Unsolved Decrypting a LUKS encrypted drive at boot

[DustinB3403]

So I have an internal development project I'm working on and I'm trying to sort out specifically how I can decrypt a luks encrypted partition built on a separate mdadm R1 at boot time so that the drive is always available if the system should reboot.

Obviously this isn't an ideal solution since the key would have to be stored in plain-text somewhere outside of the array, but I'm curious if anyone else has had to do something like this and what protections that you may have put into place to protect this information.

Alternatively, the obvious solution would be some intervention to unlock the drive after a reboot, but I was hoping to avoid this manual intervention.

Thanks in advance

[Obsolesce]

@DustinB3403 does it have a TPM2 chip?

[DustinB3403]

@Obsolesce said in Decrypting a LUKS encrypted drive at boot:

@DustinB3403 does it have a TPM2 chip?

This vm doesn't, nor a vtpm

[Obsolesce]

@DustinB3403 Oh is it the boot/os drive of a VM?

[EddieJennings]

I know it's not your ideal, but have you tried to use /etc/crypttab and store the key in a file somewhere that's owned by root and has 400 permissions, just to see if that method can do the automatic unlocking of the encrypted device?

If you're making said file that /etc/crypttab will use remember to do echo -n 'whatever' > yourfile, instead of just echo, else you'll bang your head against the wall not understanding why the stored password isn't working. Ask me how I know.