Unlock a LUKS root over SSH on Fedora and Red Hat Enterprise Linux

Summary

Remote Fedora or Red Hat Enterprise Linux servers with encrypted LUKS roots can stop in the initramfs, waiting for a passphrase at an unattended console. The documented setup installs dracut-sshd from EPEL, adds dracut’s network-manager module, enables rd.neednet=1 and ip=dhcp in GRUB, then rebuilds the initramfs and boot configuration. NetworkManager brings up the initramfs network, while SSH exposes systemd-tty-ask-password-agent; the SSH session closes after unlocking because the root transition destroys the initramfs sshd. The rd.neednet=1 argument creates the neednet flag that gates nm-initrd.service, and the generated connection profile carries into the real root. Initramfs credentials sit unencrypted on /boot, so dedicated host keys, separate known_hosts entries, and physical testing are recommended before relying on remote recovery.

Takeaways

1. 1

   rd.neednet=1 is what makes dracut’s initramfs networking unit run; the /run/NetworkManager/initrd/neednet flag gates nm-initrd.service, and without it the unit is skipped rather than reported as failed.

2. 2

   dracut-sshd normally copies /root/.ssh/authorized_keys and host keys into the initramfs, but those credentials are unencrypted on /boot; dedicated dracut SSH host keys avoid reusing the running system’s identity.

3. 3

   The initramfs-generated NetworkManager keyfile remains in /run across switch-root, allowing NetworkManager on the real root to read the same connection profile and UUID.