Skip to main content
1 of 2
frostschutz
  • 52.2k
  • 7
  • 129
  • 179

Detached headers is a special use case. Since few people use it, support for it may also be lacking in some places. So I don't recommend using them. I also don't recommend using a drive without a partition table. This setup has too many pitfalls.


If header=UUID=x does not work, try header=/dev/disk/by-uuid/x.

For header=/some/path/file:UUID=x, the path is relative to the specified filesystem. So, if you mount UUID=x /mnt/somewhere, then it looks for /mnt/somewhere/some/path/file.

Instead of luksErase consider deleting the keys instead (through removekey or killslot). A LUKS header without any remaining keyslots can not be opened anymore (you have to use your detached header for that). But it still provides the UUID so you can identify the encrypted device. Of course, if your detached header is also on a partition and has the same UUID, you'll still have problems... you'll have to change it with luksUUID.

Alternatively if you use GPT partitions, you can use PARTUUID or PARTLABEL to identify it.

frostschutz
  • 52.2k
  • 7
  • 129
  • 179