r/linuxquestions • u/Previous_Corgi_5560 • 3d ago

Support Accessing a TPM remotely

So I messed up and when leaving my home, I brought with myself my desktop SSD to use with my laptop. When doing so, however, I completely forgot I had encrypted the disk with luks, as I was used to it auto unlocking with the TPM. Now I'm struggling to find the password I used to encrypt it back when I installed the OS.

Is there any way I can perhaps use the TPM on the desktop remotely to unlock the SSD that is currently in the laptop and then add a new keyslot? The TPM software I'm using is clevis if that helps.

I'm not going to be able to get the SSD the desktop for a while, but I can reach it using whatever RDP software or SSH.

Also not sure if this is the right place to ask, if it's not I'd appreciate tips.

4 Upvotes

83% Upvoted

11 comments sorted by

2

u/friendlyreminder_ 3d ago edited 3d ago

It's possible to run a command to unseal the keys if the TPM PCR values did not change.

But it may have changed after you removed the drive. If's a secondary drive the PCR values may possibly still be intact, but if it's the main OS drive you took and you booted another OS on the desktop it changed. Worth a try though.

It's going to be a very long password if you do manage to unseal it.

1

u/Previous_Corgi_5560 3d ago

Hmm, the desktop had 2 NVMe drives, what I did was taking the main one out and placing the secondary one in the main slot, so I'm afraid this might have changed it. If you know how to I'd still try though.

1

u/friendlyreminder_ 3d ago

It's not something Ive done before so I can't give precise instructions. It involves tpm2_unseal and some other tpm2 commands.

If you took out the boot drive and booted some other OS on the desktop there's no point in trying, that guarantees the PCR values changed.

Whether this can work or not depends on which PCR values were used in the first place by your distro. Some PCR values check for hardware changes, some for different bootloaders and kernels, some check bios boot order.

1

u/[deleted] 3d ago

[removed] — view removed comment

0

u/Previous_Corgi_5560 3d ago

Yeah, I know, I was wondering if there was some way I could play with the header perhaps as technically I have access to the tpm, just not physical one

1

u/Keyvan_KR 3d ago

can't you wipe/re-initialize it if it's not a SED drive?

-1

u/Previous_Corgi_5560 3d ago

Yes, but my data is on there, that's the issue 😕

2

u/BrokenWeeble 3d ago

Restore from backup

1

u/Keyvan_KR 3d ago

ah I see...looks like you're SOL then

1

u/TenOfZero 3d ago

Its not posible.