Skip to content

Instantly share code, notes, and snippets.

@torwag
Created November 27, 2019 22:30
Show Gist options
  • Save torwag/5976009c637c467458f750aa0ebf5e58 to your computer and use it in GitHub Desktop.
Save torwag/5976009c637c467458f750aa0ebf5e58 to your computer and use it in GitHub Desktop.
decrypt swap via keyfile during boot
cat /etc/mkinitcpio.conf
# vim:set ft=sh
# MODULES
# The following modules are loaded before any boot hooks are
# run. Advanced users may wish to specify all system modules
# in this array. For instance:
# MODULES=(piix ide_disk reiserfs)
MODULES=()
# BINARIES
# This setting includes any additional binaries a given user may
# wish into the CPIO image. This is run last, so it may be used to
# override the actual binaries included by a given hook
# BINARIES are dependency parsed, so you may safely ignore libraries
BINARIES=(/usr/bin/btrfs)
# FILES
# This setting is similar to BINARIES above, however, files are added
# as-is and are not parsed in any way. This is useful for config files.
FILES=()
# HOOKS
# This is the most important setting in this file. The HOOKS control the
# modules and scripts added to the image, and what happens at boot time.
# Order is important, and it is recommended that you do not change the
# order in which HOOKS are added. Run 'mkinitcpio -H <hook name>' for
# help on a given hook.
# 'base' is _required_ unless you know precisely what you are doing.
# 'udev' is _required_ in order to automatically load modules
# 'filesystems' is _required_ unless you specify your fs modules in MODULES
# Examples:
## This setup specifies all modules in the MODULES setting above.
## No raid, lvm2, or encrypted root is needed.
# HOOKS=(base)
#
## This setup will autodetect all modules for your system and should
## work as a sane default
# HOOKS=(base udev autodetect block filesystems)
#
## This setup will generate a 'full' image which supports most systems.
## No autodetection is done.
# HOOKS=(base udev block filesystems)
#
## This setup assembles a pata mdadm array with an encrypted root FS.
## Note: See 'mkinitcpio -H mdadm' for more information on raid devices.
# HOOKS=(base udev block mdadm encrypt filesystems)
#
## This setup loads an lvm2 volume group on a usb device.
# HOOKS=(base udev block lvm2 filesystems)
#
## NOTE: If you have /usr on a separate partition, you MUST include the
# usr, fsck and shutdown hooks.
HOOKS=(base systemd autodetect keyboard sd-vconsole modconf block sd-encrypt openswap filesystems fsck)
# COMPRESSION
# Use this to compress the initramfs image. By default, gzip compression
# is used. Use 'cat' to create an uncompressed image.
#COMPRESSION="gzip"
#COMPRESSION="bzip2"
#COMPRESSION="lzma"
#COMPRESSION="xz"
#COMPRESSION="lzop"
#COMPRESSION="lz4"
# COMPRESSION_OPTIONS
# Additional options for the compressor
#COMPRESSION_OPTIONS=()
cat /etc/crypttab.initramfs
system UUID=05d548c8-d8c8-47b1-9eef-5945ff395af4 none luks
swap UUID=ec03cb1f-b1d9-4dd7-b15a-1c8fa5e9cd12 /etc/luks.swap.key:UUID=05d548c8-d8c8-47b1-9eef-5945ff395af4
cat /etc/crypttab
[sudo] password for torsten:
# Configuration for encrypted block devices.
# See crypttab(5) for details.
# NOTE: Do not list your root (/) partition here, it must be set up
# beforehand by the initramfs (/etc/mkinitcpio.conf).
# <name> <device> <password> <options>
# home UUID=b8ad5c18-f445-495d-9095-c9ec4f9d2f37 /etc/mypassword1
# data1 /dev/sda3 /etc/mypassword2
# data2 /dev/sda5 /etc/cryptfs.key
# vol /dev/sdb7 none
swap UUID=ec03cb1f-b1d9-4dd7-b15a-1c8fa5e9cd12 /etc/luks.swap.key
@torwag
Copy link
Author

torwag commented Nov 27, 2019

log for the above settings...
Nov 27 22:03:44 archlinux systemd[1]: Starting Cryptography Setup for system...
Nov 27 22:03:44 archlinux mount[297]: mount: /run/systemd/cryptsetup/keydev-swap: unknown filesystem type 'crypto_LUKS>
Nov 27 22:03:44 archlinux systemd[1]: run-systemd-cryptsetup-keydev\x2dswap.mount: Mount process exited, code=exited, >
Nov 27 22:03:44 archlinux systemd[1]: run-systemd-cryptsetup-keydev\x2dswap.mount: Failed with result 'exit-code'.
Nov 27 22:03:44 archlinux systemd[1]: Failed to mount /run/systemd/cryptsetup/keydev-swap.
Nov 27 22:03:44 archlinux systemd[1]: Dependency failed for Cryptography Setup for swap.
Nov 27 22:03:44 archlinux systemd[1]: Dependency failed for /dev/mapper/swap.
Nov 27 22:03:44 archlinux systemd[1]: Dependency failed for Resume from hibernation using device /dev/mapper/swap.
Nov 27 22:03:44 archlinux systemd[1]: systemd-hibernate-resume@dev-mapper-swap.service: Job systemd-hibernate-resume@d>
Nov 27 22:03:44 archlinux systemd[1]: dev-mapper-swap.device: Job dev-mapper-swap.device/start failed with result 'dep>
Nov 27 22:03:44 archlinux systemd[1]: Dependency failed for Local Encrypted Volumes.
Nov 27 22:03:44 archlinux systemd[1]: cryptsetup.target: Job cryptsetup.target/start failed with result 'dependency'.
Nov 27 22:03:44 archlinux systemd[1]: systemd-cryptsetup@swap.service: Job systemd-cryptsetup@swap.service/start faile>
Nov 27 22:03:44 archlinux systemd[1]: Unnecessary job for /dev/disk/by-uuid/ec03cb1f-b1d9-4dd7-b15a-1c8fa5e9cd12 was r>
Nov 27 22:03:44 archlinux systemd[1]: Reached target Local File Systems (Pre).
Nov 27 22:03:44 archlinux systemd[1]: Reached target Local File Systems.
Nov 27 22:03:44 archlinux systemd[1]: Reached target System Initialization.
Nov 27 22:03:44 archlinux systemd[1]: Reached target Basic System.
Nov 27 22:03:44 archlinux kernel: device-mapper: uevent: version 1.0.3
Nov 27 22:03:44 archlinux kernel: device-mapper: ioctl: 4.40.0-ioctl (2019-01-18) initialised: dm-devel@redhat.com
Nov 27 22:03:44 archlinux systemd-cryptsetup[300]: WARNING: Locking directory /run/cryptsetup is missing!
Nov 27 22:03:44 archlinux systemd[1]: Started Dispatch Password Requests to Console.
Nov 27 22:03:44 archlinux audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=systemd-ask-pas>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment