Fedora 30 : add additional USB keyfile for root LUKS decryption

Ask Fedora
1

Hi everyone !

I have a laptop with a fresh install of Fedora 30 with

  • a LUKS 2 encrypted LVM on an SSD,
  • an additional LUKS 2 encrypted HDD for data

I added the second drive to fstab/crypttab and both are automatically decrypted on boot because they have the same password and as I understand plymouth passes on the entered password to all mapped luks volumes, so I do not use any keyfile.

I would like to be able to ALSO boot the system using just a USB key with a keyfile on it, without entering a password. All the guides that I found were outdated or involved creating scripts (not sure how those survive system upgrades) or modifying the crypttab entry to search for the keyfile, (thus losing password login), or booting from the USB which is not convenientā€¦ is there a native way to do this, using LUKS keyslot features ? like just adding the usb to FSTAB and adding a keyfile on it mapped to the luks keyslots ?

thanks everyone !

2

Hi @anon80987096! Welcome to the community! Please do take a few minutes to go over the introductory posts in #start-here when you have the time. They contain lots of useful information.

As far as I know, the keyfile gets added to a free keyslot with cryptsetup luksAddKey command almost exactly so as with a passphrase, look here:

Iā€™ve never done it, Iā€™ve used LUKS drives with passphrases (and used additional passphrases too), not with keys. But I think the problem is not adding the key to the keyslot.

It looks like /etc/crypttab is used by default in Fedora to decrypt LUKS drives at boot time, and it looks like it can be configured either to ask for passphrase or to read it from a keyfile, but not both.

So it looks like thereā€™s no easy way to achieve this. If youā€™re open to suggestions and want to try something more hackish yourself then, I think, there could be options to try (with no guarantee for them to work though).

1 Like
3

Hi,

thanks for your answer !

too bad thenā€¦ Iā€™d rather avoid ā€œhackishā€ tips because Iā€™m afraid of how these survive system upgradesā€¦ butā€™s ok, Iā€™ll just print out a password and thatā€™ll replace the backup USB :wink:

thanks, bye !

4

If you need it just for backup, not as your main unlocking device, then you may do it like this.

Use simpler and easier to enter every time (but not too easy, you do understand!) password as your main one, never write in down or print it so that it couldnā€™t fall in the wrong hands.

Make a backup password (several, if you need) longer and harder to remember ā€“ best of all use password generator to make it complete gibberish, ā€“ print it, test it (!) and then store it securely.

It wonā€™t provide more security in the end, except than if someone sees your backup password, at least they wonā€™t know your main one. And just seeing it briefly wonā€™t help them remember backup password, if itā€™s unmemorable gibberish.

5

Sorry to bother you as this isnā€™t an answer but could you link me to where you read about modifying the ā€œcrypttab entry to search for the keyfileā€? Iā€™m looking for something like this but I canā€™t find it.

6

sorry to read you so late

what exactly are you trying to achieve?

7

I think I wanted it to search flash drives for a key file with a specific file name and avoid having to specify a path and UUID but I expect this isnā€™t really possible now. In the end I managed to get is to use any drive based on its label rather than UUID (using the boot parameter ā€œrd.luks.key=ā€˜path to keyfile on deviceā€™:LABEL=ā€˜partition LABEL where the key is locatedā€™ā€) and this is more or less what I wanted however I would like the partition to be invisible to windows. Thanks for getting back to me :+1: