In previous versions of Ubuntu, and current versions of Debian, you can unlock a fully encrypted system (using dmcrypt and LUKS) at boot time over SSH.

It was as easy as:

  1. Installing the encrypted system using the Ubuntu alternate installer disk or normal Debian installer disk and choosing to encrypt the system.
  2. After the system is installed, adding the dropbear and busybox packages.
  3. Updating the initram-fs to authorize your ssh key.

At boot time, you'd just ssh to the machine, and do:

echo -ne "keyphrase" > /lib/cryptsetup/passfifo

The machine would then unlock and boot the encrypted system.

Using the exact same steps on Ubuntu 11.10, I can ssh to the machine, but /lib/cryptsetup/passfifo doesn't exist.

There appears to be no way to unlock the system over ssh. I'm not sure where to look to see if this functionality changed or if it was removed.

  • On a system that worked with the old way, can you do dpkg -S /lib/cryptsetup/passfifo ? I can't find any packages on packages.ubuntu.com for either Natty or Maverick that contain this file.
    – maco
    Nov 7, 2011 at 19:02

2 Answers 2


Just done some googling and it appears that plymouth gets in the way. If plymouth is there then on boot then cryptsetup will ask plymouth for the password and that means it's not using passfifo.

The best workaround appears to be putting the following script in the directory /usr/share/initramfs-tools/hooks/ After you've put it there you can chmod +x and then you have to update-initramfs -u. You should then be able to use the unlock command (which is created by the script below).

This relies on you using an ssh key to login with. If you want to use a password then you need to put SSHUSERPASS=<username> into /etc/initramfs-tools/initramfs.conf



prereqs() {
    echo "$PREREQ"

case "$1" in
        exit 0

. "${CONFDIR}/initramfs.conf"
. /usr/share/initramfs-tools/hook-functions

if [ "${DROPBEAR}" != "n" ] && [ -r "/etc/crypttab" ] ; then
    cat > "${DESTDIR}/bin/unlock" <<-EOF
        if PATH=/lib/unlock:/bin:/sbin /scripts/local-top/cryptroot
            /sbin/pkill cryptroot
            /sbin/pkill -f "plymouth ask-for-pass"
            /sbin/pkill cryptsetup
            exit 0
        exit 1
    chmod 755 "${DESTDIR}/bin/unlock"

    mkdir -p "${DESTDIR}/lib/unlock"
    cat > "${DESTDIR}/lib/unlock/plymouth" <<-EOF
        [ "\$1" == "--ping" ] && exit 1
        /bin/plymouth "\$@"
    chmod 755 "${DESTDIR}/lib/unlock/plymouth"

    # Enable password login
    if [ -n "$SSHUSERPASS" ]
        sed -n "s/^${SSHUSERPASS}:/root:/p" /etc/shadow > "${DESTDIR}/etc/shadow"
        chmod 640 "${DESTDIR}/etc/shadow"

You can read more in this post on the ubuntuforums, this launchpad bug and the german post I nicked most of this from.


until this bug is resolved, you can try to first kill plymouth. Unfortunately, there is no easy way to determine the PID of plymouthd. But plymouth knows how to quit itself :-) So the following should be sufficient.

plymouth --quit; echo -ne "keyphrase" > /lib/cryptsetup/passfifo

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .