Full Disk Encryption on Fedora w/ TPM2

Today I’m diving into the world of Secure Boot, TPM2, and all of the complications that come with wanting a high level of security without having to type a disk encryption key all the time. Ultimately, my goal is to come up with a solution that I can roll out in my Linux-based business environment, but today I’m walking you through the basics of how full disk encryption works with LUKS and enrolling your first key into the TPM. Contents⌗ Video LUKS Basics LUKS Key Slots TPM-Bound Keys Encrypted Root on Fedora Video⌗ Basic LUKS Volume⌗ To learn what I’m doing, I’ll create a LUKS-encrypted volume manually. First, though, make sure you have a disk partition to work on: # If you need to partition your drive, do so with sgdisk # Remove existing partition table (MBR + GPT) # sudo sgdisk --zap-all /dev/sdX # Create new partition table and one partition full size # sudo sgdisk -n 1:0:0 -t 1:8309 /dev/sdX # Or, if you already have a partition table, set the type to 8309 (LUKS) instead of 8300 (LINUX) # This is what I did # List partition table sudo sgdisk -p /dev/sdX # Set partition 3 to type "Linux LUKS" (8309) sudo sgdisk -t 1:8309 /dev/sdX After that, we can format the LUKS partition, then format the ext4 filesystem on top of that partition # Format your drive partition (mine is mmcblk0p3) sudo cryptsetup luksFormat --type luks2 /dev/sdX1 # Inspect the LUKS header (just for fun, really) sudo cryptsetup luksDump /dev/sdX1 # Mount the LUKS volume # this creates /dev/mapper/vault block device based name we gave it here - vault sudo cryptsetup open /dev/sdX1 vault # Create the filesystem on the LUKS block device, named 'vault' sudo mkfs.ext4 -L vault /dev/mapper/vault # Create mount point, mount, and test the new device sudo mkdir -p /mnt/vault sudo mount /dev/mapper/vault /mnt/vault echo "hello" | sudo tee /mnt/vault/test.txt # get status of the volume (for fun) sudo cryptsetup status vault sudo ls -l /dev/mapper/ # Unmount ext4 and then close the crypt volume sudo umount /mnt/vault sudo cryptsetup close vault Managing Key Slots⌗ If you want to backup the LUKS header (in case you make a mistake, you can restore the old header with the old keys): # Backup sudo cryptsetup luksHeaderBackup /dev/sdX1 --header-backup-file ~/vault-header.img # Restore sudo cryptsetup luksHeaderRestore /dev/sdX1 --header-backup-file ~/vault-header.img Then we have a few options to add keys: # Add key slot with a passphrase sudo cryptsetup luksAddKey /dev/sdX1 # You can also force a keyslot if you want sudo cryptsetup luksAddKey --key-slot 5 /dev/sdX1 # Add key which is defined by a keyfile # Generate 512 bytes of random as vault.key # Obviously protect this key better than your home directory # Pass in --key-file to mount it sudo dd if=/dev/urandom of=~/vault.key bs=512 count=1 sudo cryptsetup luksAddKey /dev/sdX1 ~/vault.key # Just a reminder, you can see how many key slots there are # And you can tell what type of keys they have sudo cryptsetup luksDump /dev/sdX1 # And you can test your keys using --test-passphrase sudo cryptsetup open --test-passphrase /dev/sdX1 # Change a passphrase on a key slot sudo cryptsetup luksChangeKey /dev/sdX1 # Remove a key by supplying the key itself sudo cryptsetup luksRemoveKey /dev/sdX1 # Remove a key by supplying a different key (specify the slot number) # Cannoy delete your own key using this command sudo cryptsetup luksKillSlot /dev/sdX1 1 Enrolling TPM-Bound keys⌗ We’ll use systemd-cryptenroll for this, so make sure it’s working: # See if we have a working TPM sudo systemd-cryptenroll --tpm2-device=list Let’s now use cryptenroll to add a recovery key - this is randomly generated by systemd, gives you a QR code if you want it. It does not delete existing keys - it just adds a new key using randomness. You don’t have to add recovery keys this way, this is just another way to do it. sudo systemd-cryptenroll --recovery-key /dev/sdX1 And finally, using it to enroll a TPM: # Bind to TPM PCR 7 sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 /dev/sdX1 # Bind to PCR 7 + also require a PIN sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes /dev/sdX1 # Show what we just did sudo systemd-cryptenroll /dev/sdX1 sudo cryptsetup luksDump /dev/sdX1 # Also, we can mount manually using this command sudo cryptsetup open --token-only /dev/sdX1 vault If we are doing this ‘for real’, and want the device auto-unlocked, systemd can manage this for us with the crypttab also: # Get UUID of vault from luksDump sudo cryptsetup luksDump /dev/sdX1 # Add vault to crypttab echo 'vault UUID=<luks-uuid> none tpm2-device=auto,nofail' | sudo tee -a /etc/crypttab # If you want to mount it immediately without rebooting, do daemon-reload and start # The service is 'transient' (generated at runtime), so you can't --enable it sudo systemctl daemon-reload sudo systemctl start systemd-cryptsetup@vault.service # If you reboot, the crypto unlock should happen automatically Fedora Encrypted Root⌗ Fedora’s installer (Anaconda) already sets up the encrypted volume.

The passphrase we enter during installation becomes our recovery key. We just need to enroll a new key slot which is TPM bound, optionally using a PIN.

# Bind to PCR 7 + also require a PIN sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=7 --tpm2-with-pin=yes /dev/sdX1 # Edit the crypttab entry so it checks the TPM for that crypto volume sudo nano /etc/crypttab # luks-<uuid> UUID=<uuid> none discard,tpm2-device=auto # (keep the existing options and add tpm2-device=auto) # Rebuild the initramfs, making sure the TPM2 module is included sudo dracut --force --regenerate-all --add tpm2-tss