Skip to content

Instantly share code, notes, and snippets.

Last active February 28, 2024 07:05
Show Gist options
  • Save cmsj/94441d96568f3415a0258452cc582c21 to your computer and use it in GitHub Desktop.
Save cmsj/94441d96568f3415a0258452cc582c21 to your computer and use it in GitHub Desktop.
Ansible to add dropbear (ie an SSH server) to your initramfs, for unlocking encrypted root partitions

This is some Ansible (for Ubuntu 22.04) to install and configure your initramfs to run dropbear (ie an SSH server).

Super handy if you have an encrypted root partition and don't have physical access to the machine to enter the encryption passphrase on the console.


  • You'll need to put your actual public SSH keys, instead of the blahblah placeholder I have here
  • I set dropbear to run on port 31337 so the hostkey doesn't clash with the main OS' key in your ~/.ssh/known_hosts
  • This expects to be able to trigger two Ansible handlers when it makes changes, they are listed separately at the bottom
  • You'll need to change the GRUB_CMDLINE_LINUX_DEFAULT line below to have the actual IP/gateway/NIC/hostname you want the kernel to configure
  • After you ssh in when the machine is booting, the command to actually unlock the root filesystem is: cryptroot-unlock
# This is a playbook version of

- name: Install dropbear-initramfs
    name: dropbear-initramfs
    state: present

- name: Install busybox-static
    name: busybox-static
    state: present

- name: Configure dropbear-initramfs options
    path: /etc/dropbear/initramfs/dropbear.conf
    regexp: 'DROPBEAR_OPTIONS'
    line: 'DROPBEAR_OPTIONS="-p 31337 -s -j -k -I 60"'
  notify: update initramfs

- name: Add dropbear authorized_keys
    dest: /etc/dropbear/initramfs/authorized_keys
    mode: 0600
    owner: root
    group: root
    content: |
      ssh-rsa AAAAblahblahsshpubkey foo@bar
  notify: update initramfs

# The format of the ip= kernel parameter is: <client-ip>:<server-ip>:<gw-ip>:<netmask>:<hostname>:<device>:<autoconf>
# It comes from
- name: Configure boot IP and consoleblanking
    path: /etc/default/grub
  notify: update grub

Ansible handlers:

- name: update initramfs
  command: update-initramfs -u

- name: update grub
  command: update-grub
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment