# Extroot encryption

**URL:** <https://forum.openwrt.org/t/extroot-encryption/133230>\
**Category:** Installing and Using OpenWrt\
**Created:** [July 28, 2022, 1:20pm UTC](https://forum.openwrt.org/t/extroot-encryption/133230 "2022-07-28T13:20:44Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![crass](https://forum.openwrt.org/letter_avatar/crass/32/5_5575768a8748004e209b776fc1b2916d.png) [@crass](https://forum.openwrt.org/u/crass)\
**Post date:** [November 6, 2022, 9:08pm UTC](https://forum.openwrt.org/t/extroot-encryption/133230/6 "2022-11-06T21:08:01Z")

</div>

TLDR; Here's a [wiki section](https://openwrt.org/docs/guide-user/additional-software/extroot_configuration#luks_encrypted_extroot) I created that may be a little clearer and explicit.

Have you tried adding `export PREINIT=1; mount_root` to `/etc/rc.local` as suggested in the [troubleshooting section](https://openwrt.org/docs/guide-user/additional-software/extroot_configuration#troubleshooting)? I haven't confirmed, but I believe this could be the missing piece.

As mentioned without creating a special build, it looks like you can get extroot to work on an encypted device **in preinit**. However, once you've got everything up an running you should be able to setup the crypt device and switch root. I've done some testing to convince myself this works.

It should go without saying that you'll need to have all binaries required to bring up the crypt device installed into your `rootfs_data`. Here's some steps that I roughly did:

1. Make sure all needed packages are installed (eg. cryptsetup, which should pull in all the required kmods)
2. Create LUKS container with one of the supported extroot filesystems (eg. ext4)
3. Configure `/etc/config/fstab` as in the wiki using the UUID
  - The extroot will fail to mount in the preinit phase of the boot, that's expected

4. Edit `/etc/rc.local` to unlock the LUKS container and then do `PREINIT=1 mount_root`
  - If you require user input for the password (eg. not using a key file on the device), cryptsetup will fail as stdin is not setup. I'm sure there's a way to set it up, but I haven't loked into it yet.

5. Reboot
  - You should not have the upper dir of the `/` overlay be in the LUKS container.

6. [OPTIONAL require user input for password] run `ash /etc/rc.local` from shell.
  - Since stdin is not setup for cryptsetup when `rc.local` is normally run, you'll need to manually run `rc.local` from a shell (which has stdin setup correctly).

---

_[View the full topic](https://forum.openwrt.org/t/extroot-encryption/133230)._