View source for Encrypting root partition with decryption key on USB thumb drive

'''Problem:'''
* Your root partition of Debian Linux is encrypted  with DM-Crypt + LUKS.
* On each boot process you have to enter the password to decrypt the root partition.
* This description explains how to atomatically decrypt the root partition using a decryption key on a USB thumb drive. 

'''Solution:'''
* Prepare a USB thumb drive with an ''ext3'' or a ''vfat'' partition and label the partition. In this example ''mypartitionlabel'' is used as label.
* Create a key file on the USB thumb drive which will be later used to decrypt the root partition:
 dd if=/dev/urandom of=/media/usb/.keys/my.key bs=4k count=1
* Add the new created key to the LUKS partition (in this example the root partition is ''/dev/sda1'') that it can be used to decrypt it:
 cryptsetup luksAddKey /dev/sda1 /media/usb/.keys/my.key
* Create a bash script (e.g. ''/root/getkey.sh'') which mounts the USB thumb drive and reads the key:
 #!/bin/sh
 modprobe usb-storage 1>&2
 modprobe ehci-hcd 1>&2
 sleep 1
 mkdir /usb 1>&2
 mount /dev/disk/by-label/mypartitionlabel -t ext3 -o ro /usb 1>&2
 cat /usb/.keys/my.key
 umount /usb 1>&2
* Add the following lines to ''/etc/initramfs-tools/modules'':
 ext3
 ehci-hcd
 usb-storage
 nls_cp437
 nls_iso8859_1
 vfat
* Adapt the ''/etc/crypttab'' to use the script which gets the key:
 sda1_crypt UUID=24ef106a-6ed3-4d28-8355-e58c6621e9c1 none luks,keyscript=/root/getkey.sh
 ...
* Make a backup of the old ''initrd'' to be able to boot using the password as well:
 cp /boot/initrd.img-3.2.0-4-amd64 /boot/initrd.img-3.2.0-4-amd64-password
* Update the ''initrd'' to use the key-script:
 update-initramfs -u
* Update the grub bootloader to add the initrd backup to the bootmenu:
 update-grub
* Reeboot and see if it works... ;-)

'''Note:'''
* More details can be found at [http://www.andreas-janssen.de/cryptodisk.html http://www.andreas-janssen.de/cryptodisk.html]