I partially followed this

What is /lib/cryptsetup/scripts/passdev actually doing?


2tb UUID=... /dev/disk/by-label/STICK:/logfile luks,nofail,keyscript=/lib/cryptsetup/scripts/passdev,tries=2

I have a stick plugged in formatted ext2, label STICK with the logfile with the passphrase in it. I used the "normal" method before reading the passphrase from my first disk that I am description with keyboard input.

2tb UUID=.. /etc/luks-keys/2tb luks,nofail,tries=1

And yes I did sudo update-initramfs -u -k all && systemctl reboot endlessly but this just does not work.

I am trying to get this to work to eventually unlock my entire system with just a USB stick pluged in but its not working.

I am in a UEFI system with secure boot disabled if that matters. I have read something about a module on a related topic. Do I need anything special loaded?

Also where is the log for this?


It would be ideal to me if I could simply have a small USB stick containing a passphrase that will unlock the disk. Not only would that be handy for servers (where you could leave the USB stick in the server - the goal is to be able to return broken harddisks without having to worry about confidential data), it would also be great for my laptop: Insert the USB stick when booting and remove it after unlocking the cryptodisk.

I have now written a patch that will search the root dir of all devices for the file 'cryptkey.txt' and try decrypting with each line as a key. If that fails: Revert to typing in the pass phrase.

It does mean the key cannot contain \n, but that would apply to any typed in key, too. The good part is that you can use the same USB disk to store the key for multiple machines: You do not need a separate USB disk for each. So if you have a USB drive in your physical key ring, you can use the same drive for all the machines you boot when being physically close.

You add the key with:

cryptsetup luksAddKey /dev/sda5

And then put the same key as a line in a file on the USB/MMC disk called 'cryptkey.txt'. The patch is here:


If the USB drivers, MMC drivers or the filesystems are not present in your initramfs, you need to add them by adding to /etc/initramfs-tools/modules:


When all is done, update the initramfs:

update-initramfs -u

After using the installer to create encrypted devices using a password with 16.04 and 18.04 you have to add following (seems to be related to a bug):

A script which reads the key on boot /etc/decryptkeydevice/decryptkeydevice.sh

Alter configuration /etc/initramfs-tools/conf.d/cryptroot

trick initramfs into using a cryptroot file /etc/initramfs-tools/hooks/decryptkeydevice.hook

and modify initramfs /etc/initramfs-tools/modules

https://github.com/Codeuctivity/UnlockLuksOnBootByToken puts the steps in initAutoUnlockOnBootConfig.sh together - execute as root:

sudo dd if=/dev/urandom of=/dev/sdb bs=512 seek=1 count=60 

sudo dd if=/dev/sdb bs=512 skip=1 count=4 > tempKeyFile.bin 

sudo cryptsetup luksAddKey /dev/sda5 tempKeyFile.bin 

# copy config
mkdir /etc/decryptkeydevice
# update device ids in in this file
cp decryptkeydevice.sh /etc/decryptkeydevice/decryptkeydevice.sh
chmod +x /etc/decryptkeydevice/decryptkeydevice.sh

cp cryptroot /etc/initramfs-tools/conf.d/cryptroot
chmod +x /etc/initramfs-tools/conf.d/cryptroot

cp decryptkeydevice.hook /etc/initramfs-tools/hooks/decryptkeydevice.hook
chmod +x /etc/initramfs-tools/hooks/decryptkeydevice.hook

cat modules >> /etc/initramfs-tools/modules

update-initramfs -u

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.