2.9 KiB
title | description | date | tags | |
---|---|---|---|---|
Unlocking a LUKS partition on boot via SSH on Debian | A convenient mechanism | 2025-03-07 |
|
Introduction
This article explains how to setup an SSH server intramfs unlock mechanism for a root filesystem encrypted with LUKS. I have been using this for years but never documented it!
I am used to the comfort of unlocking the partition thanks to an SSH server embedded in the initramfs. This setup has the security flaw that the initramfs could be replaced by a malicious party, but this is not something I am overly concerned about for my personal stuff so please ignore it.
Configuration
All this relies on embedding an SSH server inside the initramfs:
apt update -qq
apt install dropbear-initramfs -y
The dropbear SSH server offers some configuration options through its command line:
printf '%s' 'DROPBEAR_OPTIONS="-I 600 -j -k -p 2222 -s -E -m -c /bin/cryptroot-unlock"' >>/etc/dropbear/initramfs/dropbear.conf
printf '%s' 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILOJV391WFRYgCVA2plFB8W8sF9LfbzXZOrxqaOrrwco' >/etc/dropbear/initramfs/authorized_keys
Here I set:
-I 600
: idle timeout of 10 minutes-j -k
: disable local and remote port forwarding-p 2222
: request port 2222-s
: disable password logins so that only ssh key authentication is available-E
: log to stderr (syslog is not available at this point in the boot process)-m
: disable motd-c /bin/cryptroot-unlock
: enforce a single command, no open shell
A personal preference of mine is to forego the predictable network interface
naming of modern Linux. You can omit this step if you are fine with using
enp0s3
instead of the simple eth0
:
printf '%s' 'GRUB_CMDLINE_LINUX="net.ifnames=0"' >> /etc/default/grub
update-grub
Since this is a server I configure networking statically on this host. Sadly this initramfs component does not support IPv6 yet:
printf '%s' 'IP=37.187.244.19::37.187.244.1:255.255.0.0:myth:eth0' >>/etc/initramfs-tools/initramfs.conf
update-initramfs -k all -u
The syntax is a bit obtuse but here are the components of this line that are separated by colons:
37.187.244.19
: IP address of the server- empty: IP address of an NFS server, remnant of network boot protocols that you are unlikely to be using
37.187.244.1
: Gateway of the server255.255.255.0
: Netmask of the server. Since this initramfs network configuration system does not support gateway on link routing, the netmask needs to be big enough to encompass your IP address and the one of your gateway. For example for another host with IP address51.77.159.16
and gateway51.77.156.1
, I need a255.255.252.0
netmask.myth
: hostname of the servereth0
: interface to bring up
Conclusion
With all this done, I can reboot a server and remote unlock it without having to open the providers webui and use their clunky virtual KVM interface!