---
title: 'Unlocking a LUKS partition on boot via SSH on Debian'
description: 'A convenient mechanism'
date: '2025-03-07'
tags:
- Debian
---

## Introduction

This article explains how to setup an SSH server intramfs unlock mechanism for a
root filesystem encrypted with LUKS. I have been using this for years but never
documented it!

I am used to the comfort of unlocking the partition thanks to an SSH server
embedded in the initramfs. This setup has the security flaw that the initramfs
could be replaced by a malicious party, but this is not something I am overly
concerned about for my personal stuff so please ignore it.

## Configuration

All this relies on embedding an SSH server inside the initramfs:

``` shell
apt update -qq
apt install dropbear-initramfs -y
```

The dropbear SSH server offers some configuration options through its command line:
``` shell
printf '%s' 'DROPBEAR_OPTIONS="-I 600 -j -k -p 2222 -s -E -m -c /bin/cryptroot-unlock"' >>/etc/dropbear/initramfs/dropbear.conf
printf '%s' 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILOJV391WFRYgCVA2plFB8W8sF9LfbzXZOrxqaOrrwco' >/etc/dropbear/initramfs/authorized_keys
```

Here I set:
- `-I 600`: idle timeout of 10 minutes
- `-j -k`: disable local and remote port forwarding
- `-p 2222`: request port 2222
- `-s`: disable password logins so that only ssh key authentication is available
- `-E`: log to stderr (syslog is not available at this point in the boot process)
- `-m`: disable motd
- `-c /bin/cryptroot-unlock`: enforce a single command, no open shell

A personal preference of mine is to forego the predictable network interface
naming of modern Linux. You can omit this step if you are fine with using
`enp0s3` instead of the simple `eth0`:

``` shell
printf '%s' 'GRUB_CMDLINE_LINUX="net.ifnames=0"' >> /etc/default/grub
update-grub
```

Since this is a server I configure networking statically on this host. Sadly
this initramfs component does not support IPv6 yet:

``` shell
printf '%s' 'IP=37.187.244.19::37.187.244.1:255.255.0.0:myth:eth0' >>/etc/initramfs-tools/initramfs.conf
update-initramfs -k all -u
```

The syntax is a bit obtuse but here are the components of this line that are separated by colons:
- `37.187.244.19`: IP address of the server
- empty: IP address of an NFS server, remnant of network boot protocols that you
  are unlikely to be using
- `37.187.244.1`: Gateway of the server
- `255.255.255.0`: Netmask of the server. Since this initramfs network
  configuration system does not support gateway on link routing, the netmask
  needs to be big enough to encompass your IP address and the one of your
  gateway. For example for another host with IP address `51.77.159.16` and
  gateway `51.77.156.1`, I need a `255.255.252.0` netmask.
- `myth`: hostname of the server
- `eth0`: interface to bring up

## Conclusion

With all this done, I can reboot a server and remote unlock it without having to
open the providers webui and use their clunky virtual KVM interface!