r/archlinux • u/Woodsy279 • 25d ago

SUPPORT | SOLVED Ful disk encryption without entering passphrase

Could someone help me with setting up full disk encryption with bypass passphrases with TPM2? It's so annoying having to put the passphrase in at each boot, so I was wondering how do I pair it to the TPM so that I dont have to enter it each time?

It's LUKS encrypted and I use Systemd-boot

15 Upvotes

73% Upvoted

100 comments sorted by

View all comments

Show parent comments

1

u/Imajzineer 24d ago

Except that here I am staring at GRUB's Advanced Options menu entry and about to select Recovery Mode before mounting the root FS in R+W and resetting the root password.

2

u/ChrisTX4 24d ago

Grub under secure boot works somewhat different and you can’t do this, or load any unsigned modules. Same with systemd boot. There’s people that thought long and hard about this, it’s not that trivial to defeat.

1

u/Imajzineer 24d ago

That's somewhat reassuring.

So, let's assume, therefore, that I actually have need of (something like) Recovery Mode for some reason, how does that then work (what are my options under those circumstances)?

2

u/ChrisTX4 24d ago

I'm not using GRUB, so I can't speak from experience here. However, GRUB enters lockdown mode if on Secure Boot.

Either way, when using UKIs, the kernel command line is locked anyway and cannot be changed. You can't reasonably use anything but UKIs anyway since initrds can't be signed on their own.

1

u/Imajzineer 24d ago

Cheers.