OpenSuse's got a neat patch for grub that copies the password you enter at boot into the initrd. This way you don't need to store a key in your initrd and you d

OpenSuse's got a neat patch for grub that copies the password you enter at boot into the initrd. This way you don't need to store a key in your initrd and you don't need to worry about securing those initrd against theft. https://build.opensuse.org/package/view_file/openSUSE:Factory/grub2/0009-Add-crypttab_entry-to-obviate-the-need-to-input-pass.patch https://build.opensuse.org/package/view_file/openSUSE:Factor... Side note, you can use this same technique to add the LUKS password to the initrd just before doing kexec. This lets you reboot a remote system protected this way without having to pull up a VNC to enter the password. My script for doing kexec with a preloaded LUKS password is here: https://gist.github.com/webstrand/381307348e24c28d5c4c9a5981871bd7 https://gist.github.com/webstrand/381307348e24c28d5c4c9a5981...