why

while (re)-setting up my media machine, i’ve decided to enable “full disk encryption” from the get-go. this means that when the machine starts up, i shall need to input a passphrase to decrypt the disk. this is not physically feasible, for one, i do not plan to have a keyboard on this machine.

macOS does this neat thing where you can ssh into a machine similarly, that has FDE and still work. the “ux” of macOS looks like the below.

This system is locked. To unlock it, use a local
account name and password. Once successfully
unlocked, you will be able to connect normally.
(alice@192.168.xx.yy) Password:

System successfully unlocked.
You may now use SSH to authenticate normally.

Connection closed by 192.168.xx.yy port 22

i was certain linux could do this. this is me figuring out how.

options

there seem to primarily be two options to do this

• dracut-crypt-ssh - based on dropbear SSH
• dracut-sshd - based on OpenSSH

after spending a good minute (or thirty) trying to decipher the dependencies¹ for getting the OpenSSH system working with a base fedora installation, i decided to look the other way towards dracut-crypt-ssh.

setup

sudo dnf copr enable uriesk/dracut-crypt-ssh
sudo dnf install dracut-crypt-ssh

since fedora seems to default to grub, that seems to be the preferred mode to setup “networking”.

grub

note: eth0 is an example interface here. find the ethernet interface from ip a or so.

# /etc/default/grub
GRUB_CMDLINE_LINUX="... rd.neednet=1 ip=eth0:dhcp"

for static assignments, you can use the full format. <server-id> is blank.

ip=<client-IP-number>:[<server-id>]:<gateway-IP-number>:<netmask>:<client-hostname>:<interface>:{dhcp|dhcp6|auto6|on|any|none|off}

so in my instance,

ip=192.168.yy.zz::192.168.aa.bb:255.255.252.0:my-hostname:eth0:off

dropbear

dropbear reads the keys from /root/.ssh/authorized_keys by default.

but FDE? the disk isn’t accessible at boot?

you’d be right. dropbear updates the initramfs with a copy of the keys from the above default location. if it gets updated, you’ll need to re-run the next steps.

generate initramfs

dracut --force --verbose

networking

this is from [gerov.eu], figuring out that the pre-boot assignments were “breaking” networking.

cat <<EOF >> /etc/systemd/system/flush-dracut-network\@.service
[Unit]
Description=Remove dracut's network configuration for %I
Before=network-pre.target
Wants=network-pre.target

[Service]
ExecStartPre=/usr/sbin/ip address show %i
ExecStart=/usr/sbin/ip -statistics address flush dev %i

[Install]
WantedBy=default.target
EOF

systemctl enable flush-dracut-network@eth0

usage.

use the systemd-tty-ask-password-agent command.

> ssh -p 222 root@192.168.yy.zz
-sh-5.3# systemd-tty-ask-password-agent
🔐 Please enter passphrase for disk {Model} (luks-e0261506-c242-4836-b636-acf97a48f7e8): 
-sh-5.3# Connection to 192.168.yy.zz closed by remote host.
Connection to 192.168.yy.zz closed.

i put the wrong password; what now?

honestly, idk. so far i’ve just been using reboot.

references

• https://gerov.eu/posts/unlock-luks-encrypted-fs-remotetly-via-ssh/
• https://web.archive.org/web/20250723090754/https://uwot.eu/remotely-unclock-a-full-disk-encrypted-fedora-40-server/