Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #219435

Re: Encrypted /boot password has to be entered twice

Show all headers | View raw

On Tue 2020-02-25 17:31, Steve McIntyre wrote:
> Grub needs the passphrase for /boot, and then Linux needs it
> separately. Unfortunately there isn't a way for Grub to pass the
> passphrase to Linux so it has to ask you again. People are looking at
> ways to make this work better...

One way to do this is to use both a passphrase and a keyfile. You use the
passphrase with grub to decrypt things, then configure the initramfs to hold the
keyfile (both located on the drive) and use it for mounting grub. The net effect
is to only have the password prompt once. Here's what to do:

* Generate the keyfile (call it /keyfile) and add it to you device.

* Add this to /etc/crypttab:

-- /etc/crypttab ---------------------------------------------------------------
root  UUID=<your uuid>  /keyfile  luks
--------------------------------------------------------------------------------

* Install cryptsetup-initramfs and add/edit this line:

-- /etc/cryptsetup-initramfs/conf-hook -----------------------------------------
KEYFILE_PATTERN=/keyfile
--------------------------------------------------------------------------------

* The keyfile should be protected and is stored, so give it a more restrictive
  umask by adding/editing the line

-- /etc/initramfs-tools/initramfs.conf -----------------------------------------
UMASK=0077
--------------------------------------------------------------------------------

* Update /etc/default/grub.

-- /etc/default/grub -----------------------------------------------------------{{{}}}
GRUB_ENABLE_CRYPTODISK=y
GRUB_CMDLINE_LINUX="cryptdevice=/dev/<your partition>"
--------------------------------------------------------------------------------

* Rebuild the initramfs, update grub:

  $ update-initramfs -k all -u
  $ update-grub


BTW, grub's verification of the passphrase is *slow*. You can speed things up at
the cost of some security by adjusting the --iter-time parameter. I have found
that --iter-time=1000 is fast enough on newer machines.

Hope this helps,
MM

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Encrypted /boot password has to be entered twice john doe <johndoe65534@mail.com> - 2020-02-25 11:40 +0100
  Re: Encrypted /boot password has to be entered twice Steve McIntyre <steve@einval.com> - 2020-02-25 18:40 +0100
    Re: Encrypted /boot password has to be entered twice Matthew Moore <a91738246@gmail.com> - 2020-02-25 20:00 +0100
      Re: Encrypted /boot password has to be entered twice john doe <johndoe65534@mail.com> - 2020-02-26 07:40 +0100
        Re: Encrypted /boot password has to be entered twice Guilhem Moulin <guilhem@debian.org> - 2020-02-26 16:10 +0100
          Re: Encrypted /boot password has to be entered twice john doe <johndoe65534@mail.com> - 2020-02-26 20:10 +0100
            Re: Encrypted /boot password has to be entered twice Guilhem Moulin <guilhem@debian.org> - 2020-02-27 01:30 +0100
              Re: Encrypted /boot password has to be entered twice john doe <johndoe65534@mail.com> - 2020-02-28 08:50 +0100

csiph-web