Full-disk encryption with remote unlock (LUKS + dropbear)

What it protects — and what it doesn’t

Full-disk encryption keeps data unreadable when the server is powered off or a drive is removed — for example a drive that fails and is replaced. While the system runs, the key is in memory: encryption at rest does not protect a live, unlocked machine.

Install with encryption

The simplest path is a fresh installation from the Debian or Ubuntu ISO through virtual media: create a software RAID 1, then choose encrypted LVM on top of it. Keep /boot on its own unencrypted RAID 1 partition.

Unlock over SSH at boot

$ apt install dropbear-initramfs
$ cat ~/.ssh/id_ed25519.pub >> /etc/dropbear/initramfs/authorized_keys
# /etc/dropbear/initramfs/dropbear.conf
DROPBEAR_OPTIONS="-p 2222 -s -j -k"

Give the initramfs a static address with the ip= kernel parameter in /etc/default/grub (address, empty field, gateway, netmask, hostname, interface, no autoconfiguration):

GRUB_CMDLINE_LINUX="ip=203.0.113.10::203.0.113.1:255.255.255.0::eno1:off"

$ update-grub && update-initramfs -u

Unlocking after a reboot

$ ssh -p 2222 root@203.0.113.10
~ # cryptroot-unlock

Use a different host key or port for dropbear than for your main SSH server, and keep the KVM console as a fallback to type the passphrase if the network is not up.