Cannot SSH into ZBM when using native encryption on root

[Shadow53]

I've got a desktop Gentoo system set up using a combination of the following guides:

• https://wiki.gentoo.org/wiki/ZFS/rootfs
• https://docs.zfsbootmenu.org/en/v2.3.x/general/native-encryption.html
• https://docs.zfsbootmenu.org/en/v2.3.x/general/remote-access.html

The system uses ZFS with native encryption for the root filesystem. My expectation was that I could reboot the system via SSH, have it load zfsbootmenu as it loads, and SSH in to unlock the root dataset and continue booting.

Instead, it seems that the ethernet connection will not initialize until the root dataset key is loaded. I assume this because the computer does not show up in the devices list in my router.

Does it sound like I've misconfigured something? Are these features maybe not supported at the same time? I'd appreciate any help, as I'd like to get this working.

[ahesford]

There should be no interaction between dracut-crypt-ssh and ZFS native encryption. However, dracut uses an internal event loop to run its modules, and these can run in unpredictable order. If you can, I recommend trying mkinitcpio to get deterministic ordering of hooks run in the ZFSBootMenu image.

[JkktBkkt]

Using the same setup on two separate machines, I ended up setting a static IP address for the system (at boot time) via configuration files processed by dracut.

In my case that ended up being:

In /etc/cmdline.d/dracut-network.conf
ip=IP::gateway:255.255.255.0:hostname:interface:off rd.neednet=1

In /etc/zfsbootmenu/dracut.conf.d/dropbear.conf
install_optional_items+=" /etc/cmdline.d/dracut-network.conf "
afaik, this ^ should be default as-is

And then a generate-zbm

I'm pretty sure that this can be done either via command line options passed to ZBM itself via EFI configuration (or via some boot manager, i.e. rEFInd) in order to not apply after ZBM kexec's into your regular kernel, but I haven't bothered with trying that out.

[Shadow53]

That neednet part might be what I'm missing. I'm using DHCP with the IP reserved on the router, so I'll have to figure how what flags I need.

I'm pretty sure that this can be done either via command line options passed to ZBM itself

That reminded me to check the options for ZBM, and I found zbm.show to force the menu to not auto-boot when it loads. Not sure if that will be necessary with encryption, but noting for myself for later.