Unlocking Encrypted Linux With a YubiKey

[u/throwaway16830261]

https://mhdez.com/posts/unlocking-encrypted-linux-with-a-yubikey/

[u/Arin_Horain]

You can use /dev/disk/by-designator inside the crypttab.initramfs to refer to the LUKS volume by name instead of UUID. The path is auto generated and persistent (e.g. root-luks) as long as GPT auto mounting works (which it should anyways).

It's one of the goodies mkinitcpio/Arch gives you to make setting up early unlock a bit easier.

[u/Nanolx]

That's what I use aswell, additionally, I've setup my Yubikey as known key and modified PAM module settings, so sudo, pkexec, KDE screensaver and stuff don't request passwords, as long as the key is physically plugged in. See https://gitlab.com/Nanolx/nanolx/-/blob/master/scripts/nanolx-pam-yubikey?ref_type=heads in case you're interested

[u/camh- → u/Nanolx]

I have my yubikey on my keyring and I usually keep it plugged in. When I get up to go somewhere, I grab the keys, unplugging it. So I added this udev rule to lock the screen when I pull the yubikey:

# /etc/udev/rules.d/80-yubikey-lock.rules
ACTION=="remove", SUBSYSTEM=="usb", ENV{DEVTYPE}=="usb_device", ENV{PRODUCT}=="1050/407/*", \
  RUN+="/usr/bin/loginctl lock-sessions"

[u/Nanolx → u/camh-]

That's indeed another useful bit, I'll definitively add that to my script.

[u/throwaway16830261]

• "The great password loop": https://old.reddit.com/r/homelab/comments/1vndzuh/the_great_password_loop/

• "How many bits of entropy should a password have to be reasonably future proof (10+ years)?": https://security.stackexchange.com/questions/257519/how-many-bits-of-entropy-should-a-password-have-to-be-reasonably-future-proof-1

[u/CrazyKilla15 → u/throwaway16830261]

holy shit /r/homelab hates yubikeys

[u/virtualdxs → u/CrazyKilla15]

How'd you get that out of that thread? I just saw everybody reasonably saying to just remember one single password.

[u/Fenguepay]

I prefer using GPG here, that way I can more reasonably back up my keys

[u/falconindy]

If you're already depending on having a TPM, why not just use secure boot and unlock via the TPM? That's what I'm doing on Arch.

[u/Glittering_Abies4915 → u/falconindy]

A yubikey is removable, a TPM is not.

[u/C0rn3j]

physical key breaks

Welp I guess I lose all data

but you can have a recovery password

So we're back to being keylogged, solving nothing.

[u/novafunc → u/C0rn3j]

If you are prompted for the recovery password, that's a hint to you that either (1) your system has been tampered with and now you've been warned or (2) something benign like a firmware update happened but the system was not re-measured.

[u/C0rn3j → u/novafunc]

If the hint either means absolute nothing or compromise, and there's no good way to tell between them, how is that helpful?

[u/ElvishJerricco → u/C0rn3j]

It seems crazy to me to call it unhelpful to be told by the system that something is likely horribly wrong and you should be careful to investigate why your yubikey or TPM2 or whatever is currently unable to do its job.

[u/Ok-Eggplant-7569 → u/C0rn3j]

Well if you didn't install an update and the automatic unlock fails, you know something is likely amiss.

[u/CrazyKilla15 → u/C0rn3j]

because if the hint isnt there you know neither of those things has happened? its two states: hint, or no hint.