Clevis: Difference between revisions
mNo edit summary |
mNo edit summary |
||
| Line 1: | Line 1: | ||
{{draft}} | {{draft}} | ||
== What is clevis == | |||
It is a software that allows to encrypt/decrypt a disk by bounding to tang (network bound encryption/decryption) or a TPM (hardware chip encryption/decryption). | It is a software that allows to encrypt/decrypt a disk by bounding to tang (network bound encryption/decryption) or a TPM (hardware chip encryption/decryption). | ||
== Auto Disk decryption using clevis + tang == | |||
You need to run tang in a separate server, from the one you want to decrypt. I recommend running a tang server on a docker. | You need to run tang in a separate server, from the one you want to decrypt. I recommend running a tang server on a docker. | ||
| Line 66: | Line 66: | ||
{{todo| write guide}} | {{todo| write guide}} | ||
== External sources == | |||
* [https://fedoramagazine.org/using-linux-system-roles-to-implement-clevis-and-tang-for-automated-luks-volume-unlocking/ https://fedoramagazine.org/using-linux-system-roles-to-implement-clevis-and-tang-for-automated-luks-volume-unlocking/] | * [https://fedoramagazine.org/using-linux-system-roles-to-implement-clevis-and-tang-for-automated-luks-volume-unlocking/ https://fedoramagazine.org/using-linux-system-roles-to-implement-clevis-and-tang-for-automated-luks-volume-unlocking/] | ||
* [https://www.admin-magazine.com/Archive/2018/43/Automatic-data-encryption-and-decryption-with-Clevis-and-Tang https://www.admin-magazine.com/Archive/2018/43/Automatic-data-encryption-and-decryption-with-Clevis-and-Tang] | * [https://www.admin-magazine.com/Archive/2018/43/Automatic-data-encryption-and-decryption-with-Clevis-and-Tang https://www.admin-magazine.com/Archive/2018/43/Automatic-data-encryption-and-decryption-with-Clevis-and-Tang] | ||
Revision as of 16:46, 25 December 2024
 Do not follow instructions here until this notice is removed. |
What is clevis
It is a software that allows to encrypt/decrypt a disk by bounding to tang (network bound encryption/decryption) or a TPM (hardware chip encryption/decryption).
Auto Disk decryption using clevis + tang
You need to run tang in a separate server, from the one you want to decrypt. I recommend running a tang server on a docker.
mkinitfs + kernel-hooks + secureboot-hook
Using mkinitfs, it is possible to force tang/clevis in initramfs generation. It is recommended to make a chroot or docker so you don't mess with your system files, and by adding these files:
apk add cryptsetup
Edit /sbin/mkinitfs (put "# Copy custom init" before "# copy modloop signature"):
Contents of /etc/mkinitfs
PUT "# Clevis + tang script" AFTER "ebegin "Mounting root""
Contents of /initramfs/init
Contents of /etc/mkinitfs/features.d/curl.files
Contents of /etc/mkinitfs/features.d/clevis.files
Contents of /etc/mkinitfs/mkinitfs.conf
Then just do:
apk add secureboot-hook gummiboot gummiboot-efistub efibootmgr kernel-hooks secureboot-hook
mkinitfs -c /etc/mkinitfs/mkinitfs.conf -b / $(uname -r)
Decompress:
mkdir /tmp/initramfs cd /tmp/initramfs zcat /boot/initramfs-$KERNEL | cpio -idmv
Test if "init" works by just executing it and see how it runs:
./init
dracut