Encrypted install, Password and Boot Screen

I am not being affected by any major issues. Just cosmetic.
Also, looking for some explanation as far as input password for decrypting internal disk.
Tumbleweed latest as of today.
Encrypted disk with Btrfs. When booting (cold boot or restart) the encryption password needs to be typed twice on two boot screen, Again, no technical issue but why is that ? Why do I have two boot screen where I need to input the same password. I am not an IT guy nor am I a Linux Guru/Admin. I am a enthusiast user but many times I can’t seem to understand some bascs :frowning: . I did check the option during set up to have a separate /home partition. Would that be the reason why its asking me for the password twice to decrypt the disk and then the Home partition ?
Finally, first boot screen (my guess is the disk encryption. Not the home partition) has barely any backlight. Enough to see through so I can type the password.
I found this error

**bbswitch: No suitable _DSM call found.**
 


I don’t know if the screen backlight issue is related to this error. Just a guess. Any help is much appreciated.

There are two possible problems that you could be describing. So we need to narrow down which it is.

The second possibility (I’ll mention this first), is that you are being prompted once for the root file system and once for “/home”. This should not happen, unless you made the mistake of using different passwords for each. And even if you made that mistake, there is a work-around.

My guess is that you are seeing the first possibility. In that case, the grub booting software requests the password, so that it can get to the boot menu. So you should be prompted immediately for this one, before you see a boot menu. Then the second prompt comes after the kernel has been loaded and needs to access the disk to continue booting. This happens because there is not any secure way for grub to communicate the password to the kernel.

There is a workaround for this. Check the page
SDB:Encrypted root file system
and scroll down until you find the heading “Avoiding to type the passphrase twice”.

thanks
I am stuck at step 3 (just a user :slight_smile: )
the partition nvme0n1p2 is already encrypted and has a passphrase. Should I continue ? This is not the passphrase of the new key.

sudo cryptsetup luksAddKey /dev/nvme0n1p2 /.root.key
Enter any existing passphrase:

That is asking for the key that you normally type in while booting.

You are adding a new key. But it needs the old key to set that up.

When done, you can boot either with the new key or the old key. But the new key is for machines, not for humans, so there’s no point in trying to remember it.

The basic idea is that you unlock the partition using a key stored in a file (the file “/.root/.key”). Of course, the system cannot read that file, because the disk is encrypted. However a copy of that file will be stored in the “initrd”. That’s also encrypted, but grub reads the “initrd” after you first give a key, and passes that “initrd” to the kernel. That way, you should not be prompted the second time (if you get everything setup properly).

Thank you for the help.
Followed all the steps… Rebooted
Now don’t have to type the password at all apart for the disk decryption.
In fact, I had to type the password 3 times. One for the disk decryption and then twice after. Now, I decrypt the disk and then the user password. No more issue with the DIM backlight since I don’t have to type in the password anymore :wink:
One question though. The forum post you referred too clearly states that the issue of having to type the password twice when encrypting the root partition is more or less normal (I interpret it as normal). I never had this when distro hopping with Ubuntu or Arch. Is it specific to Tumbleweed ? I also had my root partition encrypted then.

A disadvantage of encrypting the root partition is that you’ll have to provide the decryption passphrase twice - once in the bootloader (Grub), and then again when your system actually boots.

I still have the error code below. Any idea what that means ? I am guessing since not being really affected by it, I can ignore the error message ?

bbswitch: No suitable _DSM call found.

Thanks again for the help. Much appreciated

PS: I feel like I have become just like Mr Robot lol!

I am only prompted once for password.

The difference is that I use a separate unencrypted “/boot” partition. That’s also what Ubuntu does.

However, note that I am using “ext4”. Since you are using “btrfs” it is better to not have a separate “/boot”. The idea is that if you ever do a rollback, you want it to also roll back the kernel and boot setup.

As for that “bbswitch” message – if it isn’t causing problems, then best to not worry about it. The “bbswitch” software is for switching graphic adapters with an optimus laptop (or similar). I don’t have that, so I don’t see that message.