How to Unlock a LUKS-Encrypted Root Over SSH on Fedora and RHEL
In this article, use dracut-sshd on Fedora and RHEL to SSH into the initramfs and unlock a LUKS-encrypted root remotely, with no console trip needed.
An encrypted server that reboots in a remote rack stops at a passphrase prompt that nobody can see. Here's how to add SSH and networking to the initramfs with dracut-sshd and NetworkManager, so you can unlock it from your own terminal.
If you encrypt the root filesystem of a server in a data centre, a branch office, or a customer's closet, you have probably noticed that every reboot becomes a small problem.
A kernel update, a power cut, or planned maintenance all end the same way, with the machine waiting at a LUKS passphrase prompt on a console you cannot reach while your SSH session quietly times out.
Most admins end up driving to the machine or struggling with a slow remote management console such as IPMI or iDRAC, and some give up and leave the disk unencrypted, which throws away the protection they wanted in the first place.
There is a much simpler way to handle this on Fedora and RHEL, because the tools needed are already packaged and only need to be switched on.
That solution is dracut-sshd, which puts the OpenSSH server inside the initramfs, the small temporary root filesystem that Linux loads before the real root disk is mounted.
Together with dracut's NetworkManager module, it lets the server bring up its network card early in the boot, start sshd, and wait for you to log in and type the passphrase, just as you would at the physical console.