- 1 mkinitcpio
- 2 Boot loader
- 3 crypttab
- 4 Troubleshooting
When encrypting a system it is necessary to regenerate the initial ramdisk after properly configuring mkinitcpio. Depending on the particular scenarios, a subset of the following hooks will have to be enabled:
|| Always needed when encrypting the root partition, or a partition that needs to be mounted before root. It is not needed in all the other cases, as system initialization scripts like |
||Needed to make keyboards work in early userspace.|
|| Provides support for non-US keymaps for typing encryption passwords; it must come before the |
|| Loads an alternative console font in early userspace. Set your font in |
Other hooks needed should be clear from other manual steps followed during the installation of the system.
/etc/mkinitcpio.conf configuration using
... HOOKS=(base udev autodetect keyboard keymap consolefont modconf block encrypt lvm2 filesystems fsck) ...
A configuration with systemd-based initramfs using
... HOOKS=(base systemd autodetect keyboard sd-vconsole modconf block sd-encrypt sd-lvm2 filesystems fsck) ...
For example using GRUB the relevant parameters are best added to
/etc/default/grub before generating the boot configuration. See also GRUB#Warning when installing in chroot as another point to be aware of when installing the GRUB loader.
The kernel parameters you need to specify depend on whether or not you are using the
encrypt hook or the
Kernel parameters like
resume are specified the same way for both
root= parameter specifies the
device of the actual (decrypted) root file system:
- If the file system is formatted directly on the decrypted device file this will be
- If a LVM gets activated first and contains an encrypted logical rootvolume, the above form applies as well.
- If the root file system is contained in a logical volume of a fully encrypted LVM, the device mapper for it will be in the general form of
deviceis the device file of the decrypted (swap) filesystem used for suspend to disk. If swap is on a separate partition, it will be in the form of
/dev/mapper/swap. See also dm-crypt/Swap encryption.
Using encrypt hook
This parameter will make the system prompt for the passphrase to unlock the device containing the encrypted root on a cold boot. It is parsed by the
encrypt hook to identify which device contains the encrypted system:
deviceis the path to the device backing the encrypted device. Usage of Persistent block device naming is advisable.
dmnameis the device-mapper name given to the device after decryption, which will be available as
- If a LVM contains the encrypted root, the LVM gets activated first and the volume group containing the logical volume of the encrypted root serves as device. It is then followed by the respective volume group to be mapped to root. The parameter follows the form of
This parameter specifies the location of a keyfile and is required by the
encrypt hook for reading such a keyfile to unlock the
cryptdevice (unless a key is in the default location, see below). It can have three parameter sets, depending on whether the keyfile exists as a file in a particular device, a bitstream starting on a specific location, or a file in the initramfs.
For a file in a device the format is:
deviceis the raw block device where the key exists.
fstypeis the filesystem type of
pathis the absolute path of the keyfile within the device.
For a bitstream on a device the key's location is specified with the following:
where the offset is in bytes and the size in bits. Example:
cryptkey=/dev/sdZ:0:512 reads a 512 bit keyfile starting at the beginning of the device.
:, you have to escape it with three backslash
\. In that case the cryptkey parameter would be as follow:
cryptkey=/dev/disk/by-id/usb-123456-0\\\:0:0:512for a usb key with the id
Also note that if
cryptkey is not specified, it defaults to
/crypto_keyfile.bin (in the initramfs).
See also dm-crypt/Device encryption#Keyfiles.
This parameter is specific to pass dm-crypt plain mode options to the encrypt hook.
It takes the form
The arguments relate directly to the cryptsetup options. See dm-crypt/Device encryption#Encryption options for plain mode.
For a disk encrypted with just plain default options, the
crypto arguments must be specified, but each entry can be left blank:
A specific example of arguments is
Using sd-encrypt hook
In all of the following
rd.luks can be replaced with
rd.luks parameters are only honored by the initrd.
luks parameters are honored by both the main system and initrd. Unless you want to control devices which get unlocked after boot from kernel command line use
rd.luks. See for more options and more details.
- If the file
/etc/crypttab.initramfsexists, mkinitcpio will add it to the initramfs as
/etc/crypttab, you can specify devices that need to be unlocked at boot there. Syntax is documented in .
/etc/crypttab.initramfsis not limited to using only UUID like
rd.luks. You can use any of the persistent block device naming methods.
rd.luks.*parameters, only those devices specified on the kernel command line will be activated and you will see
Not creating device 'devicename' because it was not specified on the kernel command line.. To activate all devices in
/etc/crypttabdo not specify any
luks.*parameters and use
rd.luks.*. To activate all devices in
/etc/crypttab.initramfsdo not specify any
Specify the UUID of the device to be decrypted on boot with this flag. If the UUID is in
/etc/crypttab.initramfs, the options listed there will be used. For
luks.uuid options from
/etc/crypttab will be used.
Specify the name of the mapped device after the LUKS partition is open. For example, specifying
UUID=cryptroot causes the unlocked device to be located at
/dev/mapper/cryptroot. If this is not specified the mapped device will be located at
/dev/mapper/luks-UUID where UUID is the UUID of the LUKS partition. When using this parameter you can omit
This is equivalent to the second parameter of
Specify options for the device listed after
UUID or, if not specified, for all UUIDs not specified elsewhere (e.g., crypttab).
This is roughly equivalent to the third parameter of
Follows a similar format to options in crypttab - options are separated by commas, options with values are specified using
Specify the location of a password file used to decrypt the device specified in
rd.luks.UUID. There is no default location like there is with the
encrypt hook parameter
There are two options that affect the timeout for entering the password during boot:
rd.luks.options=timeout=mytimeoutspecifies the timeout for querying for a password
rootflags=x-systemd.device-timeout=mytimeoutspecifies how long systemd should wait for the rootfs device to show up before giving up (defaults to 90 seconds)
If you want to disable the timeout altogether, then set both timeouts to zero:
/etc/crypttab (encrypted device table) file is similar to the fstab file and contains a list of encrypted devices to be unlocked during system boot up. This file can be used for automatically mounting encrypted swap devices or secondary file systems.
crypttab is read before
fstab, so that dm-crypt containers can be unlocked before the file system inside is mounted. Note that
crypttab is read after the system has booted up, therefore it is not a replacement for unlocking encrypted partitions by using mkinitcpio hooks and boot loader options as in the case of encrypting the root partition.
crypttab processing at boot time is made by the
See #Mounting at boot time section for instructions on how to use UUIDs to mount an encrypted device.for details, read below for some examples, and the
sd-encrypthook, if a non-root partition's passphrase is the same as root's, there is no need to put that non-root partition in crypttab due to passphrase caching. See this forum thread for more information.
crypttabentries for dm-crypt plain mode (
--type plain) devices:
--type plaindevices with a keyfile, it is necessary to add the
hash=plainoption to crypttab due to a systemd incompatibility. Do not use
systemd-cryptsetupmanually for device creation to work around it.
- It may be further required to add the
plainoption explicitly to force
systemd-cryptsetupto recognize a
--type plain) device at boot. See systemd issue 442.
# Example crypttab file. Fields are: name, underlying device, passphrase, cryptsetup options. # Mount /dev/lvm/swap re-encrypting it with a fresh key each reboot swap /dev/lvm/swap /dev/urandom swap,cipher=aes-xts-plain64,size=256 # Mount /dev/lvm/tmp as /dev/mapper/tmp using plain dm-crypt with a random passphrase, making its contents unrecoverable after it is dismounted. tmp /dev/lvm/tmp /dev/urandom tmp,cipher=aes-xts-plain64,size=256 # Mount /dev/lvm/home as /dev/mapper/home using LUKS, and prompt for the passphrase at boot time. home /dev/lvm/home # Mount /dev/sdb1 as /dev/mapper/backup using LUKS, with a passphrase stored in a file. backup /dev/sdb1 /home/alice/backup.key
Mounting at boot time
If you want to mount an encrypted drive at boot time, enter the device's UUID in
/etc/crypttab. You get the UUID (partition) by using the command
lsblk -f and adding it to
crypttab in the form:
externaldrive UUID=2f9a8428-ac69-478a-88a2-4aa458565431 none luks,timeout=180
The first parameter is your preferred device mapper's name for the encrypted drive. The option
none will trigger a prompt during boot to type the passphrase for unlocking the partition. The
timeout option defines a timeout in seconds for entering the decryption password during boot.
crypttabonly determines the amount of time allowed for entering the password of the encrypted device. In addition, systemd also has a default timeout which determines the amount of time allowed for the device to be available (defaulting to 90 seconds), which is independent of the password timer. In consequence, even when the
crypttabis set to a value larger than 90 seconds (or it is at its default value of 0, meaning unlimited time), systemd will still only wait a maximum of 90 seconds for the device to be unlocked. In order to change the time systemd will wait for a device to be available, the option
x-systemd.device-timeout(see ) can be set in fstab for said device. It is probably desired, then, that the amount of time of the
crypttabis equal to the amount of time of the
fstabfor each device mounted at boot time.
A keyfile can also be set up and referenced instead of
none. This results in an automatic unlocking, if the keyfile is accessible during boot. Since LUKS offers the option to have multiple keys, the chosen option can also be changed later.
Use the device mapper's name you have defined in
/etc/fstab as follows:
/dev/mapper/externaldrive /mnt/backup ext4 defaults,errors=remount-ro 0 2
/dev/mapper/externaldrive already is the result of a unique partition mapping, there is no need to specify an UUID for it. In any case, the mapper with the filesystem will have a different UUID than the partition it is encrypted in.
Mounting a stacked blockdevice
The systemd generators also automatically process stacked block devices at boot.
$ lsblk -f
─sdXX linux_raid_member │ └─md0 crypto_LUKS │ └─cryptedbackup LVM2_member │ └─vgraid-lvraid ext4 /mnt/backup └─sdYY linux_raid_member └─md0 crypto_LUKS └─cryptedbackup LVM2_member └─vgraid-lvraid ext4 /mnt/backup
will ask for the passphrase and mount automatically at boot.
Given you specify the correct corresponding crypttab (e.g. UUID for the
crypto_LUKS device) and fstab (
/dev/mapper/vgraid-lvraid) entries, there is no need to add additional mkinitcpio hooks/configuration, because
/etc/crypttab processing applies to non-root mounts only. One exception is when the
mdadm_udev hook is used already (e.g. for the root device). In this case
/etc/madadm.conf and the initramfs need updating to achieve the correct root raid is picked first.