You want to automatically boot your encrypted root partition without any passphrase input, but want to use a keyfile. For testing purposes, the keyfile will be located on the /boot
partition, which will make the system vulnerable, since if someone gets a hold of the microSD card, they will be able to decrypt our root partition. I suggest that you put that keyfile on a separate USB Flash Disk, in this way it will act like a key, you can unplug the drive after boot process is finished.
Please also read the previous post entitled Root LUKS Disk Encryption Raspberry Pi
and install the packages needed. The steps are almost the same as in that post.
Identify our drive UUIDs:
$ sudo blkid
Generate a keyfile:
$ dd if=/dev/urandom of=./keyfile count=1024 bs=4
Add the keyfile to our existing LUKS encrypted partition:
$ sudo cryptsetup luksAddKey /dev/sda1 ./keyfile
Assume that /dev/sda
/ is the encrypted root partition.
Edit /etc/crypttab
to let the system know that we are using a keyfile:
sda1 UUID=981xxxx-xxxx-xxxx-xxxxx-xxxxx /dev/disk/by-partuuid/63a3xxx-01:/keyfile luks,keyscript=/lib/cryptsetup/scripts/passdev
Assume that /dev/disk/by-partuuid/63a3xxx-01
is our /boot
partition UUID. Replace this with your USB Flash Drive UUID or PARTUUID. /keyfile
is the name of our keyfile. 981xxxx-xxxx-xxxx-xxxxx-xxxxx
is our encrypted root partition UUID, in this case it is the /dev/sda1
UUID from the output of blkid
.
Edit /boot/cmdline.txt
append this text:
luks.crypttab=no
Generate a new initramfs:
$ sudo mkinitramfs -o /boot/initramfs.gz
Reboot the pi and check if it works.