A more automated workflow is provided by Mandos:

https://wiki.recompile.se/wiki/Mandos

It does have it’s limitations though. Make sure you read the FAQ:

https://www.recompile.se/mandos/man/intro.8mandos

I had a few questions though.

I am looking to set up an environment like this, however, I need it in the following architecture.

Instead of initiating the unlock from the local host, how would I make it so when the encrypted server boots, it automatically calls the keyserver, retrieves a key file or passphrase, then unlocks the drive.

Thanks!

Indeed. This article should be considered obsolete for stretch.

Well the idea of the tutorial is to have a different port when the server is in production. In the tutorial we are using port 4422. So if you try this it will probably work:

ssh -p 4422 root@encrypted-system

Thanks for the additional info Richard.

I do have a couple of items to add.

1. When using multiple network interfaces best practice to lock down the configure inside initramfs.conf down to one device by using the ‘DEVICE=’ else you will need to make multiple IP= lines inside the config so you guarantee the IP address used by dropbear.

2. In order to avoid any key warring you should change the a line inside /usr/share/initramfs-tools/scripts/init-premount/dropbear

The line reads ‘exec /sbin/dropbear ${DROPBEAR_OPTIONS:-$PKGOPTION_dropbear_OPTION} -Fs’

Append -p XXXX where XXXX is the port number used for the dropbear so it will not overlap with the port that is by your openssh thus avoiding the warnings when sshing into your machine.