Dual password unencrypt HD

I believe this is related to choosing systemd-boot for the bootloader. Because systemd-boot stores the initramfs images on the unencrypted EFI partition, a keyfile should not be stored in the initramfs (source). Without a keyfile, the passphrase needs to be entered more than once if you have more than one luks partition.

In this thread, a couple folks successfully switched from systemd-boot to Grub:

I wouldn’t say it was easy–it took 119 posts to figure it out! But it can be done. Hats off to those guys for sticking with it.

After you are switched over to Grub, you can set up a keyfile as described in the ArchWiki here:

https://wiki.archlinux.org/title/dm-crypt/Encrypting_an_entire_system#Avoiding_having_to_enter_the_passphrase_twice

Depending on how deeply configured your system is by now (since you just installed it), if you want to switch over to the Grub bootloader it might be easier to back up whatever you need to back up and just reinstall.

It’s not too bad actually. First, deactivate the swap space:

sudo swapoff /dev/sdxy

sdxy is the swap partition obviously.

Delete the partition with parted (https://www.thegeekdiary.com/how-to-delete-disk-partition-using-parted-command/), or something else.

Set up the swap file somewhere inside the encrypted partition like so:

https://wiki.archlinux.org/title/Swap#Swap_file

Swap file

As an alternative to creating an entire partition, a swap file offers the ability to vary its size on-the-fly, and is more easily removed altogether. This may be especially desirable if disk space is at a premium (e.g. a modestly-sized SSD).

Swap file creation

Note: For Btrfs, follow the procedure described in Btrfs#Swap file instead of the steps below.

Use dd to create a swap file the size of your choosing. For example, creating an 8 GiB swap file:

# dd if=/dev/zero of=/swapfile bs=1M count=8k status=progress

Note: Using dd to allocate a swap file is the most portable solution, see swapon(8) § Files with holes for details.

Set the right permissions (a world-readable swap file is a huge local vulnerability):

# chmod 0600 /swapfile

After creating the correctly sized file, format it to swap:

# mkswap -U clear /swapfile

Activate the swap file:

# swapon /swapfile

Finally, edit the fstab configuration to add an entry for the swap file:

/etc/fstab
/swapfile none swap defaults 0 0

For additional information, see fstab#Usage.

Note: The swap file must be specified by its location on the file system, not by its UUID or LABEL.

4 Likes