Clevis: Difference between revisions
(Created page with "{{draft}} ==== What is clevis ==== It is a software that allows to encrypt/decrypt a disk by bounding to tang (network bound encryption/decryption) or a TPM (hardware chip encryption/decryption). ==== Auto Disk decryption using clevis + tang ==== You need to run tang in a separate server, from the one you want to decrypt. I recommend running a tang server on a docker. === mkinitfs + kernel-hooks + secureboot-hook === {{todo| write guide}} Using mkinitfs, it is possi...") |
mNo edit summary |
||
| (9 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
{{draft}} | {{draft}} | ||
== What is clevis == | |||
It is a software that allows to encrypt/decrypt a disk by bounding to tang (network bound encryption/decryption) or a TPM (hardware chip encryption/decryption). | It is a software that allows to encrypt/decrypt a disk by bounding to tang (network bound encryption/decryption) or a TPM (hardware chip encryption/decryption). | ||
==== Auto Disk decryption using clevis + tang | It is in use in redhat fedora systems | ||
== Why use clevis == | |||
With tang, you may automatically decrypt device block/files for convenience, it is encrypted and built to prevent man-in-the-middle attacks as well, since nobody gets private key, only an always changing advertised timed key. | |||
* It is recommended to use a tang docker with this, you can use this for example: [https://github.com/padhi-homelab/services/blob/master/tang/docker-compose.yml github] or [https://gitlab.com/AdrianKoshka/tang-docker-container/ gitlab] | |||
== Auto Disk decryption using clevis + tang == | |||
You need to run tang in a separate server, from the one you want to decrypt. I recommend running a tang server on a docker. | You need to run tang in a separate server, from the one you want to decrypt. I recommend running a tang server on a docker. | ||
| Line 29: | Line 35: | ||
...}} | ...}} | ||
PUT "# | PUT "# Clevis + tang script" AFTER "ebegin "Mounting root"" | ||
{{cat| /initramfs/init|... | {{cat| /initramfs/init|... | ||
| Line 46: | Line 52: | ||
features{{=}}"... curl clevis" | features{{=}}"... curl clevis" | ||
...}} | ...}} | ||
Then just do: | Then just do: | ||
| Line 72: | Line 72: | ||
{{todo| write guide}} | {{todo| write guide}} | ||
== External sources == | |||
* [https://fedoramagazine.org/using-linux-system-roles-to-implement-clevis-and-tang-for-automated-luks-volume-unlocking/ https://fedoramagazine.org/using-linux-system-roles-to-implement-clevis-and-tang-for-automated-luks-volume-unlocking/] | * [https://fedoramagazine.org/using-linux-system-roles-to-implement-clevis-and-tang-for-automated-luks-volume-unlocking/ https://fedoramagazine.org/using-linux-system-roles-to-implement-clevis-and-tang-for-automated-luks-volume-unlocking/] | ||
* [https://www.admin-magazine.com/Archive/2018/43/Automatic-data-encryption-and-decryption-with-Clevis-and-Tang https://www.admin-magazine.com/Archive/2018/43/Automatic-data-encryption-and-decryption-with-Clevis-and-Tang] | * [https://www.admin-magazine.com/Archive/2018/43/Automatic-data-encryption-and-decryption-with-Clevis-and-Tang https://www.admin-magazine.com/Archive/2018/43/Automatic-data-encryption-and-decryption-with-Clevis-and-Tang] | ||
* [https://wiki.archlinux.org/title/Clevis https://wiki.archlinux.org/title/Clevis] | |||
* [https://man.archlinux.org/man/clevis-encrypt-tang.1.en https://man.archlinux.org/man/clevis-encrypt-tang.1.en] | |||
* [https://github.com/latchset/clevis/blob/master/src/pins/tang/clevis-encrypt-tang.1.adoc https://github.com/latchset/clevis/blob/master/src/pins/tang/clevis-encrypt-tang.1.adoc] | |||
[[Category:Security]] [[Category:Booting]] | |||
Latest revision as of 01:02, 30 December 2024
 Do not follow instructions here until this notice is removed. |
What is clevis
It is a software that allows to encrypt/decrypt a disk by bounding to tang (network bound encryption/decryption) or a TPM (hardware chip encryption/decryption).
It is in use in redhat fedora systems
Why use clevis
With tang, you may automatically decrypt device block/files for convenience, it is encrypted and built to prevent man-in-the-middle attacks as well, since nobody gets private key, only an always changing advertised timed key.
Auto Disk decryption using clevis + tang
You need to run tang in a separate server, from the one you want to decrypt. I recommend running a tang server on a docker.
mkinitfs + kernel-hooks + secureboot-hook
Using mkinitfs, it is possible to force tang/clevis in initramfs generation. It is recommended to make a chroot or docker so you don't mess with your system files, and by adding these files:
apk add cryptsetup
Edit /sbin/mkinitfs (put "# Copy custom init" before "# copy modloop signature"):
Contents of /etc/mkinitfs
PUT "# Clevis + tang script" AFTER "ebegin "Mounting root""
Contents of /initramfs/init
Contents of /etc/mkinitfs/features.d/curl.files
Contents of /etc/mkinitfs/features.d/clevis.files
Contents of /etc/mkinitfs/mkinitfs.conf
Then just do:
apk add secureboot-hook gummiboot gummiboot-efistub efibootmgr kernel-hooks secureboot-hook
mkinitfs -c /etc/mkinitfs/mkinitfs.conf -b / $(uname -r)
Decompress:
mkdir /tmp/initramfs cd /tmp/initramfs zcat /boot/initramfs-$KERNEL | cpio -idmv
Test if "init" works by just executing it and see how it runs:
./init
dracut
External sources
- https://fedoramagazine.org/using-linux-system-roles-to-implement-clevis-and-tang-for-automated-luks-volume-unlocking/
- https://www.admin-magazine.com/Archive/2018/43/Automatic-data-encryption-and-decryption-with-Clevis-and-Tang
- https://wiki.archlinux.org/title/Clevis
- https://man.archlinux.org/man/clevis-encrypt-tang.1.en
- https://github.com/latchset/clevis/blob/master/src/pins/tang/clevis-encrypt-tang.1.adoc