Detached LUKS USB Key Update?
While I'm trying to get Encrypted /boot and a detached LUKS header on USB to work,
I had a couple of questions come to mind:
1. Does the backup USB key need to be updated?
2. If so, then how would someone keep all backups up to date?
I probably asked a dumb question but if anyone can help guide me through the steps I'd really appreciate you!🤗🌻
What do you mean need to be updated? You store the LUKS header in an IMG file on the USB drive. I ran this setup for many years. It is kind of difficult to mess up, but you should keep at least one offline backup. Last thing you want is to lose your ability to decrypt your data.
oh actually thinking about it again, the only thing that's stored on the USB is the keyfile right?
Sorry I'm still a bit confused after trying to follow alongside the arch guide
Well technically it is the header but yeah that is what is stored there. There are times you might want to change the encryption and what not so I guess the header could get changed or you could add a key, but regardless you'll know what needs to happen cause it ain't going to happen otherwise. I only had two issues during my time of a detached header.
One was that something changed with mkinitcpio. Can't remember if it was my fault partially too or not, but basically had to add back exfat support to the initramfs since that is what I had formatted the USB drive as to access my key file. The second time was an update with systemd that caused a change with how the systemd-boot module loaded the drive.
The important thing is to get familiar with booting into a recovery image (basically the Arch Installer) and using the header flag with cryptsetup and `cryptsetup open --header' I believe followed by your header file and the encrypted drive/partition. After that is is just a matter of mounting the decrypted device mapper partition. You should only need to do this if you have issues but once I figured out how it saved me a lot of anxiety.