Sample Header Ad - 728x90

How to open all LUKS volumes with use of a single password?

1 vote
1 answer
2213 views
I'm using EndeavorOS (basically Arch), but with systemd-boot and dracut for initrd. I have a simple setup with an unencrypted boot partition and LUKS-encrypted root and swap partitions. Specifically, the setup is described in the output below:
`
$ cat /etc/fstab
#                      
UUID=8A2F-4076                            /efi           vfat    defaults,noatime 0 2
/dev/mapper/luks-81733cbe-81f5-4506-8369-1c9b62e7d6be /              ext4    defaults,noatime 0 1
/dev/mapper/luks-9715a3f9-f701-47b8-9b55-5143ca88dcd8 swap           swap    defaults   0 0
tmpfs                                     /tmp           tmpfs   defaults,noatime,mode=1777 0 0

$ lsblk -f
NAME                                          FSTYPE      FSVER LABEL       UUID                                 FSAVAIL FSUSE% MOUNTPOINTS
nvme0n1                                                                                                                         
├─nvme0n1p1                                   vfat        FAT32             8A2F-4076                             915.6M     8% /efi
├─nvme0n1p2                                   crypto_LUKS 1                 81733cbe-81f5-4506-8369-1c9b62e7d6be                
│ └─luks-81733cbe-81f5-4506-8369-1c9b62e7d6be ext4        1.0   endeavouros d8d14c59-8704-4fb8-ad02-7d20a26bc1e1  843.6G     2% /
└─nvme0n1p3                                   crypto_LUKS 1                 9715a3f9-f701-47b8-9b55-5143ca88dcd8                
  └─luks-9715a3f9-f701-47b8-9b55-5143ca88dcd8 swap        1     swap        b003ea64-a38d-464c-8609-7278e21f8a0f                [SWAP]
` The problem is that each time I boot up the computer, I need to enter my password twice; once for the root partition and once of the swap (note I use the same password for both if that helps). This has become nuisance. So my question is: Is there a way to automatically decrypt my swap partition upon a successful passphrase for the root? There has been a question very similar to this with [a sensible answer](https://unix.stackexchange.com/a/392286/509294) , but did not work. The first part of the answer is Debian-centric with a script option not present in other distributions. The second part uses crypttab to specify the location of a keyfile used to decrypt other partitions. As of now, my crypttab in initrd looks like this, which specifies a /crypto_keyfile.bin that exists in the root partition to open either of the partitions:
`
$ lsinitrd --file /etc/crypttab
luks-81733cbe-81f5-4506-8369-1c9b62e7d6be /dev/disk/by-uuid/81733cbe-81f5-4506-8369-1c9b62e7d6be /crypto_keyfile.bin luks
luks-9715a3f9-f701-47b8-9b55-5143ca88dcd8 /dev/disk/by-uuid/9715a3f9-f701-47b8-9b55-5143ca88dcd8 /crypto_keyfile.bin luks
` This approach does not work for two reasons: 1. Contrary to what the linked answer suggests (being that the user is queried for the partitions by the order of crypttab entries), the order is random at each boot. Even if I could automatically open my swap partition after opening the root, if swap comes first, then I am still forced to enter the password for root since keyfile is on root. 2. It seems to me that after entering password for root, the filesystem is not mounted immediately. The /crypto_keyfile.bin is actually searched inside the initrd filesystem, which explains the following errors in journal appearing twice: systemd-cryptsetup: Failed to activate, key file '/crypto_keyfile.bin' missing. So if I am on the right track, how could I ensure systemd-cryptsetup to query me first for the root partition and second for the swap each time, and how can I ensure that after opening root, the filesystem is mounted and /crypto_keyfile.bin is successfully found to open the swap partition? Otherwise, if I am completely off track here, is there a way to achieve what I want? Thanks.
Asked by Snusifer (113 rep)
Jul 19, 2023, 06:53 PM
Last activity: Jul 25, 2023, 09:05 AM