# Unlocking LUKS volume with Nitrokey 3 on Debian 12.2

**URL:** https://support.nitrokey.com/t/unlocking-luks-volume-with-nitrokey-3-on-debian-12-2/5553
**Category:** FIDO2 / Nitrokey 3
**Created:** [October 29, 2023, 7:50pm UTC](https://support.nitrokey.com/t/unlocking-luks-volume-with-nitrokey-3-on-debian-12-2/5553 "2023-10-29T19:50:32Z")
**Posts on this page:** 1
**Showing post:** 7

<div class="post-metadata">

### Author: ![FredL](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/f/3d9bf3/32.png) [@FredL](https://support.nitrokey.com/u/FredL)
#### Post date: [November 1, 2023, 3:47pm UTC](https://support.nitrokey.com/t/unlocking-luks-volume-with-nitrokey-3-on-debian-12-2/5553/7 "2023-11-01T15:47:42Z")

</div>

I have done more tests and things can be simplified a bit more!

When you set `hostonly=yes` in dracut configuration, the file `/etc/crypttab` is included into the initrd.  
Since dracut will have this file during boot, you don’t need to:

- add `rd.auto=1` in `/etc/default/grub`
- rename the target in `/etc/crypttab`

So it boils down to:

```auto
#
# Switch from initramfs-tools to Dracut to manage initrd
#
apt install dracut
apt purge cryptsetup-initramfs && apt autoremove -purge
echo "hostonly=yes" > /etc/dracut.conf.d/10-hostonly.conf
dracut -f
# Test that the switch to dracut is working by rebooting 😀
reboot

#
# Enroll your FIDO2 device to unlock Luks volume
#
apt install fido2-tools
nano /etc/crypttab
# Change the line:
# vda5_crypt UUID=165e9c6c-6277-49b1-ac51-94158b504964 none luks,discard
# to:
# vda5_crypt UUID=165e9c6c-6277-49b1-ac51-94158b504964 none luks,discard,fido2-device=auto
# Update initrd to include FIDO2 tools and updated /etc/crypttab
dracut -f
# Plug your FIDO2 device
systemd-cryptenroll -fido2-device=list
# Check your FIDO2 device is listed
systemd-cryptenroll -fido2-device=auto /dev/vda5
# Test if everything works as expected ! 😀
reboot

```

---

_[View the full topic](https://support.nitrokey.com/t/unlocking-luks-volume-with-nitrokey-3-on-debian-12-2/5553)._