You will need to adjust how you generate your initrd to include early-ssh and to start it at the correct time. Example for LUKS + LVM as described in README_CRYPT.TXT: mkinitrd -c -k "$kernel" -f ext4 -r /dev/disk/by-uuid/ \ -m ext4: -u -L -o /boot/initrd-"$kernel".gz \ -C /dev/disk/by-uuid/ -s /tmp/initrd-tree-"$kernel" # clear the luksdev so init does not try to unlock it itself true > /tmp/initrd-tree-"$kernel"/luksdev DESTDIR=/tmp/initrd-tree-"$kernel" /usr/share/mkinitrd/hooks/early_ssh sed -i '/^[[:space:]]*if \[ -x \/sbin\/cryptsetup \]/i \ \/early_ssh' /tmp/initrd-tree-"$kernel"/init mkinitrd -k "$kernel" -f ext4 -r /dev/disk/by-uuid/ -u -L \ -o /boot/initrd-"$kernel".gz -s /tmp/initrd-tree-"$kernel"