LUKS encryption, header on a dongle USBdrive?

Solution 1:

I am writing now from the machine that works exactly that way.

1. First, you will need to put whole /boot folder on the dongle.
2. Encrypt the disk with key file and put the keyfile into the boot dongle too.

3. Edit /etc/crypttab, add this line

   sda2_crypt UUID=14-88 /dev/disk/by-uuid/88-14:/rootfs.key     luks,keyscript=/lib/cryptsetup/scripts/passdev
   

where sda2_crypt is arbitrary name, first UUID is of encrypted root partition, second - of dongle partition and rootfs.key is the keyfile name.

4. Then Update your /etc/fstab accordingly.
5. Mount dongle as /boot and do update-initramfs

This should be enough. Different instructions suggest you to add kernel boot arguments, but in my case it worked without.If you ever want to use password instead of keyfile, just edit /etc/crypttab and do update-initramfs.