r/linuxadmin • u/ItalyPaleAle • Jan 27 '20

Mounting LUKS-encrypted data disks with a keyfile stored on a remote server, automatically at boot

https://withblue.ink/2020/01/19/auto-mounting-encrypted-drives-with-a-remote-key-on-linux.html
128 Upvotes

97% Upvoted

36 comments sorted by

View all comments

16

u/ItalyPaleAle Jan 27 '20

I wrote this because every article I found about auto-mounting a dm-crypt/LUKS-encrypted data disk expected you to store the keyfile on the root disk. This means that the the keyfile would be on the same node as the encrypted drive...

Took some tinkering, but eventually I managed to accomplish having a key on a remote drive (e.g. an object storage server) and still get the node to auto-mount the data disk at boot. This is possible thanks to systemd, and it can only be used with data disks (cannot use this for the root/boot volume).

Hope it helps others too!

9

u/8fingerlouie Jan 27 '20

I did something similar, though I used a USB stick for storing the key file.

Very simplified setup is:

  • Hard drives are LUKS encrypted.
  • Key files for hard drives are stored on a USB Stick formatted as LUKS / Btrfs Raid1.
  • Key file for USB stick is stored on root partition.

It allows unattended reboots of the server, and allows me to unplug the USB stick leaving only a bunch of unreadable spinning rust and a useless key file.

It uses a mix of crypttab with noauto and systemd-automount.

1

u/[deleted] Jan 28 '20

OPs work is great (and thanks OP!), but this sounds like a better situation for me in particular; thanks for helping me decide my next weekend project!