I am writing now from the machine that works exactly that way.
- First, you will need to put whole
/boot folder on the dongle.
- Encrypt the disk with key file and put the keyfile into the boot dongle too.
/etc/crypttab, add this line
sda2_crypt UUID=14-88 /dev/disk/by-uuid/88-14:/rootfs.key luks,keyscript=/lib/cryptsetup/scripts/passdev
sda2_crypt is arbitrary name, first UUID is of encrypted root partition, second - of dongle partition and
rootfs.key is the keyfile name.
- Then Update your
- Mount dongle as
/boot and do
This should be enough. Different instructions suggest you to add kernel boot arguments, but in my case it worked without.If you ever want to use password instead of keyfile, just edit
/etc/crypttab and do