**This is an old revision of the document!**
Linux Disk Encrpytion
Remote unlocking at boot
Problem
If you have a encrpyted root partition, it usually requires access to the console to enter the passsphrase.
Even if you have the root partition unencrypted and have you sensitive data on a different encrypted partition, that you manually mount after SSH is available. You still have to deal with starting services after said manual mount.
There are a number of remote unlocking tools (luksrku, mandos, tang/clevis), which attempt to solve this problem, by having a service running a trusted network to provide the decryption key. While this may be suitable for larger environments, I needed something simplier, suited for a handful of machines.
Solution
I decided to use dropbear to run an SSH daemon in the initrd, then being able to SSH in and unlock all the devices in the initrd, before starting the root pivot.
This then allows the usual systemd init system to start services. Without needing to implement any custom service starting.
Implementation
Info
The following applies to Ubuntu 20.04, different distributions may vary
Warning
Cryptab format varies between distros and programs (systemd / Debian initrd), therefore be wary of alternative formatting described elsewhere
Dropbear
The dropbear SSH daemon can be installed in the initrd by:
apt-get install dropbear-initramfs
Password authentication is disabled, therefore you need to add your authorizedkeys
to /etc/dropbear/initramfs/authorizedkeys
Dropbear options can be added to DROPBEAR_OPTIONS in /etc/dropbear/initramfs/dropbear.conf. See man dropbear(8) for more details.
Networking
Configuring networking in the initrd, is the same as documented for configuring NFS root booting. Upstream docs can be found at https://www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt , under the ip parameter.
This matches the IP= option placed in /etc/initramfs-tools/initramfs.conf. e.g.
IP=10.42.2.100::10.42.2.250:255.255.255.0:frank:eno1
Networking persists to the OS booting, which is good if your configuration is the same.
In my case, the IP in the full OS should be on a bridg ise device (br0), not eno1 as it is in the initrd. The simplest solution is to remove the networking configuration as the initrd pivots and let netplan bring up the new configuration as the OS boots.
To remove the initrd networking, add the following script as /etc/initramfs-tools/scripts/init-bottom/remove-networking.sh: