#1137532 cryptroot-unlock: Error: Timeout reached while waiting for askpass.

Package:
cryptsetup
Source:
cryptsetup
Description:
disk encryption support - startup scripts
Submitter:
Holger Levsen
Date:
2026-05-24 23:19:01 UTC
Severity:
normal
#1137532#5
Date:
2026-05-24 20:53:06 UTC
From:
To:
package: cryptsetup
version: 2:2.7.5-2

hi Guilhem,

so I have a server running trixie and using dropbear-initramfs to unlock
the crypted root partition, which until last week worked very nicely:

$ dpkg -l|grep -E 'dropbear|cryptsetup|linux-image'|cut -b 1-60
ii  cryptsetup                        2:2.7.5-2
ii  cryptsetup-bin                    2:2.7.5-2
ii  cryptsetup-initramfs              2:2.7.5-2
ii  dropbear-bin                      2025.89-1~deb13u1
ii  dropbear-initramfs                2025.89-1~deb13u1
ii  libcryptsetup12:amd64             2:2.7.5-2
ii  linux-image-6.12.74+deb13+1-amd64 6.12.74-2
ii  linux-image-6.12.88+deb13-amd64   6.12.88-1
ii  linux-image-6.12.90+deb13-amd64   6.12.90-1
ii  linux-image-amd64                 6.12.90-1

The root fs is on an md array, nothing fancy really.

With linux-image-6.12.74 i can boot as always, that is, log in via
ssh, run cryptroot-unlock and then the server boots.

With the newer kernels this doesnt work anymore:

----
To unlock root partition, and maybe others like swap, run `cryptroot-unlock`.


BusyBox v1.37.0 (Debian 1:1.37.0-6+b8) built-in shell (ash)
Enter 'help' for a list of built-in commands.

~ # cryptroot-unlock

Error: Timeout reached while waiting for askpass.
----

I recreated all the initramfs using

# update-initramfs -k all -u

but that changed nothing.

(I also see some sdb errors but I believe those are red herrings.)

Any help welcome, i'd be happy to further help in debugging this.

& thank you for maintaining cryptsetup! It's awesome when it works! :)
#1137532#10
Date:
2026-05-24 23:17:35 UTC
From:
To:
Hi Holger!

Are you able to unlock manually using cryptsetup(8) from that SSH
session?  If not, please share the output using the --debug flag.

It might be that a module is missing, or perhaps on the newer kernel the
block device holding hasn't shown up yet for some reason?  See
https://cryptsetup-team.pages.debian.net/cryptsetup/README.debug.html
to debug the boot script and see what it's doing instead of launching
askpass.  (You should be able to get a shell in the premount stage via
SSH too, but need to set the `break=premount` boot option first.)

Hope that helps :-)