I have luks set up on my server and it is kind of annoying to type the password at reboots (mostly power outages). Strictly speaking I do not need the luks, but I feel its good to have anyway. I was thinking of getting a yubikey and just leaving it on or at least telling a trusted family member where to get it and to plug it in when turning it on.
Has anyone over come a similar set up or issue?
For some clarity I am not a pro and the homelabing is mostly just a learning experience for me.
I have not used a yubikey for boot stuff as you describe, I am a fan in general though.
That said, I have a setup on my servers where there is full disk encryption and a password stored on a random file in a thumb drive or SD card of each machine. If the file / drive is removed I can always type a manual password as well to complete booting. And if I need to do a clean wipe I just delete the keys or intentionally corrupt that sector of the drive, instead of having to do forensic cleaning.
I’ve been mulling over this very idea for years, but I just haven’t gotten around to putting it into practice. Could you tell me how it works for you?
I recently finished setting this up on my system after having a plan to do it for years beforehand and never following through. It turned out to be quite a bit easier than I thought; LUKS has built-in support for keyfiles, so all you have to do is add the keyfile as a valid key for your disk, then modify the mount options to use the keyfile by default. There’s a dedicated option to fail over to password-based authentication as well.
have a setup on my servers where there is full disk encryption and a password stored on a random file in a thumb drive or SD card of each machine.
The wagie in me likes this. Was it particularly difficult to set?
Not at all. Pretty sure I got the instructions from Arch wiki, typical passfile setup just a slightly unusual path
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters Git Popular version control system, primarily for code IP Internet Protocol SSH Secure Shell for remote terminal access VPS Virtual Private Server (opposed to shared hosting)
4 acronyms in this thread; the most compressed thread commented on today has 17 acronyms.
[Thread #289 for this comm, first seen 15th May 2026, 00:40] [FAQ] [Full list] [Contact] [Source code]
I made a systems service that mounts a temp file from my ftp server (inside internet router) and that file is being used to unlock disks during boot. When it’s gone it would ask for password.
The vector is that someone steals my server while keeping the router in place. That’s my bet on what would happen if someone breaks into our flat.
The vector is that someone steals my server while keeping the router in place.
What does this part mean?
is internet router some kind of software or you mean your physical router?
They run the FTP server on the router, hosting the password file.
I use it for work stuff so I don’t have to cross contaminate devices or apps
I have a VPS which hosts some stuff and I just e2ee all the data. Syncthing sync is e2ee and Joplin sync is e2ee. But lots of services don’t support e2ee, or e2ee gets in the way of UX and nice features so we make a tradeoff.
As for LUKS, I guess a good solution is to have a VPS or public device somewhere that shares the encryption key with the server (but only after it gives the correct password) but only to the correct IP address of your server.
The router solution someone mentioned below is similar.
I have a yubikey setup to autounlock my laptop luks. It’s a bit of a pain to get setup the first time then it just works. Not sure it’s worth it for a home server unless it has some real valuable data on it. And in that case you wouldn’t want the key stored anywhere near it.
I don’t see the point, because if someone steals your server, they’ve stolen the key too.
Perhaps set up ssh unlock? Plenty of decent guides out there.
I use a yubikey on my laptop, but I use it to make it even harder to log in. It’s set to challenge-response so you have to have the key in and enter a password to unlock LUKS. Bit overkill but it was more just to see if I could do it lol
I dream of being this hardcore
Perhaps set up ssh unlock? Plenty of decent guides out there
Do you do this with separate machine?
Yes, phone, desktop, laptop, whatever’s handy.
