Clevis - Revision history

Prabuanand: replaced references to gummiboot-efistub by systemd-efistub as per v3.22 release notes

2025-05-30T15:32:53Z

replaced references to gummiboot-efistub by systemd-efistub as per v3.22 release notes

← Older revision		Revision as of 15:32, 30 May 2025
Line 1:		Line 1:
	{{draft}}		{{draft}}
			[https://github.com/latchset/clevis Clevis] is a pluggable framework for automated decryption. This page documents the how to use it in Alpine Linux to encrypt/decrypt a disk by bounding to tang (network bound encryption/decryption) or a TPM (hardware chip encryption/decryption).

	~~== What is clevis ==~~
	~~It is a software that allows to encrypt/decrypt a disk by bounding to tang (network bound encryption/decryption) or a TPM (hardware chip encryption/decryption).~~

	~~It is in use in redhat fedora systems~~

	~~== Why use clevis ==~~
	With tang, you may automatically decrypt device block/files for convenience, it is encrypted and built to prevent man-in-the-middle attacks as well, since nobody gets private key, only an always changing advertised timed key.		With tang, you may automatically decrypt device block/files for convenience, it is encrypted and built to prevent man-in-the-middle attacks as well, since nobody gets private key, only an always changing advertised timed key.
	* It is recommended to use a tang docker with this, you can use this for example: [https://github.com/padhi-homelab/services/blob/master/tang/docker-compose.yml github] or [https://gitlab.com/AdrianKoshka/tang-docker-container/ gitlab]		* It is recommended to use a tang docker with this, you can use this for example: [https://github.com/padhi-homelab/services/blob/master/tang/docker-compose.yml github] or [https://gitlab.com/AdrianKoshka/tang-docker-container/ gitlab]
Line 15:		Line 10:

	=== mkinitfs + kernel-hooks + secureboot-hook ===		=== mkinitfs + kernel-hooks + secureboot-hook ===

	{{todo\| write guide}}		{{todo\| write guide}}

Line 54:		Line 50:

	Then just do:		Then just do:
	{{cmd\| apk add secureboot-hook ~~gummiboot gummiboot~~-efistub efibootmgr kernel-hooks secureboot-hook}}		{{cmd\| apk add secureboot-hook systemd-efistub efibootmgr kernel-hooks secureboot-hook}}

	{{tip\|To make sure initramfs has the scripts needed, do:		{{tip\|To make sure initramfs has the scripts needed, do:
Line 67:		Line 63:
	}}		}}

	== ~~External sources~~ ==		== See also ==
	* [https://fedoramagazine.org/using-linux-system-roles-to-implement-clevis-and-tang-for-automated-luks-volume-unlocking/ https://fedoramagazine.org/using-linux-system-roles-to-implement-clevis-and-tang-for-automated-luks-volume-unlocking/]		* [https://fedoramagazine.org/using-linux-system-roles-to-implement-clevis-and-tang-for-automated-luks-volume-unlocking/ https://fedoramagazine.org/using-linux-system-roles-to-implement-clevis-and-tang-for-automated-luks-volume-unlocking/]
	* [https://www.admin-magazine.com/Archive/2018/43/Automatic-data-encryption-and-decryption-with-Clevis-and-Tang https://www.admin-magazine.com/Archive/2018/43/Automatic-data-encryption-and-decryption-with-Clevis-and-Tang]		* [https://www.admin-magazine.com/Archive/2018/43/Automatic-data-encryption-and-decryption-with-Clevis-and-Tang https://www.admin-magazine.com/Archive/2018/43/Automatic-data-encryption-and-decryption-with-Clevis-and-Tang]

WhyNotHugo: delete comments (these yield false-positives in search)

2025-02-27T09:33:34Z

delete comments (these yield false-positives in search)

← Older revision		Revision as of 09:33, 27 February 2025
Line 66:		Line 66:
	{{cmd\|./init}}		{{cmd\|./init}}
	}}		}}

	~~----~~

	~~<!--~~

	~~=== dracut ===~~
	~~{{todo\| write guide}}~~

	~~-->~~

	== External sources ==		== External sources ==

WhyNotHugo: /* dracut */ comment out comment

2025-02-26T09:08:52Z

dracut: comment out comment

← Older revision		Revision as of 09:08, 26 February 2025
Line 68:		Line 68:

	----		----

			<!--

	=== dracut ===		=== dracut ===
	{{todo\| write guide}}		{{todo\| write guide}}

			-->

	== External sources ==		== External sources ==

Pursuable1652 at 01:02, 30 December 2024

2024-12-30T01:02:58Z

← Older revision		Revision as of 01:02, 30 December 2024
Line 8:		Line 8:
	== Why use clevis ==		== Why use clevis ==
	With tang, you may automatically decrypt device block/files for convenience, it is encrypted and built to prevent man-in-the-middle attacks as well, since nobody gets private key, only an always changing advertised timed key.		With tang, you may automatically decrypt device block/files for convenience, it is encrypted and built to prevent man-in-the-middle attacks as well, since nobody gets private key, only an always changing advertised timed key.
	* It is recommended to use a tang docker with this, you can use this for example: [https://github.com/padhi-homelab/services/blob/master/tang/docker-compose.yml github]		* It is recommended to use a tang docker with this, you can use this for example: [https://github.com/padhi-homelab/services/blob/master/tang/docker-compose.yml github] or [https://gitlab.com/AdrianKoshka/tang-docker-container/ gitlab]

	== Auto Disk decryption using clevis + tang ==		== Auto Disk decryption using clevis + tang ==

Pursuable1652 at 01:02, 30 December 2024

2024-12-30T01:02:08Z

← Older revision		Revision as of 01:02, 30 December 2024
Line 8:		Line 8:
	== Why use clevis ==		== Why use clevis ==
	With tang, you may automatically decrypt device block/files for convenience, it is encrypted and built to prevent man-in-the-middle attacks as well, since nobody gets private key, only an always changing advertised timed key.		With tang, you may automatically decrypt device block/files for convenience, it is encrypted and built to prevent man-in-the-middle attacks as well, since nobody gets private key, only an always changing advertised timed key.
	* It is recommended to use a tang docker with this		* It is recommended to use a tang docker with this, you can use this for example: [https://github.com/padhi-homelab/services/blob/master/tang/docker-compose.yml github]

	== Auto Disk decryption using clevis + tang ==		== Auto Disk decryption using clevis + tang ==

Pursuable1652 at 01:00, 30 December 2024

2024-12-30T01:00:03Z

← Older revision		Revision as of 01:00, 30 December 2024
Line 77:		Line 77:
	* [https://wiki.archlinux.org/title/Clevis https://wiki.archlinux.org/title/Clevis]		* [https://wiki.archlinux.org/title/Clevis https://wiki.archlinux.org/title/Clevis]
	* [https://man.archlinux.org/man/clevis-encrypt-tang.1.en https://man.archlinux.org/man/clevis-encrypt-tang.1.en]		* [https://man.archlinux.org/man/clevis-encrypt-tang.1.en https://man.archlinux.org/man/clevis-encrypt-tang.1.en]
			* [https://github.com/latchset/clevis/blob/master/src/pins/tang/clevis-encrypt-tang.1.adoc https://github.com/latchset/clevis/blob/master/src/pins/tang/clevis-encrypt-tang.1.adoc]

	[[Category:Security]] [[Category:Booting]]		[[Category:Security]] [[Category:Booting]]

Pursuable1652 at 00:59, 30 December 2024

2024-12-30T00:59:17Z

← Older revision		Revision as of 00:59, 30 December 2024
Line 76:		Line 76:
	* [https://www.admin-magazine.com/Archive/2018/43/Automatic-data-encryption-and-decryption-with-Clevis-and-Tang https://www.admin-magazine.com/Archive/2018/43/Automatic-data-encryption-and-decryption-with-Clevis-and-Tang]		* [https://www.admin-magazine.com/Archive/2018/43/Automatic-data-encryption-and-decryption-with-Clevis-and-Tang https://www.admin-magazine.com/Archive/2018/43/Automatic-data-encryption-and-decryption-with-Clevis-and-Tang]
	* [https://wiki.archlinux.org/title/Clevis https://wiki.archlinux.org/title/Clevis]		* [https://wiki.archlinux.org/title/Clevis https://wiki.archlinux.org/title/Clevis]
			* [https://man.archlinux.org/man/clevis-encrypt-tang.1.en https://man.archlinux.org/man/clevis-encrypt-tang.1.en]

	[[Category:Security]] [[Category:Booting]]		[[Category:Security]] [[Category:Booting]]

Pursuable1652 at 00:58, 30 December 2024

2024-12-30T00:58:23Z

← Older revision		Revision as of 00:58, 30 December 2024
Line 3:		Line 3:
	== What is clevis ==		== What is clevis ==
	It is a software that allows to encrypt/decrypt a disk by bounding to tang (network bound encryption/decryption) or a TPM (hardware chip encryption/decryption).		It is a software that allows to encrypt/decrypt a disk by bounding to tang (network bound encryption/decryption) or a TPM (hardware chip encryption/decryption).

			It is in use in redhat fedora systems

	== Why use clevis ==		== Why use clevis ==
	With tang, you may automatically decrypt device block/files for convenience, it is encrypted and built to prevent man-in-the-middle attacks as well.		With tang, you may automatically decrypt device block/files for convenience, it is encrypted and built to prevent man-in-the-middle attacks as well, since nobody gets private key, only an always changing advertised timed key.
	* It is recommended to use a tang docker with this		* It is recommended to use a tang docker with this

Pursuable1652 at 00:55, 30 December 2024

2024-12-30T00:55:32Z

← Older revision		Revision as of 00:55, 30 December 2024
Line 3:		Line 3:
	== What is clevis ==		== What is clevis ==
	It is a software that allows to encrypt/decrypt a disk by bounding to tang (network bound encryption/decryption) or a TPM (hardware chip encryption/decryption).		It is a software that allows to encrypt/decrypt a disk by bounding to tang (network bound encryption/decryption) or a TPM (hardware chip encryption/decryption).

			== Why use clevis ==
			With tang, you may automatically decrypt device block/files for convenience, it is encrypted and built to prevent man-in-the-middle attacks as well.
			* It is recommended to use a tang docker with this

	== Auto Disk decryption using clevis + tang ==		== Auto Disk decryption using clevis + tang ==

Pursuable1652 at 16:46, 25 December 2024

2024-12-25T16:46:50Z

← Older revision		Revision as of 16:46, 25 December 2024
Line 1:		Line 1:
	{{draft}}		{{draft}}

	==== What is clevis ====		== What is clevis ==
	It is a software that allows to encrypt/decrypt a disk by bounding to tang (network bound encryption/decryption) or a TPM (hardware chip encryption/decryption).		It is a software that allows to encrypt/decrypt a disk by bounding to tang (network bound encryption/decryption) or a TPM (hardware chip encryption/decryption).

	==== Auto Disk decryption using clevis + tang ====		== Auto Disk decryption using clevis + tang ==

	You need to run tang in a separate server, from the one you want to decrypt. I recommend running a tang server on a docker.		You need to run tang in a separate server, from the one you want to decrypt. I recommend running a tang server on a docker.
Line 66:		Line 66:
	{{todo\| write guide}}		{{todo\| write guide}}

	==== External sources ====		== External sources ==
	* [https://fedoramagazine.org/using-linux-system-roles-to-implement-clevis-and-tang-for-automated-luks-volume-unlocking/ https://fedoramagazine.org/using-linux-system-roles-to-implement-clevis-and-tang-for-automated-luks-volume-unlocking/]		* [https://fedoramagazine.org/using-linux-system-roles-to-implement-clevis-and-tang-for-automated-luks-volume-unlocking/ https://fedoramagazine.org/using-linux-system-roles-to-implement-clevis-and-tang-for-automated-luks-volume-unlocking/]
	* [https://www.admin-magazine.com/Archive/2018/43/Automatic-data-encryption-and-decryption-with-Clevis-and-Tang https://www.admin-magazine.com/Archive/2018/43/Automatic-data-encryption-and-decryption-with-Clevis-and-Tang]		* [https://www.admin-magazine.com/Archive/2018/43/Automatic-data-encryption-and-decryption-with-Clevis-and-Tang https://www.admin-magazine.com/Archive/2018/43/Automatic-data-encryption-and-decryption-with-Clevis-and-Tang]