udisks icon indicating copy to clipboard operation
udisks copied to clipboard

Use key-file specified in crypttab

Open debnath-d opened this issue 1 year ago • 0 comments

From crypttab's manpage:

Each line is in the form

    volume-name encrypted-device key-file options

...

 3. The third field specifies an absolute path to a file with the
    encryption key. Optionally, the path may be followed by ":"
    and an /etc/fstab style device specification (e.g. starting
    with "LABEL=" or similar); in which case the path is taken
    relative to the specified device's file system root. If the
    field is not present or is "none" or "-", a key file named
    after the volume to unlock (i.e. the first column of the
    line), suffixed with .key is automatically loaded from the
    /etc/cryptsetup-keys.d/ and /run/cryptsetup-keys.d/
    directories, if present. Otherwise, the password has to be
    manually entered during system boot. For swap encryption,
    /dev/urandom may be used as key file, resulting in a
    randomized key.   

Currently, udiskctl unlock does not use the key-file specified either in /etc/crypttab or automatically from /etc/cryptsetup-keys.d/ if not specified in /etc/crypttab.

It would be great if the key-file (either specified in /etc/crypttab or located in /etc/cryptsetup-keys.d/) could be used automatically by udiskctl to unlock the encrypted device without needing to use the --key-file option or without prompting the user for a passphrase.

debnath-d avatar Sep 18 '23 14:09 debnath-d