Public bug reported:
Ubuntu Server 26.04 LTS now uses Dracut as the default initramfs
generator.
There currently does not appear to be an Ubuntu-supported way to access
a Dracut initramfs through SSH in order to manually unlock a LUKS-
encrypted root filesystem.
My use case is a VPS with a LUKS2-encrypted root filesystem. When the
system boots, the LUKS passphrase has to be entered through the VPS
provider's console/KVM.
For long, randomly generated LUKS passphrases, this is particularly
inconvenient because the provider's KVM does not allow convenient
copy/paste.
I would like to be able to do the following:
```
VPS boots
↓
GRUB
↓
Linux kernel + Dracut initramfs
↓
Network is initialized
↓
SSH server becomes available in the initramfs
↓
I connect remotely using SSH
↓
I manually enter the LUKS2 passphrase
↓
The encrypted root filesystem is unlocked
↓
Ubuntu Server continues booting normally
```
The existing Ubuntu `dropbear-initramfs` package does not appear to
solve this problem because it is integrated with `initramfs-tools`,
whereas Ubuntu Server 26.04 uses Dracut by default.
There also appears to be no Ubuntu package providing `dracut-sshd` or an
equivalent SSH server integration for Dracut.
I am not looking for automatic disk unlocking with Clevis/Tang. The
intended workflow is deliberately manual: SSH authentication provides
access to the initramfs, and I manually enter the LUKS passphrase.
The requested functionality could potentially be implemented by
packaging/integrating `dracut-dropbear`, `dracut-sshd`, or another
suitable SSH server solution for Dracut.
Could Ubuntu provide an officially supported way to access the Dracut
initramfs over SSH for remote/manual LUKS unlocking?
This would be particularly useful for encrypted Ubuntu Server
installations on remote physical servers and VPS instances where
entering a long LUKS passphrase through a provider console is
impractical.
** Affects: dracut (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2163307
Title:
Provide SSH access in the Dracut initramfs for remote LUKS unlocking
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/dracut/+bug/2163307/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
