Re: Unlock a Veracrypt/Truecrypt partition which uses a keyfile with a passphrase from /etc/crypttab

[Milan Broz <gmazyland@gmail.com>]

On 8/22/23 11:31, Kent Larsson wrote:
> Hi! I have a Veracrypt (/Truecrypt) volume, which I can successfully
> unlock manually by providing a key file and passphrase:
> 
>      # cryptsetup --type tcrypt --key-file /.keyfile open /dev/nvme0n1p5 shared
>      Enter passphrase for /dev/nvme0n1p5:
> 
> Only root has `rw` on the key file, a binary file of 64 bytes.
> 
>      # ls -l /.keyfile
>      -rw------- 1 root root 64 aug 21 08:09 /.keyfile
>      # file /.keyfile
>      /.keyfile: data
>      # du -b /.keyfile
>      64 /.keyfile
> 
> Is there a way to unlock a Veracrypt (/Truecrypt, `/dev/nvme0n1p5` in
> my case) partition that uses a key file with a password in
> `/etc/crypttab`?

Crypttab should support keyfile as standard option (3rd option), see
https://www.freedesktop.org/software/systemd/man/crypttab.html

There was even dependency mechanism in systemd that mounts the device
with keyfile if not yet mounted.

(Crypttab is processed by systemd not cryptsetup itself. Ignoring
the old crypttab processing - but even there keyfile option was present.)

Milan

> 
> I have tried constructing a file with the structure
> `{passphrase}{newline}{key file contents}` and manually using it to
> unlock as above, but I still got the passphrase question. To create
> that file, I did the following:
> 
>      # echo 'mypassword' > /.keyfile_psw
>      # cat /.keyfile >> /.keyfile_psw
>