If you’re running encrypted drives (LUKS) on your home lab or remote servers, you know the pain: every time the system reboots, you’re stuck. You either have to plug in a monitor and keyboard or set up some complex KVM-over-IP just to type in a decryption password.
I got tired of that, so I set up a way to SSH into the server at the decryption screen. Basically, we’re putting a tiny SSH server (Dropbear) into the initramfs (the early boot environment).
Honestly, this setup has been a total lifesaver. I no longer have to physically stand in front of my servers just to unlock the drives after a reboot. It’s made troubleshooting and general management so much easier now that I can handle everything remotely instead of trekking over to the hardware.
Here is exactly how I did it.
The Setup
1. Install the necessary tools
First, you’ll need dropbear-initramfs (the SSH server that runs before your main OS) and busybox.
sudo apt update
sudo apt install -y dropbear-initramfs busybox
2. Add your SSH Public Key
Since this happens before your actual user accounts are loaded, you can’t use passwords. You have to use an SSH key.
sudo mkdir -p /etc/dropbear/initramfs
sudo nano /etc/dropbear/initramfs/authorized_keys
Paste your local machine’s public key (id_rsa.pub) into that file, save it, and set the permissions:
sudo chmod 600 /etc/dropbear/initramfs/authorized_keys
3. Configure your network settings (Optional)
The server needs to know how to get online before the main OS boots. You’ll need to edit the IP config file:
sudo nano /etc/initramfs-tools/conf.d/ip
If you want to use DHCP, just add:IP=dhcp
If you prefer a Static IP, use this format:IP=192.168.1.100::192.168.1.1:255.255.255.0:servername:eth0:off
4. Optional: Change the SSH Port
By default, it uses port 22. If you want to change that (to avoid conflicts or for a bit of obscurity), edit the Dropbear config:
sudo nano /etc/dropbear/initramfs/dropbear.conf
I set mine to port 2222. Make sure NO_START=0 and update the options line like this:
DROPBEAR_OPTIONS="-I 180 -j -k -p 2222 -s -c cryptroot-unlock"
5. Apply changes and reboot
Finally, you have to update the initramfs image so these changes are actually baked into the boot process.
sudo update-initramfs -u
sudo reboot
How to use it
Once the server reboots and hits the decryption screen, you can SSH in from your main machine:
ssh -p 2222 root@your-server-ip
From there, you can run the unlock command and let the server finish booting. It’s a simple fix that saves a ton of time!