Your message dated Tue, 16 Jun 2026 16:07:46 +0200
with message-id <[email protected]>
and subject line Re: Bug#1140141: cryptsetup: Failure to boot fresh install via 
cryptroot-unlock with an encrypted home partition
has caused the Debian Bug report #1140141,
regarding cryptsetup: Failure to boot fresh install via cryptroot-unlock with 
an encrypted home partition
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)


-- 
1140141: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1140141
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: cryptsetup
Version: 2:2.7.5-2
Severity: normal
X-Debbugs-Cc: [email protected]

Dear Maintainer,

I created a fresh install of Debian Trixie with the installation media. During 
the installation, I created a separate partition for /home in a LUKS encrypted 
device.
Upon booting for the first time, I could unlock these devices and boot normally 
by interacting directly with the physical computer, but when attempting to log 
in remotely via dropbear and unlock with cryptroot-unlock, I was unable to do 
so successfully (I was not prompted to unlock the /home device).

I tested with only an encrypted /root separate from /boot. Using the same 
procedure, I was able to successfully boot using dropbear and cryptroot-unlock 
in this case.

It appears that cryptroot-unlock does not properly prompt for all required boot 
devices even when booting can take place correctly via the normal terminal when 
interacting directly with the physical computer.

I would expect an encrypted partition set up directly with the Debian installer 
to boot properly with cryptroot-unlock with separate partitions for /home or 
other top‐level paths it suggests (/var, etc.).



-- Package-specific info:
-- /proc/cmdline
BOOT_IMAGE=/vmlinuz-6.12.90+deb13.1-amd64 
root=UUID=63f95d40-e535-493b-8f10-6630a5c3b4bd ro rootflags=subvol=@rootfs 
kvm.enable_virt_at_load=0 quiet splash

-- /etc/crypttab
swap_crypt UUID=645e05aa-67ca-4baa-a0e8-5bf8d6435d05 ClaveRepetida 
luks,swap,discard,x-initrd.attach,keyscript=decrypt_keyctl
root_crypt UUID=c0a75ea3-e9cf-48e5-b850-8ae38d4bb13a ClaveRepetida 
luks,discard,x-initrd.attach,keyscript=decrypt_keyctl
B UUID=983219b0-36df-4068-b43d-ab4f7d9c2538 /root/Claves/luks luks,discard

-- /etc/fstab
# /etc/fstab: static file system information.
#
# Use 'blkid' to print the universally unique identifier for a
# device; this may be used with UUID= as a more robust way to name devices
# that works even if disks are added and removed. See fstab(5).
#
# systemd generates mount units based on this file, see systemd.mount(5).
# Please run 'systemctl daemon-reload' after making changes here.
#
# <file system> <mount point>   <type>  <options>       <dump>  <pass>
/dev/mapper/root_crypt /               btrfs   defaults,subvol=@rootfs 0       0
# /boot was on /dev/nvme0n1p2 during installation
UUID=89326fe2-2416-4241-a453-0397a5869c12 /boot           ext4    defaults      
  0       2
# /boot/efi was on /dev/nvme0n1p1 during installation
UUID=1429-00A2  /boot/efi       vfat    umask=0077      0       1
/dev/mapper/swap_crypt none            swap    sw              0       0

# Adimen /home/alejandro/Adimen
[email protected]:/a/Archivos/Alejandro        /home/alejandro/Adimen  
fuse.sshfs      
x-systemd.automount,_netdev,identityfile='/home/alejandro/.ssh/alejandro.ssh',allow_other,follow_symlinks,default_permissions,umask=000,uid=1000,gid=1000,reconnect,ServerAliveInterval=10,ServerAliveCountMax=3
        0       0

# Adimen /home/alejandro/Alejandro
[email protected]:/a/Ficheros/Alejandro        
/home/alejandro/Alejandro       fuse.sshfs      
x-systemd.automount,_netdev,identityfile='/home/alejandro/.ssh/alejandro.ssh',allow_other,follow_symlinks,default_permissions,umask=000,uid=1000,gid=1000,reconnect,ServerAliveInterval=10,ServerAliveCountMax=3
        0       0

# Archivo veloz /mnt/b
UUID="98b4f38d-a8e9-4200-9e2e-319c358dc1cb"     /mnt/b  ext4    defaults        
0       2

-- lsmod
Module                  Size  Used by
xt_addrtype            12288  1
xt_nat                 12288  0
wireguard             118784  0
libchacha20poly1305    16384  1 wireguard
chacha_x86_64          28672  1 libchacha20poly1305
poly1305_x86_64        28672  1 libchacha20poly1305
curve25519_x86_64      36864  1 wireguard
libcurve25519_generic    45056  2 curve25519_x86_64,wireguard
libchacha              12288  1 chacha_x86_64
ip6_udp_tunnel         16384  1 wireguard
udp_tunnel             32768  1 wireguard
sg                     45056  0
uas                    32768  0
usb_storage            94208  1 uas
serpent_avx2           45056  2
serpent_avx_x86_64     49152  1 serpent_avx2
serpent_sse2_x86_64    49152  0
serpent_generic        24576  4 
serpent_avx2,serpent_sse2_x86_64,serpent_avx_x86_64
twofish_generic        16384  0
twofish_avx_x86_64     49152  2
twofish_x86_64_3way    32768  1 twofish_avx_x86_64
twofish_x86_64         16384  3 twofish_x86_64_3way,twofish_avx_x86_64
twofish_common         20480  4 
twofish_x86_64,twofish_generic,twofish_x86_64_3way,twofish_avx_x86_64
xts                    12288  2
sd_mod                 81920  0
scsi_mod              327680  4 sd_mod,usb_storage,uas,sg
scsi_common            16384  5 scsi_mod,sd_mod,usb_storage,uas,sg
snd_seq_dummy          12288  0
snd_hrtimer            12288  1
snd_seq               110592  7 snd_seq_dummy
snd_seq_device         16384  1 snd_seq
ccm                    20480  9
ip6t_REJECT            12288  6
ipt_REJECT             12288  6
xt_multiport           16384  4
xt_cgroup              12288  11
xt_mark                12288  6
xt_owner               12288  8
xt_tcpudp              16384  0
nft_compat             20480  42
qrtr                   57344  2
rfcomm                102400  8
cmac                   12288  3
algif_hash             12288  1
algif_skcipher         12288  1
af_alg                 36864  6 algif_hash,algif_skcipher
bnep                   36864  2
binfmt_misc            28672  1
snd_ctl_led            24576  0
nls_ascii              12288  1
nls_cp437              16384  1
vfat                   24576  1
fat                   102400  1 vfat
ext4                 1146880  3
mbcache                16384  1 ext4
squashfs               86016  14
jbd2                  200704  1 ext4
loop                   45056  30
intel_rapl_msr         20480  0
amd_atl                57344  1
intel_rapl_common      53248  1 intel_rapl_msr
snd_acp_legacy_mach    28672  4
snd_acp_mach           40960  1 snd_acp_legacy_mach
snd_soc_nau8821        65536  1 snd_acp_mach
snd_acp3x_rn           12288  0
snd_acp70              12288  1
snd_acp_i2s            16384  1 snd_acp70
snd_acp_pdm            12288  1 snd_acp70
snd_acp_pcm            12288  1 snd_acp70
snd_soc_dmic           12288  1
snd_sof_amd_rembrandt    16384  0
snd_sof_amd_acp        61440  1 snd_sof_amd_rembrandt
mt7925e                24576  0
snd_sof_pci            24576  1 snd_sof_amd_rembrandt
edac_mce_amd           28672  0
snd_sof_xtensa_dsp     16384  1 snd_sof_amd_acp
mt7925_common         135168  1 mt7925e
snd_hda_codec_realtek   225280  1
kvm_amd               221184  0
mt792x_lib             69632  2 mt7925e,mt7925_common
uvcvideo              155648  1
btusb                  81920  0
snd_sof               393216  2 snd_sof_amd_acp,snd_sof_pci
btrtl                  32768  1 btusb
videobuf2_vmalloc      20480  1 uvcvideo
snd_hda_codec_generic   114688  1 snd_hda_codec_realtek
uvc                    12288  1 uvcvideo
snd_sof_utils          16384  1 snd_sof
mt76_connac_lib        98304  3 mt792x_lib,mt7925e,mt7925_common
snd_hda_scodec_component    20480  1 snd_hda_codec_realtek
snd_soc_core          421888  7 
snd_soc_nau8821,snd_acp_mach,snd_acp3x_rn,snd_sof,snd_acp_legacy_mach,snd_acp_pcm,snd_soc_dmic
btintel                69632  1 btusb
videobuf2_memops       16384  1 videobuf2_vmalloc
snd_hda_codec_hdmi     98304  1
kvm                  1396736  1 kvm_amd
snd_hda_intel          61440  11
videobuf2_v4l2         36864  1 uvcvideo
btbcm                  24576  1 btusb
snd_compress           28672  1 snd_soc_core
mt76                  139264  4 mt792x_lib,mt7925e,mt76_connac_lib,mt7925_common
snd_intel_dspcfg       40960  2 snd_hda_intel,snd_sof
videodev              368640  2 videobuf2_v4l2,uvcvideo
snd_pcm_dmaengine      16384  1 snd_soc_core
hid_sensor_als         16384  0
snd_pci_ps             20480  0
btmtk                  32768  1 btusb
hid_sensor_trigger     20480  1 hid_sensor_als
snd_intel_sdw_acpi     16384  1 snd_intel_dspcfg
snd_rpl_pci_acp6x      16384  0
snd_hda_codec         217088  4 
snd_hda_codec_generic,snd_hda_codec_hdmi,snd_hda_intel,snd_hda_codec_realtek
hid_sensor_iio_common    20480  2 hid_sensor_trigger,hid_sensor_als
mac80211             1454080  4 mt792x_lib,mt76,mt76_connac_lib,mt7925_common
irqbypass              12288  1 kvm
videobuf2_common       81920  4 
videobuf2_vmalloc,videobuf2_v4l2,uvcvideo,videobuf2_memops
snd_acp_pci            12288  0
snd_acp_legacy_common    16384  2 snd_acp70,snd_acp_pci
industrialio_triggered_buffer    12288  1 hid_sensor_trigger
snd_hda_core          143360  5 
snd_hda_codec_generic,snd_hda_codec_hdmi,snd_hda_intel,snd_hda_codec,snd_hda_codec_realtek
bluetooth            1085440  34 btrtl,btmtk,btintel,btbcm,bnep,btusb,rfcomm
mc                     94208  5 
videodev,videobuf2_v4l2,uvcvideo,videobuf2_common
leds_cros_ec           12288  0
snd_pci_acp6x          16384  0
led_class_multicolor    16384  1 leds_cros_ec
kfifo_buf              12288  1 industrialio_triggered_buffer
snd_hwdep              20480  1 snd_hda_codec
ecdh_generic           16384  2 bluetooth
snd_pci_acp5x          16384  0
rapl                   20480  0
industrialio          139264  4 
industrialio_triggered_buffer,hid_sensor_trigger,kfifo_buf,hid_sensor_als
snd_pcm               188416  17 
snd_sof_amd_acp,snd_soc_nau8821,snd_hda_codec_hdmi,snd_pci_acp6x,snd_acp_mach,snd_hda_intel,snd_hda_codec,snd_sof,snd_compress,snd_acp_legacy_mach,snd_soc_core,snd_acp_pcm,snd_sof_utils,snd_hda_core,snd_pci_ps,snd_pcm_dmaengine
libarc4                12288  1 mac80211
amd_pmf                73728  0
cros_ec_hwmon          12288  0
snd_rn_pci_acp3x       20480  0
wmi_bmof               12288  0
pcspkr                 12288  0
amdtee                 28672  0
snd_timer              53248  3 snd_seq,snd_hrtimer,snd_pcm
cfg80211             1404928  4 mt76,mac80211,mt76_connac_lib,mt7925_common
spd5118                12288  0
snd_acp_config         20480  6 
snd_rn_pci_acp3x,snd_pci_acp6x,snd_pci_acp5x,snd_sof_amd_rembrandt,snd_acp_pci,snd_pci_ps
snd                   151552  47 
snd_ctl_led,snd_hda_codec_generic,snd_seq,snd_seq_device,snd_hda_codec_hdmi,snd_hwdep,snd_acp_mach,snd_hda_intel,snd_hda_codec,snd_hda_codec_realtek,snd_sof,snd_timer,snd_compress,snd_acp_legacy_mach,snd_soc_core,snd_pcm
k10temp                12288  0
snd_soc_acpi           16384  3 snd_sof_amd_acp,snd_acp_config,snd_acp_pcm
ccp                   163840  2 kvm_amd,amdtee
soundcore              16384  2 snd_ctl_led,snd
snd_pci_acp3x          16384  0
rfkill                 40960  7 bluetooth,cfg80211
amd_sfh                53248  1 amd_pmf
ac                     16384  0
tee                    49152  2 amd_pmf,amdtee
platform_profile       12288  1 amd_pmf
amd_pmc                53248  0
joydev                 24576  0
evdev                  28672  13
nft_reject_inet        12288  0
nf_reject_ipv4         16384  2 nft_reject_inet,ipt_REJECT
nf_reject_ipv6         24576  2 nft_reject_inet,ip6t_REJECT
nft_reject             12288  1 nft_reject_inet
nft_chain_nat          12288  6
nf_nat                 65536  2 xt_nat,nft_chain_nat
nf_conntrack          204800  2 nf_nat,xt_nat
nf_defrag_ipv6         24576  1 nf_conntrack
nf_defrag_ipv4         12288  1 nf_conntrack
msr                    12288  0
nf_tables             380928  488 
nft_compat,nft_reject_inet,nft_chain_nat,nft_reject
parport_pc             40960  0
ppdev                  24576  0
lp                     20480  0
configfs               69632  1
parport                81920  3 parport_pc,lp,ppdev
efi_pstore             12288  0
nfnetlink              20480  3 nft_compat,nf_tables
efivarfs               28672  1
ip_tables              28672  0
x_tables               53248  11 
xt_cgroup,nft_compat,xt_multiport,xt_tcpudp,xt_addrtype,xt_nat,xt_owner,ipt_REJECT,ip_tables,ip6t_REJECT,xt_mark
autofs4                57344  4
btrfs                2166784  1
blake2b_generic        24576  0
xor                    20480  1 btrfs
raid6_pq              122880  1 btrfs
libcrc32c              12288  4 nf_conntrack,nf_nat,btrfs,nf_tables
crc32c_generic         12288  0
dm_crypt               65536  6
dm_mod                221184  13 dm_crypt
amdgpu              14479360  407
amdxcp                 12288  1 amdgpu
drm_exec               12288  1 amdgpu
gpu_sched              65536  1 amdgpu
drm_buddy              28672  1 amdgpu
i2c_algo_bit           16384  1 amdgpu
drm_suballoc_helper    12288  1 amdgpu
drm_display_helper    274432  1 amdgpu
crct10dif_pclmul       12288  1
crc32_pclmul           12288  0
crc32c_intel           16384  7
hid_sensor_hub         28672  3 
hid_sensor_trigger,hid_sensor_iio_common,hid_sensor_als
hid_multitouch         36864  0
ghash_clmulni_intel    16384  0
hid_generic            12288  0
cec                    69632  1 drm_display_helper
rc_core                73728  1 cec
sha512_ssse3           53248  1
i2c_hid_acpi           12288  0
drm_ttm_helper         16384  2 amdgpu
sha256_ssse3           32768  0
i2c_hid                45056  1 i2c_hid_acpi
ttm                   106496  2 amdgpu,drm_ttm_helper
xhci_pci               24576  0
sha1_ssse3             32768  0
sp5100_tco             20480  0
cros_ec_debugfs        16384  0
cros_ec_sysfs          12288  0
cros_charge_control    16384  0
watchdog               49152  1 sp5100_tco
xhci_hcd              364544  1 xhci_pci
hid                   262144  5 
i2c_hid,hid_multitouch,hid_sensor_hub,hid_generic,amd_sfh
cros_kbd_led_backlight    12288  0
ucsi_acpi              12288  0
cros_ec_chardev        12288  0
drm_kms_helper        253952  3 drm_display_helper,amdgpu,drm_ttm_helper
aesni_intel           122880  18
nvme                   57344  5
typec_ucsi             69632  1 ucsi_acpi
gf128mul               16384  1 aesni_intel
cros_ec_dev            12288  0
crypto_simd            16384  5 
serpent_avx2,serpent_sse2_x86_64,aesni_intel,serpent_avx_x86_64,twofish_avx_x86_64
usbcore               409600  7 
xhci_hcd,btmtk,usb_storage,uvcvideo,btusb,xhci_pci,uas
i2c_piix4              28672  0
nvme_core             225280  6 nvme
typec                 114688  1 typec_ucsi
thunderbolt           540672  0
video                  81920  1 amdgpu
cryptd                 28672  9 crypto_simd,ghash_clmulni_intel
serio_raw              16384  0
drm                   774144  45 
gpu_sched,i2c_hid,drm_kms_helper,drm_exec,drm_suballoc_helper,drm_display_helper,drm_buddy,amdgpu,drm_ttm_helper,ttm,amdxcp
roles                  16384  1 typec_ucsi
i2c_smbus              16384  1 i2c_piix4
crc16                  12288  3 bluetooth,amdgpu,ext4
nvme_auth              24576  1 nvme_core
cros_ec_lpcs           20480  0
button                 24576  1 amd_pmf
battery                28672  1 cros_charge_control
fan                    24576  0
usb_common             16384  4 xhci_hcd,usbcore,uvcvideo,typec_ucsi
wmi                    28672  2 video,wmi_bmof
cros_ec                20480  1 cros_ec_lpcs


-- System Information:
Debian Release: 13.5
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 6.12.90+deb13.1-amd64 (SMP w/12 CPU threads; PREEMPT)
Kernel taint flags: TAINT_WARN
Locale: LANG=es_ES.UTF-8, LC_CTYPE=es_ES.UTF-8 (charmap=UTF-8), 
LANGUAGE=es_ES:es
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages cryptsetup depends on:
ii  cryptsetup-bin         2:2.7.5-2
ii  debconf [debconf-2.0]  1.5.91
ii  dmsetup                2:1.02.205-2
ii  libc6                  2.41-12+deb13u3

cryptsetup recommends no packages.

Versions of packages cryptsetup suggests:
ii  cryptsetup-initramfs    2:2.7.5-2
ii  dosfstools              4.2-1.2
ii  keyutils                1.6.3-6
ii  liblocale-gettext-perl  1.07-7+b1

-- debconf information:
  cryptsetup/prerm_active_mappings: true

--- End Message ---
--- Begin Message ---
Hi,

On Tue, 16 Jun 2026 at 08:02:47 -0500, Alex wrote:
> I created a fresh install of Debian Trixie with the installation media. 
> During the installation, I created a separate partition for /home in a LUKS 
> encrypted device.
> Upon booting for the first time, I could unlock these devices and boot 
> normally by interacting directly with the physical computer, but when 
> attempting to log in remotely via dropbear and unlock with cryptroot-unlock, 
> I was unable to do so successfully (I was not prompted to unlock the /home 
> device).
>
> I tested with only an encrypted /root separate from /boot. Using the same 
> procedure, I was able to successfully boot using dropbear and 
> cryptroot-unlock in this case.
>
> It appears that cryptroot-unlock does not properly prompt for all required 
> boot devices even when booting can take place correctly via the normal 
> terminal when interacting directly with the physical computer.

cryptroot-unlock processes only devices that are configured for
unlocking at initramfs stage there.  Either because they are required
(the device is holding the root file system, /usr, or the resume
device), or because they have been manually configured with the
`initramfs` crypttab(5) option.

It appears your device is not configured to be unlocked at initramfs
stage.  When at the computer (not remotely), the unlocking happens by
systemd later in the boot process.  Use the `initramfs` crypttab(5)
option and rebuild the initramfs if you want to unlock it at initramfs
stage instead.

-- 
Guilhem.

Attachment: signature.asc
Description: PGP signature


--- End Message ---

Reply via email to