Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Unlocking LUKS2 Volumes with TPM2, FIDO2, PKCS#11 Security HW on Systemd 248

0pointer.net

Post reply on HN
Print view View original

81–90 of 102 posts

Re: Unlocking LUKS2 Volumes with TPM2, FIDO2, PKCS#11 Security HW on Systemd 248

#81

Post by tialaramex »

Sentes wrote: post #79
tialaramex wrote: post #42

Earlier quoted context omitted.

FIDO-based SSH requires support from the server, because it's a new authentication method. So this is great in an environment where you control the servers, and some day it'll be pretty great for almost everybody, but today e.g. you can't use FIDO for GitHub. Whereas the older methods did not have this dependency. On the other hand, one really nice thing is that FIDO lets you force employees to actually use organisat…

> There's no way to force the remote SSH client not to store that RSA private key unencrypted But there is a way to remotely attest that the private key has been generated on device (either through TPM attestation or https://developers.yubico.com/PGP/Attestation.html ). Not to mention that the admin could just generate private keys on the token and give employees that.

I was unaware of these options, thank you.

Re: Unlocking LUKS2 Volumes with TPM2, FIDO2, PKCS#11 Security HW on Systemd 248

#82

Post by Fnoord »

vbezhenar wrote: post #78
clipradiowallet wrote: post #15

Unrelated to unlocking devices...but LUKS is a really nice piece of software for linux. You throw any block device(real or otherwise) to it, and you get a /dev/mapper/ volume that transparently encrypts anything written to it. Other than encrypting my local workstations, you can also use it on VMs from linode/digitalocean/aws/gcp/etc. If you store all your sensitive data beneath /home for example, you can boot the in…

I’ve found out that my VPS hoster mounts disk of my VM when I power it off and writes some config changes (which broke network because their scripts were buggy). That creeped me out, so I decided to encrypt my disks. So encryption is useful even for better stability in uncontrolled environments.

> VPS hoster

> so I decided to encrypt my disks

Where is the data encrypted? Local or remote? If its done remotely, whoever owns the hardware and has root on the host OS has your private key. Even with rented servers, where you are root, the KVM is king.

Re: Unlocking LUKS2 Volumes with TPM2, FIDO2, PKCS#11 Security HW on Systemd 248

#83

Post by gdamjan1 »

kd913 wrote: post #25

I am confused at which stage this is happening. Is this after the bootloader, after initramfs but now systemd-cryptsetup is loaded and unlock the first disk? AFAIK when I do my first disk unlock, at that point does systemd units get loaded including systemd-mounting. Those mounts can already already mount/unlock encrypted secondary disks, based on the keyfiles stored on the now decrypted disk. So what exactly in this…

fTPM on my Ryzen 3600 worked.

Re: Unlocking LUKS2 Volumes with TPM2, FIDO2, PKCS#11 Security HW on Systemd 248

#85

Post by gdamjan1 »

Foxboron wrote: post #27
kd913 wrote: post #25

I am confused at which stage this is happening. Is this after the bootloader, after initramfs but now systemd-cryptsetup is loaded and unlock the first disk? AFAIK when I do my first disk unlock, at that point does systemd units get loaded including systemd-mounting. Those mounts can already already mount/unlock encrypted secondary disks, based on the keyfiles stored on the now decrypted disk. So what exactly in this…

Initramfs I believe. `systemd-cryptenrol` would probably just be a binary like any other and wrap `cryptsetup` which is on your initramfs.

here's what I had to do on Arch to enable unlocking the root volume with TPM2: https://github.com/systemd/systemd/pull/17741#issuecomment-7...

it'll need some work from the distros so the whole process is a bit more straightforward.

Re: Unlocking LUKS2 Volumes with TPM2, FIDO2, PKCS#11 Security HW on Systemd 248

#86

Post by vbezhenar »

Fnoord wrote: post #82
vbezhenar wrote: post #78

Earlier quoted context omitted.

I’ve found out that my VPS hoster mounts disk of my VM when I power it off and writes some config changes (which broke network because their scripts were buggy). That creeped me out, so I decided to encrypt my disks. So encryption is useful even for better stability in uncontrolled environments.

> VPS hoster > so I decided to encrypt my disks Where is the data encrypted? Local or remote? If its done remotely, whoever owns the hardware and has root on the host OS has your private key. Even with rented servers, where you are root, the KVM is king.

It is encrypted remotely using LUKS, but I have to enter password manually when machine is booting (via web VNC). Of course I understand that determined attacker from hoster side could sniff that password, but, as I said, that's more about preventing automatic scripts to mount my disks rather than trying to hide something.

Re: Unlocking LUKS2 Volumes with TPM2, FIDO2, PKCS#11 Security HW on Systemd 248

#87

Post by m45t3r »

iio7 wrote: post #55
m45t3r wrote: post #43

Earlier quoted context omitted.

I don't really understand this feature creep argument against systemd. I mean, this is not like this is a feature included in PID1, it is a new binary so a separate feature (and I am pretty sure that you can choose to not compile it too if you don't want, like almost any other systemd feature with the exception of systemd itself and journald). Also, the way I understand systemd nowadays is it isn't an init system, it…

> I don't really understand this feature creep argument against systemd. I mean, this is not like this is a feature included in PID1, it is a new binary so a separate feature (and I am pretty sure that you can choose to not compile it too if you don't want, like almost any other systemd feature with the exception of systemd itself and journald). AFAIK systemd and the different components has so many internal dependen…

Unless you give me a more concrete example, I don't really think this is true.

For example, right now neither my desktop nor my notebook uses `systemd-networkd` and it works fine. Actually, since I use NixOS even basic things like `hostnamectl` or `timedatectl` are "disabled" (they work in read-only mode since those configs are managed by NixOS). But I do use `systemd-bootd` (so I can get boot information from the early UEFI until user space, try doing the same thing with GRUB+sysVinit).

The only two components that I know it can't be disabled in systemd is the init part and journalctl (because all the other parts of systemd depends on it).

Re: Unlocking LUKS2 Volumes with TPM2, FIDO2, PKCS#11 Security HW on Systemd 248

#88

Post by arianvanp »

mnd999 wrote: post #23

This means systemd needs to live on an unencrypted volume though, right? Seems like a bit of a weakness given how much systemd can actually do. I went with LUKS1 which grub can unlock.

systemd-boot measures the bootloader, initramfs, kernel and kernel-params state into the PCR registers of your TPM. SecureBoot state is also measured.

You can configure through systemd-enroll to configure the TPM to only unlock the cryptokey if those measurements are consistent.

If somebody changes your systemd binary in the initramfs; this causes the TPM PCR register to change; and will cause the system to not be able to decrypt the stage-2 rootfs

Re: Unlocking LUKS2 Volumes with TPM2, FIDO2, PKCS#11 Security HW on Systemd 248

#90

Post by ae5hnw5 »

mo2art wrote: post #89

How is this superior to clevis? https://blog.dowhile0.org/2017/10/18/automatic-luks-volumes-... https://m.youtube.com/watch?v=Dk6ZuydQt9I

Superior might be a stretch, but it the ability to use PKCS11 and FIDO2 tokens look to be differentiating features.
Post reply on HN