Home / server / Questions / 686119
In Process
krisdigitx
Asked: 2015-04-29 04:00:17 +0800 CST

LUKS full disk encryption use keyfile instead of passphrase

  • 772

I have enabled LUKS full disk encryption on an LVM volume while installing centos6.6, however it asks for a passphrase every time the OS is rebooted.

I am now trying to use a key file according to this post. Unfortunately it does not work...and still asks for the passphrase.

/etc/cryptab

sda2 /dev/disk/by-uuid/0e7815c0-0941-431a-a6d2-cbe78132d292 /root/keyfile luks

Any ideas of a better solution to remove the passphrase and use only the keyfile?

linux

1 Answers

  1. Did you regenerate the initramfs ?

    The initramfs is a small file system called before your rootfs to ask for your password and decrypt the LUKS container and handle stuff. It contains the /etc/cryptab file to be able to know what it should uncrypt / mount.

    If you haven't regenerate it, the initramfs don't have you modified file and can't handle your new configuration.

    So try to update the initramfs. Here some help for Red Hat : http://advancelinux.blogspot.ch/2013/06/how-to-rebuild-initrd-or-initramfs-in.html

    Keep in mind that your key file have not to be on the encrypted partition, and so the encryption become useless because it easy to find the key.

    • 2