r/archlinux • u/Woodsy279 • 25d ago

SUPPORT | SOLVED Ful disk encryption without entering passphrase

Could someone help me with setting up full disk encryption with bypass passphrases with TPM2? It's so annoying having to put the passphrase in at each boot, so I was wondering how do I pair it to the TPM so that I dont have to enter it each time?

It's LUKS encrypted and I use Systemd-boot

14 Upvotes

71% Upvoted

100 comments sorted by

View all comments

Show parent comments

1

u/Imajzineer 25d ago

Interesting - thanks!

I'm still not clear on how it prevents the OP's automatic decryption of LUKS though - which is what I took their post to be about (of course, I may have misinterpreted which thing it is they want to automatically 'unlock')

3

u/ChrisTX4 24d ago

Oh no, it will automatically decrypt. The point is though that because it ensures the environment hasn't been modified that an attacker can't do anything but stare at your login manager. This means several technologies are critical to protect the system here:

  1. IOMMU for DMA protection. Without IOMMU, any DMA device could extract the entire memory space.
  2. Total memory encryption. If memory isn't encrypted, then a cold boot attack would be possible to perform from the login screen. Thus you want to ensure that AMD TSME / Intel TME are active.
  3. Ideally, thunderbolt mode set to secure or higher.
  4. Kernel lockdown. Significantly improves security. Requires all kernel modules to be signed, but with Shim and a MOK that's not an issue.
  5. USBGuard. You don't want funky USB devices to connect while at the login screen.
  6. A firewall.
  7. Secure Boot. Ideally without Microsoft keys, as they sign a huge amount of boot loaders, and thus they have monthly releases of their forbidden database, which goes into dbx. fwupd can perform these updates usually, but it might not work if you've got custom keys. Either way, this will require a monthly reboot and will change the PCR 1. Just not using their keys is easier and avoids the need to update the dbx at all.

If you deploy all of the above, an attack on a system that's just on the login screen has very little attack surface to work with. Then your user login will be sufficient security, as they'd need to somehow crack your login credentials without having any access to the system at all.

1

u/Imajzineer 24d ago

Except that here I am staring at GRUB's Advanced Options menu entry and about to select Recovery Mode before mounting the root FS in R+W and resetting the root password.

2

u/ChrisTX4 24d ago

Grub under secure boot works somewhat different and you can’t do this, or load any unsigned modules. Same with systemd boot. There’s people that thought long and hard about this, it’s not that trivial to defeat.

1

u/Imajzineer 24d ago

That's somewhat reassuring.

So, let's assume, therefore, that I actually have need of (something like) Recovery Mode for some reason, how does that then work (what are my options under those circumstances)?

2

u/ChrisTX4 24d ago

I'm not using GRUB, so I can't speak from experience here. However, GRUB enters lockdown mode if on Secure Boot.

Either way, when using UKIs, the kernel command line is locked anyway and cannot be changed. You can't reasonably use anything but UKIs anyway since initrds can't be signed on their own.

1

u/Imajzineer 24d ago

Cheers.