Arch Linux

1ptb3b

Member

Registered: 2017-01-17

Posts: 95

Partition layout for mounting LUKS during user login

I currently unlock a LUKS partition during my boot process. This requires me to enter a password. Then GDM kicks in and I am again required to enter a password, although this time for my GNOME user login.

I was wondering if it was possible to combine these two steps: entering the LUKS password and entering the user password.

So I checked the wiki first, and it seems like this is indeed possible.

* https://wiki.archlinux.org/title/Dm-cry … user_login
* https://wiki.archlinux.org/title/Dm-cry … g_at_login

Although, I still have some questions. I'm not quite understanding the wiki.

Assuming a fresh install, I typically partition my disk like this.

# parted -l
Model: WDC PC SN730 SDBQNTY-512G-1001 (nvme)
Disk /dev/nvme0n1: 512GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags: 

Number  Start   End    Size   File system  Name                  Flags
 1      1049kB  274MB  273MB  fat32        EFI system partition  boot, hidden, esp
 2      287MB   512GB  512GB               primary

Additional info
* Partition 1 is my boot partition, which I leave unencrypted and mount at /boot
* Partition 2 is my root partition, which I decrypt with cryptsetup and mount cryptroot at /
* I'm the only user on the entire system
* I don't use LVM
* I use GDM + Gnome
* I use systemd-boot

My question is:

* How do I need to change my partitioning if I want my LUKS partition to get decrypted and mounted at user login?
* Do I need to create additional partitions for this to work? p1=boot, p2=root, p3=user?

Last edited by 1ptb3b (2021-09-25 06:47:35)

jasonwryan

Anarchist

From: .nz

Registered: 2009-05-09

Posts: 30,426

Website

Re: Partition layout for mounting LUKS during user login

* How do I need to change my partitioning if I want my LUKS partition to get decrypted and mounted at user login?
* Do I need to create additional partitions for this to work? p1=boot, p2=root, p3=user?

* You can only unlock a non-root (ie., not the system) partition at user login - you could use a keyfile to do this to only enter credentials once
* Yes.

---

Arch + dwm   •   Mercurial repos  •   Surfraw

Registered Linux User #482438

Ammako

Member

Registered: 2021-07-16

Posts: 267

Re: Partition layout for mounting LUKS during user login

Can you read the keyfile from an external device at initramfs stage? Because if you need to embed your key file in initramfs for it to automatically unlock during boot, that just defeats the purpose of the encryption.

I guess you could keep your boot partition on a flash drive that you always keep on you, and boot from that, but if that flash drive gets stolen then you're not really any better off.

You might be able to instead use automatic or passwordless login in GDM, that way you just enter your encryption passphrase and then you log in without needing to enter your account password.