LUKS full-disk encryption with remote unlock.

Before you start

• The root filesystem must be encrypted when the system is installed. Use a custom ISO with an encrypted install, or reinstall with the installer's encryption option. The out-of-band console is useful for this.
• Back up anything you need. Installing with encryption wipes the disk.
• Understand the limit: after you unlock, the keys are in memory on a host you do not control. Encryption protects a powered-off disk, not a running one.

Install the tools

apt update
apt install -y cryptsetup-initramfs dropbear-initramfs

Authorise your key

Use a different key and port from your normal SSH login. On older releases the directory is /etc/dropbear-initramfs.

# Debian 12 and later
install -m 600 /dev/null /etc/dropbear/initramfs/authorized_keys
echo "ssh-ed25519 AAAA... you@laptop" >> /etc/dropbear/initramfs/authorized_keys
# restrict and move the port in /etc/dropbear/initramfs/dropbear.conf, for example:
# DROPBEAR_OPTIONS="-I 180 -j -k -p 2222 -s"

Make the initramfs bring up the network

# in /etc/initramfs-tools/initramfs.conf or via the kernel command line
IP=:::::eth0:dhcp
update-initramfs -u

Unlock after a reboot

Enter the passphrase. The server continues booting and your normal SSH becomes available. Check the host key fingerprint the first time so you do not hand your passphrase to an impostor.

ssh -p 2222 root@YOUR-SERVER-IP
cryptroot-unlock

What this protects against

Full-disk encryption protects data at rest: a decommissioned disk, a backup of the volume or a copied image. It does not protect against a host who can read the running server memory, which is why privacy architecture describes the limits.

Troubleshooting

• If the server does not answer after reboot, check the console for the initramfs prompt.
• Confirm the network interface name matches the one in your initramfs config.
• Keep a second authorised key for recovery.

Common questions