Reinstall to existing encrypted partitions

Question

My disk layout is like this:

• Encrypted partition for /
• Encrypted partition for /home
• Unencrypted partition for /boot

I set this up last time I did a complete reinstall (incl. wiped disk) of Ubuntu a while ago. Now, after upgrading to latest Ubuntu, some things were broken and I decided to reinstall again from scratch. But, as I have a separate partition for /home and another partition for /, which are both already encrypted, I'd like to reuse these, instead of starting all over. Especially to save the time it takes to back up my /home and restore it again after fresh install.

Before going through the installer, I unlock the 2 encrypted partitions. This allows me to select these for / and /home for the new installation. I do this pre-install unlocking because I am not able to unlock the partitions from the installer UI.

Everything seems to install fine.

But when I reboot into the system, I never get the unlock prompt. The 5 dot boot splash is just there for a while, and then it drops to an (initramfs) prompt.

What do I do to get the unlock prompt at boot? Can I change some settings in a file somewhere in my /boot partition? Do I need to do something different during the install? I don't mind doing another reinstall (as it doesn't take a lot of time, yay!). I just don't want to have to do the backup/restore of /home (as it takes a lot of time, boo!).

Solution

The issue is that /etc/crypttab is not set up properly in the new system. You can fix this by booting into a live environment and then mounting your new system to fix it. The following is an overview of what you need to do, but device names will likely need to be changed for your system.

$ sudo -i
# cryptsetup open /dev/sda5 sda5_crypt # For root partition
# cryptsetup open /dev/sda6 sda6_crypt # For home partition
# lvchange -ay  # activates the logical volumes if you use llvm
# mkdir /mnt/ubuntu
# mount /dev/mapper/sda5_crypt /mnt/ubuntu
# mount /dev/mapper/sda6_crypt /mnt/ubuntu/home
# mount /dev/sda1 /mnt/ubuntu/boot
# mount --bind /dev /mnt/ubuntu/dev
# mount --bind /sys /mnt/ubuntu/sys
# mount -t proc none /mnt/ubuntu/proc

Now that the system is mounted you can add /mnt/ubuntu/etc/crypttab. It should look somewhat like this:

sda5_crypt UUID=12345678-9abc-def012345-6789abcdef01 none luks
sda6_crypt UUID=87654321-cba9-543210fed-01fedcba9876 none luks

You can find the UUID with ls -l /dev/disk/by-uuid. Note that the UUIDs used should be of the encrypted partitions, not the decrypted partitions.

You should also have a look at /mnt/ubuntu/etc/fstab and make sure the decrypted partitions are referenced by the sdaX_crypt names you assign in /mnt/ubuntu/etc/crypttab. If you decrypted the devices in the OS installer before installing, they might be referenced by some other names than what you assign yourself (e.g. luks-<uuid>). If you fail to do this, you might get an error saying cryptsetup: lvm is not available during boot.

Finally you can chroot into the new system to update the initramfs.

# chroot /mnt/ubuntu /bin/bash
# update-initramfs -u

And then you're ready to reboot into your new system.

Comments

[Wrzlprmft]

I fail to make sense why you mount dev, sys, and proc to /boot instead of /. When I changed this, everything worked fine for me. Shoud you agree that this is a mistake, please edit your answer accordingly. (CC @decibyte)