Help to enable full encryption Hetzner dedicated server - Alma 9.6

8tvlsrlz · August 10, 2025, 8:51am

Hi, any help with installing Alma Linux 9.6 on Hetzner dedicated server via installimage with full encryption ?

I try to install , but after install process and finish, server just not start.

My config:

CRYPTPASSWORD my-secret-passwd-here
DRIVE1 /dev/sda
DRIVE2 /dev/sdb    
SWRAID 1          # Enable software Raid  
SWRAIDLEVEL 1  # Use software raid level 0    
HOSTNAME My-hostname-here #Server hostname

PART /boot ext3 1024M
PART lvm vg0 all crypt

LV vg0 swap swap swap 32G
LV vg0 root / ext4 500G   
LV vg0 home /home ext4 all

IMAGE /root/images/Alma-96-amd64-base.tar.gz

edit: install script output:

Hetzner Online GmbH - installimage

  Your server will be installed now, this will take some minutes
             You can abort at any time with CTRL+C ...

         :  Reading configuration                           done 
         :  Loading image file variables                    done 
         :  Loading almalinux specific functions            done 
   1/18  :  Deleting partitions                             done 
   2/18  :  Test partition size                             done 
   3/18  :  Creating partitions and /etc/fstab              done 
   4/18  :  Creating software RAID level 1                  done 
   5/18  :  Encrypt partitions and create /etc/crypttab     done 
   6/18  :  Creating LVM volumes                            done 
   7/18  :  Formatting partitions
         :    formatting /dev/md/0 with ext3                done 
         :    formatting /dev/vg0/swap with swap            done 
         :    formatting /dev/vg0/root with ext4            done 
         :    formatting /dev/vg0/home with ext4            done 
   8/18  :  Mounting partitions                             done 
   9/18  :  Sync time via ntp                               done 
         :  Importing public key for image validation       done 
  10/18  :  Validating image before starting extraction     done 
  11/18  :  Extracting image (local)                        done 
  12/18  :  Setting up network config                       done 
  13/18  :  Executing additional commands
         :    Setting hostname                              done 
         :    Generating new SSH keys                       done 
         :    Generating mdadm config                       done 
         :    Generating ramdisk                            done 
         :    Generating ntp config                         done 
  14/18  :  Setting up miscellaneous files                  done 
  15/18  :  Configuring authentication
         :    Fetching SSH keys                             done 
         :    Disabling root password                       done 
         :    Disabling SSH root login with password        done 
         :    Copying SSH keys                              done 
  16/18  :  Installing bootloader grub                      done 
  17/18  :  Running some almalinux specific functions       done 
  18/18  :  Clearing log files                              done 

                  INSTALLATION COMPLETE
   You can now reboot and log in to your new system with the
 same credentials that you used to log into the rescue system.

With this setup, install script finish with no issue, but server not starts .

Installing with no encryption , removing all crypt options server starts.

Any help?

Thanks!

Fekthis · August 10, 2025, 9:14am

Hi @8tvlsrlz!

Two things commonly make it look like the server „doesn’t start” after an encrypted install:

1. It’s actually booting but waiting at the initramfs prompt for your LUKS passphrase (you only see that on the console/KVM, not over SSH).
2. Your machine boots in UEFI mode but the config has no EFI System Partition, so GRUB can’t start at all.

Reboot with KVM attached and enter the passphrase once to confirm it boots.
Run it:

I CAN’T GUARANTEE THAT IT WORKS 100%, SO BE CAREFUL.

// !! mount everything !! //

mdadm --assemble --scan
cryptsetup luksOpen /dev/md1 luksroot
vgchange -ay
mount /dev/vg0/root /mnt
mount /dev/vg0/home /mnt/home
mount /dev/md0 /mnt/boot
mount /dev/sda1 /mnt/boot/efi  // adjust if ESP is sda1 on your box
for d in /dev /proc /sys /run; do mount --bind $d /mnt$d; done
chroot /mnt

// install + generate configs for EFI //

grub2-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id="AlmaLinux" --recheck
grub2-mkconfig -o /boot/efi/EFI/almalinux/grub.cfg
exit

https://docs.hetzner.com/robot/dedicated-server/operating-systems/installimage/

All the best!

redadmin · August 10, 2025, 12:44pm

I agree with Fekthis — most likely it’s either waiting for the LUKS passphrase on console or missing the ESP in UEFI mode.

8tvlsrlz · August 10, 2025, 2:23pm

Hi dude, thanks to response .
You are right, after rebooting with KVM I see the initramfs prompt waiting for LUKS passphrase.

I login with my password but I get error trying :

grub2-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id="AlmaLinux" --recheck

Is test with new setup creating /boot/efi partition in my install config:

PART /boot/efi esp 256M

And install again, but same issue, maybe I need to use dropbear to unlock the partition, I see tutorials but most are for Ubuntu/Debian . Any idea how to do it in Alma , or how to replicate this script from https://community.hetzner.com/tutorials/install-ubuntu-2004-with-full-disk-encryption

Thanks again

Fekthis · August 10, 2025, 7:00pm

From what I can see, Alma 9 has Secure Boot, and the bootloader comes from the shim + grub2-efi packages. So, unfortunately, grub2-install is not used.

In installimage, use something like:

SWRAID 1
SWRAIDLEVEL 1

PART /boot/efi esp 512M
PART /boot ext2 1024M
PART lvm vg0 all crypt
On Alma 9, grub2-install is not used on UEFI (due to Secure Boot). The bootloader comes from the shim + grub2-efi packages.
LV vg0 swap swap swap 32G
LV vg0 root / ext4 500G
LV vg0 home /home ext4 all

If you want to “recreate” the correct UEFI entry (not with grub2-install)

dnf reinstall -y shim-x64 grub2-efi-x64 grub2-efi-x64-modules grub2-tools efibootmgr
mkdir -p /boot/efi/EFI/almalinux
grub2-mkconfig -o /boot/efi/EFI/almalinux/grub.cfg
efibootmgr --create --disk /dev/sda --part 1 \
  --label "AlmaLinux" --loader '\EFI\almalinux\shimx64.efi'

Yes, you can also use dropbear, but one option I can offer you would be the one below, but note that on Alma 9 it is done with dracut-sshd (and the network in initramfs):