Created
November 27, 2019 22:30
-
-
Save torwag/5976009c637c467458f750aa0ebf5e58 to your computer and use it in GitHub Desktop.
decrypt swap via keyfile during boot
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
cat /etc/mkinitcpio.conf | |
# vim:set ft=sh | |
# MODULES | |
# The following modules are loaded before any boot hooks are | |
# run. Advanced users may wish to specify all system modules | |
# in this array. For instance: | |
# MODULES=(piix ide_disk reiserfs) | |
MODULES=() | |
# BINARIES | |
# This setting includes any additional binaries a given user may | |
# wish into the CPIO image. This is run last, so it may be used to | |
# override the actual binaries included by a given hook | |
# BINARIES are dependency parsed, so you may safely ignore libraries | |
BINARIES=(/usr/bin/btrfs) | |
# FILES | |
# This setting is similar to BINARIES above, however, files are added | |
# as-is and are not parsed in any way. This is useful for config files. | |
FILES=() | |
# HOOKS | |
# This is the most important setting in this file. The HOOKS control the | |
# modules and scripts added to the image, and what happens at boot time. | |
# Order is important, and it is recommended that you do not change the | |
# order in which HOOKS are added. Run 'mkinitcpio -H <hook name>' for | |
# help on a given hook. | |
# 'base' is _required_ unless you know precisely what you are doing. | |
# 'udev' is _required_ in order to automatically load modules | |
# 'filesystems' is _required_ unless you specify your fs modules in MODULES | |
# Examples: | |
## This setup specifies all modules in the MODULES setting above. | |
## No raid, lvm2, or encrypted root is needed. | |
# HOOKS=(base) | |
# | |
## This setup will autodetect all modules for your system and should | |
## work as a sane default | |
# HOOKS=(base udev autodetect block filesystems) | |
# | |
## This setup will generate a 'full' image which supports most systems. | |
## No autodetection is done. | |
# HOOKS=(base udev block filesystems) | |
# | |
## This setup assembles a pata mdadm array with an encrypted root FS. | |
## Note: See 'mkinitcpio -H mdadm' for more information on raid devices. | |
# HOOKS=(base udev block mdadm encrypt filesystems) | |
# | |
## This setup loads an lvm2 volume group on a usb device. | |
# HOOKS=(base udev block lvm2 filesystems) | |
# | |
## NOTE: If you have /usr on a separate partition, you MUST include the | |
# usr, fsck and shutdown hooks. | |
HOOKS=(base systemd autodetect keyboard sd-vconsole modconf block sd-encrypt openswap filesystems fsck) | |
# COMPRESSION | |
# Use this to compress the initramfs image. By default, gzip compression | |
# is used. Use 'cat' to create an uncompressed image. | |
#COMPRESSION="gzip" | |
#COMPRESSION="bzip2" | |
#COMPRESSION="lzma" | |
#COMPRESSION="xz" | |
#COMPRESSION="lzop" | |
#COMPRESSION="lz4" | |
# COMPRESSION_OPTIONS | |
# Additional options for the compressor | |
#COMPRESSION_OPTIONS=() | |
cat /etc/crypttab.initramfs | |
system UUID=05d548c8-d8c8-47b1-9eef-5945ff395af4 none luks | |
swap UUID=ec03cb1f-b1d9-4dd7-b15a-1c8fa5e9cd12 /etc/luks.swap.key:UUID=05d548c8-d8c8-47b1-9eef-5945ff395af4 | |
cat /etc/crypttab | |
[sudo] password for torsten: | |
# Configuration for encrypted block devices. | |
# See crypttab(5) for details. | |
# NOTE: Do not list your root (/) partition here, it must be set up | |
# beforehand by the initramfs (/etc/mkinitcpio.conf). | |
# <name> <device> <password> <options> | |
# home UUID=b8ad5c18-f445-495d-9095-c9ec4f9d2f37 /etc/mypassword1 | |
# data1 /dev/sda3 /etc/mypassword2 | |
# data2 /dev/sda5 /etc/cryptfs.key | |
# vol /dev/sdb7 none | |
swap UUID=ec03cb1f-b1d9-4dd7-b15a-1c8fa5e9cd12 /etc/luks.swap.key |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
log for the above settings...
Nov 27 22:03:44 archlinux systemd[1]: Starting Cryptography Setup for system...
Nov 27 22:03:44 archlinux mount[297]: mount: /run/systemd/cryptsetup/keydev-swap: unknown filesystem type 'crypto_LUKS>
Nov 27 22:03:44 archlinux systemd[1]: run-systemd-cryptsetup-keydev\x2dswap.mount: Mount process exited, code=exited, >
Nov 27 22:03:44 archlinux systemd[1]: run-systemd-cryptsetup-keydev\x2dswap.mount: Failed with result 'exit-code'.
Nov 27 22:03:44 archlinux systemd[1]: Failed to mount /run/systemd/cryptsetup/keydev-swap.
Nov 27 22:03:44 archlinux systemd[1]: Dependency failed for Cryptography Setup for swap.
Nov 27 22:03:44 archlinux systemd[1]: Dependency failed for /dev/mapper/swap.
Nov 27 22:03:44 archlinux systemd[1]: Dependency failed for Resume from hibernation using device /dev/mapper/swap.
Nov 27 22:03:44 archlinux systemd[1]: [email protected]: Job systemd-hibernate-resume@d>
Nov 27 22:03:44 archlinux systemd[1]: dev-mapper-swap.device: Job dev-mapper-swap.device/start failed with result 'dep>
Nov 27 22:03:44 archlinux systemd[1]: Dependency failed for Local Encrypted Volumes.
Nov 27 22:03:44 archlinux systemd[1]: cryptsetup.target: Job cryptsetup.target/start failed with result 'dependency'.
Nov 27 22:03:44 archlinux systemd[1]: [email protected]: Job [email protected]/start faile>
Nov 27 22:03:44 archlinux systemd[1]: Unnecessary job for /dev/disk/by-uuid/ec03cb1f-b1d9-4dd7-b15a-1c8fa5e9cd12 was r>
Nov 27 22:03:44 archlinux systemd[1]: Reached target Local File Systems (Pre).
Nov 27 22:03:44 archlinux systemd[1]: Reached target Local File Systems.
Nov 27 22:03:44 archlinux systemd[1]: Reached target System Initialization.
Nov 27 22:03:44 archlinux systemd[1]: Reached target Basic System.
Nov 27 22:03:44 archlinux kernel: device-mapper: uevent: version 1.0.3
Nov 27 22:03:44 archlinux kernel: device-mapper: ioctl: 4.40.0-ioctl (2019-01-18) initialised: [email protected]
Nov 27 22:03:44 archlinux systemd-cryptsetup[300]: WARNING: Locking directory /run/cryptsetup is missing!
Nov 27 22:03:44 archlinux systemd[1]: Started Dispatch Password Requests to Console.
Nov 27 22:03:44 archlinux audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=systemd-ask-pas>