Sample Header Ad - 728x90

Unlocking the Debian root partition with keyfile from an encrypted boot partition

0 votes
2 answers
114 views
This may sound similar to [this question](https://unix.stackexchange.com/questions/164403/unlock-luks-encrypted-debian-root-with-key-file-on-boot-partition) , except the circumstances are different where the boot partition is encrypted. I do not want to store the keyfile in the initramfs as that is not my intention. My goal is to unlock the boot partition on boot after grub finishes and use the keyfile, named keyfile to unlock the main root partition after manually unlocking the boot partition again. I desire this as I would rather type the passphrase twice rather than thrice. How would this be possible? I have not had any success as continuing to boot after grub finishes causes an error which says that the keyfile does not exist along with systemd-cryptsetup failing, alerting of a bad password or options. Booting with grub is fine as I manually unlock the boot partition, but the aftermath is not. My partition scheme:
(Block device for EFI system partition): ESP (not important)
(Block device for encrypted ext2 boot partition)
└─/keyfile (keyfile to unlock the encrypted root partition)
(Block device for encrypted btrfs root partition)
├─@rootfs (subvolume for /)
├─@home (subvolume for /home)
├─@log (subvolume for /var/log)
├─@libvirt (subvolume for /var/lib/libvirt)
└─@opt (subvolume for /opt)
Current /etc/crypttab:
#                        
debian_crypt  PARTLABEL=Debian     none          luks

cryptswap     PARTLABEL=cryptswap  /dev/urandom  swap,plain,cipher=aes-xts-plain64,size=512,sector-size=4096

boot_crypt    PARTLABEL=Boot       none          luks
I have tried to reorder the debian_crypt part to the end, specifying the path to the keyfile in the third column, /boot/keyfile, and adding the keyscript option, keyscript=/lib/cryptsetup/scripts/passdev along with the key-slot option. Also, is it possible for cryptsetup-suspend to also unlock the encrypted root partition with the keyfile on the encrypted boot partition so only the encrypted boot partition has to be manually unlocked after waking up?
Asked by horsey_guy (421 rep)
Jul 3, 2025, 03:58 AM
Last activity: Jul 8, 2025, 07:26 AM