On: Unlocking LUKS2 Volumes with TPM2, FIDO2, PKCS#11 Security HW on Systemd 248

[lambda_obrien]

You can even setup SSH to the bootloader to unlock LUKS if it reboots.

[kdtsh → lambda_obrien]

Yup, earlyssh - I found it a massive pain to set up, but it works.

[kwk1 → kdtsh]

Interesting, I've never heard of earlyssh as an option--I've used dropbear-initramfs for this in the past.

[jamesponddotco → kwk1]

Same here, I have been using dropbear-initramfs since forever. I am now looking into Mandos[1] though, as doing it manually with Dropbear becomes a massive pain when managing several bare-metal servers.

[1] https://www.recompile.se/mandos

[predakanga → jamesponddotco]

Thanks for the link; I hadn't heard of Mandos.

Another solution in the same space is Clevis[1]; last time I was researching this problem, I came across it via Red Hat's docs[2].

[1]: https://github.com/latchset/clevis

[2]: https://access.redhat.com/documentation/en-us/red_hat_enterp...

[kdtsh → kwk1]

I think dropbear is what sits under earlyssh. I'll look into dropbear-initramfs, if it's easier to work with than earlyssh that is a big plus in my book.

edit: early-ssh is hosted at https://github.com/gheja/early-ssh . Not to knock early-ssh by saying it's difficult to work with too - it's a great piece of software which has made my life a lot easier.

[unqueued → kdtsh]

If you like early-ssh, I would like to suggest checking out better-initramfs. No dependency on systemd, easy to modify and build. I think it can do everything early-ssh can do. I use it to boot a variety of LUKS encrypted btrfs machines.

Disclosure: I'm a contributor.

https://github.com/slashbeast/better-initramfs

[kdtsh → unqueued]

Nice! Starred, will definitely keep that in mind, thanks a lot.

[lambda_obrien → kwk1]

Same, that's what I use, and it was super easy to do.

[geek_at → lambda_obrien]

Also you can auto-decrypt LUKS when your main machine is booted https://blog.haschek.at/2020/the-encrypted-homelab.html