First boot "invalid passphrase"

English Install/Boot/Login
1

Hello all,

I’m currently distro hopping and seem to be having quite a bit of trouble with openSUSE. I can’t even boot into the OS once after installation.

System Details:

  • CPU: AMD Ryzen 5 7600X
  • GPU: AMD RX 7800XT
  • RAM: 64GB DDR5 Kingston
  • Drive: Kingston NVMe

Installation Details:

  • Installer: Network image / Offline image (x86_64) using USB media created with Balena Etcher.
  • Partitions:
    • nvme0n1p1 - EFI (boot)
    • nvme0n1p2 - BTRFS with LUKS encryption (subvolumes auto-created)

I mostly used the default settings in the installer, but manually created the partitions mentioned above since I wanted to test before committing to a distro, possible dualboot setup

The Issue:

  1. After completing the install with no errors, I boot into the system for the first time.
  2. It asks for a passphrase for “hd0,gpt2” — the only passwords set during installation were for the user account and the LUKS encryption (neither are keyboard-layout sensitive).
  3. I try both passwords, but it says “invalid passphrase.” After 3 attempts, I am sent to emergency mode.
  4. Restarting the system results in a similar issue, but this time it asks for the passphrase for “hd0,gpt3.”
  5. Again, neither password works.

Tried Reinstalling , deleting past attempt parttions and starting from a blank slate drive:

  • Attempt 1: Followed the above steps (LUKS encryption, 2 partitions).
  • Attempt 2: Same as above, but I went through each step more carefully to ensure no settings were unintentionally changed.
  • Attempt 3: Used the offline image and recreated the USB stick with Balena Etcher, keeping the same configuration otherwise.
  • Attempt 4: I tried a non-LUKS setup with only a basic 3-digit password for the user account during install, but still ended up in the same passphrase loop, asking for different “hd0,gpt xnumber” passphrases.

Additional Information:

  • I’ve checked the partition layout using a live USB (lsblk and blkid), and everything seems correct (EFI on nvme0n1p1 and the encrypted partition on nvme0n1p2).
  • I haven’t been able to find any logs in emergency mode or elsewhere that give a clear error, although not saying they don’t exist, just in my limited knowledge troubleshooting using my phone to try and troubleshoot I have not seen any readily apparent cause.

I’m starting to wonder if I’m missing something painfully obvious., which I hope is the case because at this point, openSUSE is causing the most headaches of all the distros I’ve tested, and I haven’t even gotten a chance to use it yet. Any help or advice would be greatly appreciated!

Thanks in advance!

2

How are you creating the install media?? Must be a clean binary copy (no modes) to the install media device not to a partition on the device!.

3

Just a bog standard balenaetcher, select iso>flash, balena overwrites any existing data on the usb so there’s nothing but the iso. Did learn the hard way about ventoy, had install issues, including debian when installing auto flagging a ventoy partition I didn’t notice and install failed, been using balenaetcher since, 1 flash per usb, has worked on endeavour,kubuntu and fedora, just suse I am for some reason struggling with

4

Personally I just use cp or dd. don’t know balenaetcher

5

Before commencing with the installation, I assume that you wiped the disk partitions completely?

Is this a multi-boot system?

If /boot is inside the encrypted volume, GRUB has to unlock the disk. That’s GRUB cryptodisk, and it’s fragile. Speculating that leftover GPT/LUKS/EFI metadata could cause GRUB to probe the wrong container and reject the correct passphrase.

6

I appreciate the input, you’re right—the drive is wiped. I’ve been deleting the partitions within the openSUSE installer at the start of each attempt. Dual-booting is something I’m considering, but for now, my priority is to install a distro, use it for a while to see what I like and don’t like, and depending on how things shape up, maybe set up a dual-boot if two different distros appeal to me enough to want to learn both. The install attempts I mentioned have been on an M.2 drive that only has the partitions created during the openSUSE install process.

7

If you boot into a live system after installation and try to unlock the encrypted root partition manually, does that work with the correct passphrase?

8

Yes, in a live system I can use cryptsetup luksOpen and my passphrase is accepted on the first entry.
I can mount the /dev/mapper/suse_crypt and run btrfs check which returns no issues,

9

That’s good to know. From what you’ve posted so far, it reads like a GRUB configuration issue generated by the installer.

Did you inspect the installed /boot and GRUB configuration?

sudo mount /dev/nvme0n1p1 /mnt/boot/efi
cat /mnt/boot/grub2/grub.cfg

You could try rebuilding GRUB from the live system…

sudo mount --bind /dev /mnt/dev
sudo mount --bind /proc /mnt/proc
sudo mount --bind /sys /mnt/sys
sudo chroot /mnt
grub2-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=openSUSE
grub2-mkconfig -o /boot/grub2/grub.cfg
exit

Then reboot and test the installed OS again.

10

To expand on the above, also check the UUID enumerated by sudo blkid /dev/nvme0n1p2 is referenced by the GRUB config of the installed OS.

11

Thanks, the uuid matches what is shown in the grub/cfg , hit and miss progress stumbling my way through the rest but unfortunately the same result .

First at sudo chroot /mnt I got

tty: ttyname error: no such device

After unmounting and remounting I got further and at the grub2-install line I got

“EFI variables are not supported on this system.
EFI variables are not supported on this system.
grub2-install: error: efibootmgr failed to register the boot entry: No such file or directory.”

After this i got

Generating grub configuration file …
Found theme: /boot/grub2/themes/openSUSE/theme.txt
Found linux image: /boot/vmlinuz-6.18.2-1-default
Found initrd image: /boot/initrd-6.18.2-1-default
Warning: os-prober will be executed to detect other bootable partitions.
Its output will be used to detect bootable binaries on them and create new boot entries.
579.258867 | DM multipath kernel driver not loaded
WARNING: failed to init udev for external device info, using none.
Adding boot menu entry for UEFI Firmware Settings …
done

On this reboot, same thing as always, passphrase prompt

enter passphrase for hd0,gpt4

then telling me “invalid passphrase” however before kicking me to emergency mode it did linger longer on the following error screen longer than any point before, don’t know the relevance of that b ehaviour.

error:…/…/grub-core/disk/luks2.c:838 invalid passphrase.
error:…/…/grub-core/disk/cryptodisk.c:1561:no such cryptodisk found, perhaps a needed disk or cryptodisk module is not loaded.
error:…/…/grub-core/commands/search.c:1370:no server is specified.
error:…/…/grub-core/loader/i386/efi/linux.c:168:you need to load the kernel first

12

I’m not sure how to resolve this…GRUB cannot complete the LUKS2 unlock. Hence it does not find a decrypted device to boot with.

Just in case the following approaches are helpful…

https://en.opensuse.org/Portal%3AMicroOS/FDE?utm_source=chatgpt.com#Installation_with_YaST

13

Were you able to find a solution? I’m encountering the same problem. GRUB2 EFI reports an invalid password when FDE is enabled during install.

14

Actually, I’ve just discovered the solution. If you instantly receive an “invalid passphrase” message then your GRUB doesn’t support argon2id decryption. I booted a live USB then added a pbkdf2 key using cryptsetup luksChangeKey --pbkdf pbkdf2 /dev/sda2

You can remove the previous key after logging in or simply leave it. This is safer than using cryptsetup luksConvertKey which could leave your partition unreadable if there’s a power loss.

2 Likes
15

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.