LUKS keyfile doesn't work on boot, still the passphrase prompt

1

Hello, I am new to the community and I hope that someone has a tip that helps me further.
I have been working for some years with CentOS and now switched to Almalinux. I installed Almalinux9.3 and created with the installer the following non-LVM-partitions:

  • /boot (unencrypted)
  • /boot/efi (unencrypted)
  • /swap (LUKS2 encrypted)
  • /home (LUKS2 encrypted)
  • / (LUKS2 encrypted)
  • /tmp (LUKS2 encrypted)
  • /var (LUKS2 encrypted)
  • /var/tmp (LUKS2 encrypted)
  • /var/log (LUKS2 encrypted)
  • /var/log/audit (LUKS2 encrypted)
  • /dev/shm (LUKS2 encrypted)

CIS Benchmark Workstation Level 2 is activated

  • I created a keyfile /crypttab.key
  • cryptsetup luksAddKey UUID=f167e0cf-6f91-4ce6-8b52-f9109cf6abef /crypttab.key for all partitions
  • now there are two key slots present for each partition
  • I edited the /etc/crypttab for each LUKS partition (9 rows): luks-f167e0cf-6f91-4ce6-8b52-f9109cf6abef UUID=f167e0cf-6f91-4ce6-8b52-f9109cf6abef /crypttab.key luks
  • echo ‘install_items=“/crypttab.key /etc/crypttab”’ > /etc/dracut.conf.d/99-MyMachine.conf
  • dracut -f
    After a boot, the prompt for the passphrase still appears.
    What I am doing wrong? I tried with some other paths for the key-file, but no success.
2

Note: AlmaLinux 9 did release 9.4 in May. The release of 9.4 did EOL the 9.3 – only the latest has support. Simple dnf up should update your system to supported version.

I have used LUKS only once. That was recently. I did apparently:

dnf install clevis-luks clevis-dracut
clevis luks bind -d /dev/nvme0n1p6 tpm2 '{"hash":"sha256","key":"rsa"}'
dracut -fv --regenerate-all

(The instructions for that were somewhere within Red Hat’s RHEL documentation.)

On boot the prompt for the passphrase does appear, wait a bit, and then continue – apparently happy with whatever the “clevis” feeds from TPM.

I have no idea what the “CIS Benchmark Workstation Level 2” is, so can’t tell whether the use of TPM is ok with it.

3

Hello jlehtone,
many thanks, I updated to 9.4, but the same problem. After installing “clevis” and following your steps it worked as expected.
You are my hero :grinning: