---
title: "Unlock a LUKS root over SSH on Fedora and Red Hat Enterprise Linux"
description: "Remote Fedora or Red Hat Enterprise Linux servers with encrypted LUKS roots can stop in the initramfs, waiting for a passphrase at an unattended console. The documented setup installs dracut-sshd from EPEL, adds dracut’s network-manager module, enables rd.neednet=1 and ip=dhcp in GRUB, then rebuilds the initramfs and boot configuration. NetworkManager brings up the initramfs network, while SSH exposes systemd-tty-ask-password-agent; the SSH session closes after unlocking because the root transition destroys the initramfs sshd. The rd.neednet=1 argument creates the neednet flag that gates nm-initrd.service, and the generated connection profile carries into the real root. Initramfs credentials sit unencrypted on /boot, so dedicated host keys, separate known_hosts entries, and physical testing are recommended before relying on remote recovery."
---

# Unlock a LUKS root over SSH on Fedora and Red Hat Enterprise Linux

[Red Hat](https://yomu.fyi/company/red-hat) · Josephine Pfeiffer · Sep 11, 2026

**Type:** Tutorial

## Summary

Remote Fedora or Red Hat Enterprise Linux servers with encrypted LUKS roots can stop in the initramfs, waiting for a passphrase at an unattended console. The documented setup installs dracut-sshd from EPEL, adds dracut’s network-manager module, enables rd.neednet=1 and ip=dhcp in GRUB, then rebuilds the initramfs and boot configuration. NetworkManager brings up the initramfs network, while SSH exposes systemd-tty-ask-password-agent; the SSH session closes after unlocking because the root transition destroys the initramfs sshd. The rd.neednet=1 argument creates the neednet flag that gates nm-initrd.service, and the generated connection profile carries into the real root. Initramfs credentials sit unencrypted on /boot, so dedicated host keys, separate known\_hosts entries, and physical testing are recommended before relying on remote recovery.

## Context

A remote encrypted server can reboot into the initramfs and wait for a passphrase at a console where nobody is present to enter it.

## Approach / What changed

Install dracut-sshd from EPEL, configure dracut’s network-manager module, add rd.neednet=1 and ip=dhcp to GRUB\_CMDLINE\_LINUX, and rebuild the initramfs and GRUB configuration. The resulting initramfs runs NetworkManager and sshd, allowing systemd-tty-ask-password-agent to unlock the LUKS root over SSH.

## Takeaways

- rd.neednet=1 is what makes dracut’s initramfs networking unit run; the /run/NetworkManager/initrd/neednet flag gates nm-initrd.service, and without it the unit is skipped rather than reported as failed.
- dracut-sshd normally copies /root/.ssh/authorized\_keys and host keys into the initramfs, but those credentials are unencrypted on /boot; dedicated dracut SSH host keys avoid reusing the running system’s identity.
- The initramfs-generated NetworkManager keyfile remains in /run across switch-root, allowing NetworkManager on the real root to read the same connection profile and UUID.

**Tags:** [dracut](https://yomu.fyi/topic/dracut), [Linux](https://yomu.fyi/topic/linux), [SSH](https://yomu.fyi/topic/ssh)

- Source: [Red Hat](https://developers.redhat.com/articles/2026/09/11/unlock-a-luks-root-over-ssh-on-fedora-and-red-hat-enterprise-linux)
- Source URL: https://developers.redhat.com/articles/2026/09/11/unlock-a-luks-root-over-ssh-on-fedora-and-red-hat-enterprise-linux
- Ingested by Yomu: 2026-09-11T16:03:28.926Z

[Read original post](https://developers.redhat.com/articles/2026/09/11/unlock-a-luks-root-over-ssh-on-fedora-and-red-hat-enterprise-linux)