile in /etc/luks (the main disk is also LUKS encrypted) .
    – xenoid
    Feb 23, 2020 at 13:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .