I am using a raspberry pi 2 stretch and have a working set up where the root partition is encrypted using luks and can be remotely mounted via entering the password via ssh (dropbear and initramfs). The luks root partition is located on the local SD card. Now I want to move the encrypted luks root partition to an external USB HDD drive and I am failing... I am able to connect via dropbear and enter the password. The dropbear session drops but I can not connect via ssh after that to the actual session. Can anybody spot an issue below?

I copied the root partition from SD-card to USD HDD on a linux machine with both devices connected by the following:

    # copy sd card
    dd if=/dev/sdcard of=/tmp/root.img bs=4M
    e2fsck -f /tmp/root.img
    resize2fs -M /tmp/root.img   

    # create luks partition on usb hdd
    sudo cryptsetup -v -y --cipher aes-cbc-essiv:sha256 --key-size 256 luksFormat /dev/usbhdd
    sudo cryptsetup -v luksOpen /dev/usbhdd crypt

    # copy root partition from sd card to hdd
    sudo dd if=/tmp/root.img of=/dev/mapper/crypt bs=4M
    sudo e2fsck /dev/mapper/crypt
    sudo resize2fs /dev/mapper/crypt

Finally, I attached the usb hdd and sd card back to the raspberry and recreated the initramfs on the raspberry by:

sudo mkinitramfs -o /boot/initramfs.gz

The changed configuration files on boot and root partition look like this:

cmdline.txt on SD-card boot partition:

    dwc_otg.lpm_enable=0 console=serial0,115200 console=tty1 root=/dev/mapper/crypt cryptdevice=/dev/sda1:crypt rootfstype=ext4 elevator=deadline fsck.repair=yes rootwait rootdelay=5

config.txt on SD-card boot partition (added the following lines):

initramfs initramfs.gz followkernel

/etc/fstab on SD-card and USB HDD root partition:

    proc            /proc           proc    defaults          0       0
PARTUUID=c406c9b7-01  /boot           vfat    defaults          0       2
/dev/mapper/crypt  /               ext4    defaults,noatime  0       1
# a swapfile is not a swap partition, no line here
#   use  dphys-swapfile swap[on|off]  for that

/etc/crypttab on SD-card and USB HDD root partition:

crypt   /dev/sda1   none    luks

etc/dropbear-initramfs/authorized_keys on SD-card and USB HDD root partition:

command="/scripts/local-top/cryptroot && kill -9 `ps | grep -m 1 'cryptroot' | cut -d ' ' -f 3` && exit"
ecdsa-sha2-nistp256 xxxx xx@xx

etc/cryptsetup-initramfs/conf-hook on SD-card and USB HDD root partition:


In addition I added the following script as etc/kernel/postinst.d/initramfs-rebuild:

#!/bin/sh -e

# Rebuild initramfs.gz after kernel upgrade to include new kernel's modules.
# https://github.com/Robpol86/robpol86.com/blob/master/docs/_static/initramfs-rebuild.sh
# Save as (chmod +x): /etc/kernel/postinst.d/initramfs-rebuild

# Remove splash from cmdline.
if grep -q '\bsplash\b' /boot/cmdline.txt; then
  sed -i 's/ \?splash \?/ /' /boot/cmdline.txt

# Exit if not building kernel for this Raspberry Pi's hardware version.
current_version="$(uname -r)"
case "${current_version}" in
    case "${version}" in
      *-v7+) ;;
      *) exit 0
    case "${version}" in
      *-v7+) exit 0 ;;

# Exit if rebuild cannot be performed or not needed.
[ -x /usr/sbin/mkinitramfs ] || exit 0
[ -f /boot/initramfs.gz ] || exit 0
lsinitramfs /boot/initramfs.gz |grep -q "/$version$" && exit 0  # Already in initramfs.

# Rebuild.
mkinitramfs -o /boot/initramfs.gz "$version"

.... sry guys... sometimes just writing a post and just starting from scratch helps... it works as described above. Just had to start from preconditions – something was corrupted while playing around making it work.

  • Please accept your own answer with a click on the tick on its left side. Only this will finish the question and it will not pop up again year for year. – Ingo Jan 19 '20 at 15:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.