Re: Boot with encrypted disk but only with USB Stick

On 4 Mar 2025 11:19 +0100, from [email protected] (Dirk Nichterwitz):
> I have configured my system to boot a luks encrypted harddisk. I addes a
> keyfile on a usb stick and this works to boot automaticaly when plugged in .
> But ist her a way to configure the system to only boot with stick ? because
> if i unplug the stick the system ask für passphrase.

To cryptsetup, a key file (in the sense of its --key-file parameter;
not --volume-key-file/--master-key-file) _is_ a passphrase. See
cryptsetup-open(8) under OPTIONS.

So you will need something outside of cryptsetup to detect whether the
USB stick is plugged in and if not, stop the boot process and/or
prompt to insert the USB stick, before the boot process gets to the
point of unlocking the container. Exactly how to do that will depend
on your distribution and init system, but as Arno suggested, will
likely involve tweaking the initrd. For example, on a Debian-based
system, you'd likely start out somewhere under /etc/initramfs-tools.

Note that doing this won't add any security compared to your current
situation; anyone who wants to attack the container can still do so
normally, because they can either remove the storage device or make a
full-disk copy of it and attack that with no regard to your boot
scripts.

-- 
Michael Kjörling
🔗 https://michael.kjorling.se