Using a Bluetooth keyboard to unlock LUKS on Ubuntu

A Bluetooth keyboard normally becomes available only after Ubuntu starts its regular Bluetooth service.

That is too late for the LUKS password prompt. Disk unlocking happens earlier during boot.

The fix is to include Bluetooth support in the initramfs.

Why this is needed

The initramfs is the small temporary system used before the encrypted root filesystem is mounted.

The LUKS password prompt runs there.

So a Bluetooth keyboard can only work at that stage if the initramfs contains:

• the Bluetooth kernel drivers
• bluetoothd
• bluetoothctl
• the Bluetooth configuration
• the keyboard pairing data

This setup uses dracut.

Check the Bluetooth adapter

Find the Bluetooth device:

lsusb

Example:

Intel Corp. Bluetooth wireless interface

Check the loaded Bluetooth modules:

lsmod | grep -E 'bluetooth|btusb|btintel|btrtl|btbcm'

For an Intel adapter, the important modules are usually:

bluetooth
btusb
btintel

Add Bluetooth to the initramfs

Create the dracut configuration file:

sudo nano /etc/dracut.conf.d/bluetooth.conf

Add:

add_dracutmodules+=" bluetooth "
add_drivers+=" bluetooth btusb btintel btbcm btrtl "

Then rebuild the initramfs:

sudo update-initramfs -u

Dracut may still show:

If you need to use bluetooth, please include it explicitly.

That warning does not confirm whether Bluetooth was included. Check the generated image directly.

Verify the result

For the currently running kernel:

sudo lsinitrd /boot/initrd.img-$(uname -r) \
  | grep -Ei 'bluetooth|bluez|btusb|btintel'

If a newer kernel was installed and the system has not rebooted yet, check that image directly:

sudo lsinitrd /boot/initrd.img-<kernel-version> \
  | grep -Ei 'bluetooth|bluez|btusb|btintel'

Useful entries include:

usr/bin/bluetoothctl
usr/libexec/bluetooth/bluetoothd
usr/lib/modules/.../btusb.ko
usr/lib/modules/.../btintel.ko
var/lib/bluetooth/

var/lib/bluetooth/ is important. It contains the pairing information needed to reconnect an already paired keyboard.

After rebooting, the Bluetooth keyboard should reconnect before the LUKS password is entered.

Advantages

The main benefit is simple: no separate USB keyboard is needed just for disk unlocking.

This is useful for desktops, small PCs, and systems where the main keyboard is Bluetooth-only.

Disadvantages

Bluetooth early in boot adds more dependencies than a wired keyboard.

The adapter, drivers, Bluetooth daemon, and pairing data all need to work correctly inside the initramfs.

A wired keyboard is still the safer recovery option.

The initramfs also contains Bluetooth pairing data after this change. Since /boot is often not encrypted, that is worth knowing.

Keeping it working

Normal kernel updates should reuse:

/etc/dracut.conf.d/bluetooth.conf

No manual work should normally be required.

If a new Bluetooth keyboard is paired, rebuild the initramfs once:

sudo update-initramfs -u

After a major Ubuntu upgrade, check that the configuration still exists and Bluetooth is still present:

sudo lsinitrd /boot/initrd.img-<kernel-version> \
  | grep -Ei 'bluetooth|btusb|btintel|bluetoothd'

The useful rule is:

Anything needed before the encrypted root filesystem is unlocked must be available inside the initramfs.