In OpenWRT, I have installed and set up LUKs. I then used LUKS to encrypt the root file system and created a key file to enable root file system decryption. However, the issue is how to set up the grub configuration file located in /boot/grub/grub.cfg such that grub automatically utilises the keyfile to decrypt the root filesystem upon booting into the system.
I tried lots of various blogs and articles. However, there is no viable fix. I've pasted the sources I used below.
sorry for being stupid, but what's the point of an encrypted rootfs when the decrypt key sits on a partition right next to it ?
Yes, you are right. We can use a passphrase too.
My concern is how to configure the grub for all the LUK-related decryption. Because if I can configure it with a keyfile, it can easily be configured with a passphrase. So it's all about the Grub configuration that I need to figure out. Rest we can configure according to the needs.
ok, but what are you protecting ?
the roofs content, or the ability to boot ?
The rootfs files that I have in the root partition.
The boot partition can be left unencrypted.
The main issue is that there are no modules related to grub-mkconfig or grub2-mkconfig that can generate the grub configuration. Maybe we have to directly edit the /boot/grub/grub.cfg or there is another method that I am not aware of.