Unlocking LUKS2 Volumes with TPM2, FIDO2, PKCS#11 Security HW on Systemd 248

Post by inetknght » Mon, Jan 25, 2021, 10:13 PM UTC

Arnavion wrote: post #98

inetknght wrote: post #95

Earlier quoted context omitted.

You have to know that you're looking for `systemd.service` in the first place. If you search for `man service` you get linked to SysV init scripts [0] and are led astray if you don't know that sysv init scripts aren't systemd. If you search for `man systemd` you get linked to a huge man page [1] which isn't approachable to a novice. There isn't an `EXAMPLE` section like there are on other man pages and searching for…

>You have to know that you're looking for `systemd.service` in the first place. Yeah, because that's the thing you want help with. No shit `man service` and `man systemd` aren't going to give you help for systemd services that easily. Also, apparently you assume the user is simultaneously stupid enough to not put "systemd" and "service" in the same search query, but is meant to know to visit ` https://systemd.softwar…

> Yeah, because that's the thing you want help with.

No it isn't. I, as a power user and only as a novice system administrator, want to "run a program at startup".

It's not clear to me that it's `systemd` that manages that. It's not clear to me that it's specifically `systemd.service` that I need to find help with.

> No shit `man service` and `man systemd` aren't going to give you help for systemd services that easily.

But... why???

> Also, apparently you assume the user is simultaneously stupid enough to not put "systemd" and "service" in the same search query

Yes, I do assume that because it describes me. I'm sorry you think I'm stupid though. Get off your high horse and start thinking of people with different experiences than yours.

> but is meant to know to visit `https://systemd.software/service` even though it too contains both those words.

Searching Google for `systemd service` puts a link to freedesktop.org with a very un-memorable URL. I didn't even understand that "freedesktop.org" is the authoritive site until a few weeks into learning systemd. I definitely won't remember to type in "freedesktop.org/software/" before trying to find systemd documentation. And I don't want to have to use Google as a relay every time I want to read the documentation for systemd.

So I made a site that does it for me.

Post by tialaramex » Sat, Jan 30, 2021, 12:33 PM UTC

tialaramex wrote: post #5

resoluteteeth wrote: post #2

Does the yubikey "security key" series (the ones that only do u2f/fido2) support the necessary extension?

Edited to update: Nope :( My Security Key 2 reports lacking this extension. This is what the comment said before I updated it, in case it's important context for replies: I believe that they do implement hmac-secret yes. For what it's worth this is the same feature (for the same reason) you need to enroll FIDO authenticators to unlock a Windows system, so if you use one to do that today, it definitely ought to work w…

Now I feel terrible, because I think this was incorrect due to an embarrassing error and yet it has 5 upvotes which suggests several HN readers thought it was helpful :(

During another activity I was talking to somebody about this test, and when I visualised it in my head I realised that even though I was talking about testing my "Security Key 2" I had actually tested a much simpler/cheaper Feitian based U2F authenticator I own because it was in my pocket and I just instinctively use the one I'm carrying for FIDO authentication.

Unsurprisingly this cheaper device doesn't do hmac-secret.

However I have now fetched my actual genuine Yubico Security 2 and re-tested that, and it does have hmac-secret despite Yubico's own site seeming to suggest otherwise.

The chances anybody is reading this for any reason other than to point out I was wrong are small, but just in case this is found by somebody's later Google search here it is.

Here's some example output from Yubico's example app (the secrets here are random and worthless)

New credential created, with the HmacSecret extension. Authenticate with salt: b'21cef9e80517c7527ddaea4229ea36c675c539da7f98ecf3878dfc026caf4a6d'

Re: Unlocking LUKS2 Volumes with TPM2, FIDO2, PKCS#11 Security HW on Systemd 248

Re: Unlocking LUKS2 Volumes with TPM2, FIDO2, PKCS#11 Security HW on Systemd 248