Detached LUKS headers on USB flash, bad idea?

[389292]

I've read here that if you detach your LUKS header, you shouldn't really unmount that drive (with the header) after boot, is it true? Shouldn't it stay in memory while the drive is mounted? I don't plan to use hibernation or any kind of sleep function.

[Ant P.]

The cryptsetup package, as the name hints, is only really used to set up the in-kernel encryption stuff and load the keys/metadata used to make the container mountable. You can double-check this for yourself using tools like fuser(1) on the header device - it shouldn't show anything holding an open filehandle to the header.

[Hu]

That claim, with no supporting evidence that I can see, is the first I have heard of it being a problem. The same person goes on to say that you should not mix LUKS with LVM, again without a good description of why to avoid this. I generally see LUKS+LVM proposed as the preferred way to handle LUKS, since it minimizes the number of unique password prompts while still granting you multiple independent filesystems inside the container. Without a more precise description of what happened and why, I am not inclined to accept either of those claims.