Re: Boot with encrypted disk but only with USB Stick

Hey.


On Tue, 2025-03-04 at 11:19 +0100, Dirk Nichterwitz wrote:
> I addes a
> keyfile on a usb stick and this works to boot automaticaly when
> plugged in .
> But ist her a way to configure the system to only boot with stick ?
> because
> if i unplug the stick the system ask für passphrase.
> 
> But i want a system only works with stick and no way to do a other
> boot.

Not sure what exactly you want:


You can simply install your bootloader, kernel and initramfs on the USB
stick (along with any keys needed for decryption).

Most BIOSes/UEFIs support booting from USB.

That way, an attacker cannot mess with these parts, which would
otherwise be completely open.
Of course a powerful enough attacker could still replace your firmware.
And of course this only makes sense if you then keep your USB stick
with you "all the time".


Or do you want to continue to boot from your regular storage drive, but
simply get no passphrase prompt in case the stick is not present?


Cheers
Chris.