Unlocking encrypted root with SSH

[emad-elsaid]

I have the following setup :

• 3x8TB HDD disks
• 1 ZFS pool, RAIDZ, encrypted with passphrase
• 2 datasets /ROOT and ROOT/default, ROOT/default has mountpoint /
• the whole system is installed inside ROOT/default even /boot
• Booting uses zfsbootmenu EFI image from a removable USB stick that loads ROOT/default as it's the only choice
• zfsbootmenu asks for the passphrase before showing the menu as expected
• after loading the kernel in ROOT/default the kernel asks for the passphrase again.

I understand that there is a way to remove that second passphrase prompt it was mentioned inside the contrib/remote-ssh-build.sh script:

mkdir -p -m 700 /etc/zfs/keys
cp passwordfile /etc/zfs/keys/rpool.key

zfs change-key \
    -o keylocation=file:///etc/zfs/keys/rpool.key \
    -o keyformat=passphrase rpool
update-initramfs -u
chmod go= /boot

I followed it for my system (Archlinux) as follows

mkdir -p -m 700 /etc/zfs/keys
echo "password" > /etc/zfs/keys/rpool.key
zfs change-key \
    -o keylocation=file:///etc/zfs/keys/rpool.key \
    -o keyformat=passphrase rpool
mkinitcpio -P

• but the system after this change waits for the file for a couple of seconds, it doesn't appear. so it asks for the passphrase as usual.
• So I think I'm doing it wrong I guess.
• The end result I'm going for is to have the system boot unlocked from SSH without the need for a keyboard and a monitor connected to the system. eliminating this passphrase prompt is the last step to reach this milestone. I'm looking for any pointers

[ahesford]

You probably forgot to add /etc/zfs/keys/rpool.key to the FILES array in /etc/mkinitcpio.conf.

[emad-elsaid]

that was it. than you. I'll add a line to the script