I am going to install Linux the LUKS/LVM way, in order to have an encrypted disk.

In addition, I would like to put the header and passphrase in a USB Key.

Thus, instead of entering the passphrase, I only plug the USB drive dongle.

Is it possible and how?

  • There is a way to do that, I have seen it working. – 3pic Jul 31 '15 at 9:56

I am writing now from the machine that works exactly that way.

  1. First, you will need to put whole /boot folder on the dongle.
  2. Encrypt the disk with key file and put the keyfile into the boot dongle too.
  3. Edit /etc/crypttab, add this line

    sda2_crypt UUID=14-88 /dev/disk/by-uuid/88-14:/rootfs.key     luks,keyscript=/lib/cryptsetup/scripts/passdev

where sda2_crypt is arbitrary name, first UUID is of encrypted root partition, second - of dongle partition and rootfs.key is the keyfile name.

  1. Then Update your /etc/fstab accordingly.
  2. Mount dongle as /boot and do update-initramfs

This should be enough. Different instructions suggest you to add kernel boot arguments, but in my case it worked without.If you ever want to use password instead of keyfile, just edit /etc/crypttab and do update-initramfs.

  • 1
    There is no need to remove /boot folder from machine. When you mount dongle over it, all access to original folder is blocked. However, you should better set it to readonly to be sure that future kernel upgrades happen on dongle, not on the disk. – Barafu Albino Jul 31 '15 at 16:38
  • Thank you. You write: "2. Encrypt the disk with key file and put the keyfile into the boot dongle too". Does that mean you can encrypt disk with LUKS, with an already installed system ? I thought that you cannot, and must reinstall from scratch, choosing the LUKS/LVM option at the install begin. – 3pic Aug 3 '15 at 8:13
  • You can do it from any LiveCD. You will need to clean the encrypted partition, but you can temporarily copy all your root with tar to any other place and move it back. Reinstalling is an easier option, though. Just make sure you have backups in case it will not boot at first attempt. Additionally, first make it boot with password and only when you have no problems with it go for booting with key on USB stick. – Barafu Albino Aug 3 '15 at 8:54
  • 1
    To encrypt partition you have to erase the contents, write LUKS container data into it, mount and put files back. You can not remove root partition of a running system (well, you can, but it is tricky), so I say you better use bootable LiveUSB. GRUB bootloader can't decrypt LUKS partition, so you need /boot partition unencrypted, so you store it on another USB and make it bootable. Essentially, you make a LiveUSB, but with root data not on the stick, but on encrypted partition of your PC. – Barafu Albino Aug 11 '15 at 11:48
  • 1
    You can keep a separate /boot partition HDD and only a keyfile on USB. But if attacker ever gets unnoticed access to that /boot partition, it will be trivially easy to alter so that it sends your keyfile to attacker when you boot it next time. If you see no problem in this (no one can work your PC and walk away unnoticed) than you can keep /boot partition on HDD. – Barafu Albino Aug 11 '15 at 14:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.