Linux Tips

Linux LUKS Keyfile: 4 Steps to Automate Disk Unlocking

- by John Britto - Leave a Comment - 1 min read
Quick Linux Tip #110:

Question: My encrypted data disk needs password every boot. How do I automate it safely?

Try: sudo cryptsetup luksAddKey /dev/sdb1 /root/keyfile.bin

Info: Adds a keyfile slot to LUKS for automated boot decryption.

Examples:

  • $ sudo cryptsetup luksDump /dev/sdb1  # Inspect active LUKS key slots
  • $ sudo cryptsetup luksRemoveKey /dev/sdb1  # Revoke a specific key slot
  • $ sudo cryptsetup luksChangeKey /dev/sdb1  # Update an existing passphrase

Note: Storing a keyfile unencrypted on the same drive defeats security. Use separate keys, TPM 2.0 (systemd-cryptenroll), or network unlocking (Clevis/Tang) for production.




LinuxTeck.com 
linuxteck:~$ sudo cryptsetup luksAddKey /dev/sdb1 /root/keyfile.bin
Enter any existing passphrase:

linuxteck:~$ sudo chmod 0400 /root/keyfile.bin

linuxteck:~$ sudo blkid /dev/sdb1
/dev/sdb1: UUID="a1b2c3d4-5e6f-7890-abcd-ef1234567890" TYPE="crypto_LUKS"

linuxteck:~$ echo 'data_crypt UUID=a1b2c3d4-5e6f-7890-abcd-ef1234567890 /root/keyfile.bin luks' | sudo tee -a /etc/crypttab

linuxteck:~$ sudo update-initramfs -u
linuxteck:~$

PREVIOUS ARTICLE Quick Linux Tip #109: Linux Terminal Session Recording: 3 Easy Methods NEXT ARTICLE Quick Linux Tip #111: Hardlinks in Linux: 3 Commands to Find Duplicate Files
About John Britto

John Britto Founder & Chief-Editor @LinuxTeck. A Computer Geek and Linux Intellectual having more than 20+ years of experience in Linux and Open Source technologies.

View all posts by John Britto →

Leave a Reply

Your email address will not be published.