Linux – LUKS full disk encryption use keyfile instead of passphrase

centosencryptionlinuxluksunix

I have enabled LUKS full disk encryption on an LVM volume while installing centos6.6, however it asks for a passphrase every time the OS is rebooted.

I am now trying to use a key file according to this post. Unfortunately it does not work…and still asks for the passphrase.

/etc/cryptab

sda2 /dev/disk/by-uuid/0e7815c0-0941-431a-a6d2-cbe78132d292 /root/keyfile luks

Any ideas of a better solution to remove the passphrase and use only the keyfile?

Best Answer

Did you regenerate the initramfs ?

The initramfs is a small file system called before your rootfs to ask for your password and decrypt the LUKS container and handle stuff. It contains the /etc/cryptab file to be able to know what it should uncrypt / mount.

If you haven't regenerate it, the initramfs don't have you modified file and can't handle your new configuration.

So try to update the initramfs. Here some help for Red Hat : http://advancelinux.blogspot.ch/2013/06/how-to-rebuild-initrd-or-initramfs-in.html

Keep in mind that your key file have not to be on the encrypted partition, and so the encryption become useless because it easy to find the key.

Related Topic