| View previous topic :: View next topic |
| Author |
Message |
carcajou
Apprentice
Joined: 10 Jun 2008
Posts: 248
|
 Posted: Wed Apr 12, 2023 9:24 pm Post subject: Unlocking LUKS w/o LVM with USB flash on boot? |
 |
|
Hi guys.
Is there an easy/simple way to unlock encrypted root partition on boot using the USB flash with key, instead of typing the passphrase? I would leave passphrase input as fallback.
I have LUKS encrypted root partition and unencrypted /boot partition. Now, on each boot, I enter the passphrase. It is not a big deal for me personally, but now my desktop will be used by my wife and I do not expect her to understand why she has to type 2 passphrases to login to her account (the first one being quite long). 
Thank you. |
|
| Back to top |
|
 |
sublogic
Guru
Joined: 21 Mar 2022
Posts: 309
Location: Pennsylvania, USA
|
| Posted: Thu Apr 13, 2023 2:25 am Post subject: Re: Unlocking LUKS w/o LVM with USB flash on boot? |
|
|
| kukibl wrote: | | Is there an easy/simple way to unlock encrypted root partition on boot using the USB flash with key, instead of typing the passphrase? I would leave passphrase input as fallback. |
I never tried, but I know genkernel does it. From the man page: | Code: | RAMDISK/INITRAMFS OPTIONS
[ . . . ]
root_key=<...>
In case your root is encrypted with a key, you can use a device
like a usb pen to store the key. This value should be the key path
relative to the mount point.
root_keydev=<...>
If necessary provide the name of the device that carries the
root_key. If unset while using root_key, it will automatically look
for the device in every boot.
root_keydev_fstype=<...>
Used filesystem for root_keydev. See rootfstype for more details. |
Details left as an exercise. |
|
| Back to top |
|
|
Hu
Administrator
Joined: 06 Mar 2007
Posts: 23091
|
| Posted: Thu Apr 13, 2023 3:05 am Post subject: |
|
|
| As an obligatory reminder, before enabling password-free boot via USB key, consider your threat model. Why did you encrypt the drive? Who are you trying to keep out? Will that adversary likely have ready access to the USB key? Using a key can be acceptable if you encrypted the drive as a defense against a future warranty return or gift/recycling of the drive. It may not be a good idea if you encrypted the drive as a defense against someone robbing your home and taking the electronics for later perusal / fencing. |
|
| Back to top |
|
|
sMueggli
Guru
Joined: 03 Sep 2022
Posts: 538
|
| Posted: Thu Apr 13, 2023 6:34 am Post subject: |
|
|
I am not a thief, but I imagine that I would not also steal the laptop, but also steal the attached USB key.
And people tend to use USB sticks to store data. For example to share photos with other people. |
|
| Back to top |
|
|
carcajou
Apprentice
Joined: 10 Jun 2008
Posts: 248
|
| Posted: Thu Apr 13, 2023 9:20 am Post subject: |
|
|
| sublogic wrote: |
I never tried, but I know genkernel does it. From the man page:
|
I moved from genkernel to dracut, but thank you for the idea. I will check how dracut does it. There is even this (will research it a little bit later): https://wiki.gentoo.org/wiki/Full_Encrypted_System_Root_with_Dracut_USB_Stick
| Hu wrote: | | As an obligatory reminder, before enabling password-free boot via USB key, consider your threat model. Why did you encrypt the drive? Who are you trying to keep out? Will that adversary likely have ready access to the USB key? Using a key can be acceptable if you encrypted the drive as a defense against a future warranty return or gift/recycling of the drive. It may not be a good idea if you encrypted the drive as a defense against someone robbing your home and taking the electronics for later perusal / fencing. |
| sMueggli wrote: | I am not a thief, but I imagine that I would not also steal the laptop, but also steal the attached USB key.
And people tend to use USB sticks to store data. For example to share photos with other people. |
The usb key unlocking is only temporary, because my wife has to use it to connect her office remotely. The disk is encrypted primary for the privacy - in case I sell the computer later or give it away or send it for repair (except simple upgrades and replacements, I usually do not fiddle with hardware). Getting robbed is not one of the concerns.  |
|
| Back to top |
|
|
|
Networking & Security
