Unlock LUKS via SSH#

1.Auto script#

curl -OL hacker.st/ssh-luks.tar.gz

2.Or clone the repository#

git clone https://github.com/uvns/archlinux-initrd-ssh-cryptsetup.git
cd archlinux-initrd-ssh-cryptsetup

I3.nstal ssh-cryptsetup#

makepkg -sri

4.Generate dropbear key#

dropbearkey -t ecdsa -f /etc/dropbear/dropbear_ecdsa_host_key

5.Add public key to initrd.authorized_keys#

vi /etc/dropbear/initrd.authorized_keys

6.Add network devices and hooks to /etc/mkinitcpio.conf#

vi /etc/mkinitcpio.conf

MODULES=(e1000 e1000e virtio_net vmxnet3)

HOOKS=(base udev autodetect microcode modconf kms keyboard keymap consolefont block ssh-cryptsetup sd-encrypt lvm2 filesystems fsck)

7.Setup network and disable systemd to unlock LUKS#

vi /etc/default/grub

GRUB_CMDLINE_LINUX="ip=:::::eth0:dhcp rd.luks=0"

8.Edit /etc/crypttab#

vi /etc/crypttab

9.Crypttab file#

cryptroot      UUID=xxxxxxxxxxxxxxxxxxxxxx    none                    luks

10.Finalize#

mkinitcpio -p linux-lts
grub-mkconfig -o /boot/grub/grub.cfg