Multiple LUKS+dm_crypt datasets demands multiple passphrases at boot time

Question

I am experimenting with LUKS+dm_crypt. My setup is something like this: a LVM VG made of multiple Physical Volumes (PV). That VG contains multiple LV (Logical Volumes), most of them encrypted via LUKS+dm_crypt (via cryptsetup).

Editing "/etc/crypttab", the system will requiere a passphrase for each encrypted LV. But since all my encrypted LVs share the same passphrase, I would like to be prompted only ONCE, instead of twelve times (I have 12 encrypted LV).

I have thought about writing a script to include in initrd that ask for the password once, store the result somewhere volatile (ramdisk?), and provide that password for the rest of "/etc/crypttab" entries.

But this seems complex and fragile.

I wonder if there is something I am missing, or some other easier way.

Answer 1

This might help: Setting up an encrypted Debian system

Answer 2

Store the keys on a USB device or SD card. Encrypt this with a key stored on the initrd.

Write the script to wait for the device or card, apply the stored key, and then pull the remainder of the keys from this device.