I am working on a Raspberry Pi 3B v1.2, and I have already encrypted my root partition of the OS with LUKS.

The problem is that I would like to decrypt it or have the appropriate password to decrypt it using a Yubikey and use a challenge password at boot time.

I've being searching on Internet a lot about how to do it but everything I have found is that there is a bug that in new distros' systemd do not recognize the /etc/crypttab keyscript option (which refers to a bash script) that would create that challenge-password situation at a boot time and as a result, get the password to decrypt the root partition.

Every time I boot up the raspberry, appears one question that asks for the password (I think it is the askpass script that generates it, but I am not really sure about it) but the thing is that is not what it is expected to be. I don't know if the bug is fixed yet or not and if it is, I would really appreciate an answer on where is it and how to fix it.

By the way, I also try to use at kernel command line the cryptopts option to decrypt it with the script in bash I mentioned before, but nothing. The password needed is already saved in the yubikey and the yubikey is also configured to work on the challenge-response situation.

Also, every time I made a change on initramfs I use both sudo update-initramfs -u and sudo update-initramfs -c -k, which I know that these last one is not really recommended.

On the other hand, I've also read that there is a conflict between initramfs and the initramfs that systemd generates by itself. Something like, even if you specified to use the /etc/crypttab keyscript option it won't read it. By the way, I am using a Raspberry Pi OS, the one that offers their webpage: "Raspberry Pi OS with desktop and recommended software", debian version 11 (bullseye).

  • This seems to be a Debian question.
    – joan
    Jul 18 at 15:58
  • Good afternoon Joan. As I am working with a raspberry pi, I guess it must be here done. Anyway, I will post it also in Debian Forums. Thank you for your advice. Jul 18 at 16:23


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.