Kowa's Blog

Automatic LUKS 2 disk decryption with TPM 2 on Fedora

Wed, 03 Jan 2024 00:00:00 GMT

Photo courtesy of George Becker

You just switched to Linux after years of Windows, and after setting up full disk encryption with LUKS2, you already miss one handy Windows feature: BitLocker and its automatic disk unlock.

Today we will learn how to approximate its behavior under the popular Linux distribution Fedora

If you are using an old version of Fedora, you must use clevis to bind the TPM2 (TPM 1.0 is not supported and never will be) key to the LUKS volume, but if you are using Fedora 35 or later, you can use the new systemd-cryptenroll command.

First chech for available TPM2 devices:

systemd-cryptenroll --tpm2-device=list

And check for Secure Boot status, you need to enable it in order to prevent tampering with the boot process:

mokutil --sb-state

If you have a TPM2 device, you can use the following command to bind the TPM2 key to the LUKS volume:

sudo systemd-cryptenroll --wipe-slot tpm2 --tpm2-device auto --tpm2-pcrs "0+1+2+3+4+5+7+9" /dev/nvme0n1p3

where --tpm2-pcrs is the list of PCRs to use for the binding, you can find more information about PCRs later in this article.

You need to update the /etc/crypttab file to unlock the volume at boot:

luks-7a02e564-b7fa-4837-a3ec-3b83752c3a20 UUID=1f7f5ba4-01f8-419e-ae48-5daaa69bd1e6 none discard,tpm2-device=auto

On earlier versions of Fedora (before 36), you may update dracut to include libtss2 in the initramfs:

Create a file /etc/dracut.conf.d/tss2.conf with the following content:

install_optional_items+=" /usr/lib64/libtss2* "

and then regenerate the initramfs:

dracut -f

You can also add a recovery key to the LUKS volume. It's the same as the normal key, but it's generated with higher entropy.

systemd-cryptenroll --recovery-key /dev/nvme0n1p3

Clevis installation and configuration

The things we need (besides the LUKS2 installation we already did) to accomplish this task are the Trusted Platform Module

First things first, we need to install the Clevis framework and the needed plugins with Fedora's DNF package manager with this simple command:

sudo dnf install clevis clevis-luks clevis-dracut clevis-udisks2 clevis-systemd

Then we need to find the LUKS volume to bind, we can use the tool lsblk to find the volume (In my case it was nvme0n1p3).

[kowalski7cc@Kaos ~]$ lsblk
NAME                                          MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINT
nvme0n1                                       259:0    0   477G  0 disk
├─nvme0n1p1                                   259:1    0   600M  0 part  /boot/efi
├─nvme0n1p2                                   259:2    0     1G  0 part  /boot
└─nvme0n1p3                                   259:3    0 475,4G  0 part
  └─luks-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 253:0    0 475,3G  0 crypt
    ├─fedora_localhost--live-root             253:1    0    70G  0 lvm   /
    ├─fedora_localhost--live-swap             253:2    0   7,8G  0 lvm   [SWAP]
    └─fedora_localhost--live-home             253:3    0 397,6G  0 lvm   /home

If we are right we should have an output like this using the tool cryptsetup:

[kowalski7cc@Kaos ~]$ sudo cryptsetup luksDump /dev/nvme0n1p3
[sudo] password di kowalski7cc:
LUKS header information
Version:        2
Epoch:          3
Metadata area:  16384 [bytes]
Keyslots area:  16744448 [bytes]
UUID:           xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
Label:          (no label)
Subsystem:      (no subsystem)
Flags:          (no flags)

PCR IDS

To make sure our boot has not tampered, we must choose some PCRs to validate against the boot.

Here is a table with the IDs and a small description of its usage:

PCR ID	Description
0	Firmware
1	Firmware configuration
2	Option ROMs
3	Option ROMs configuration
4	MBR
5	MBR Configuration
6	State transition
7	Platform-specific
8 - 15	Operating System reserved
16	Debug
23	Applications

Finally we can use the following command to set up the decryption key usin the TPM PCRs:

sudo clevis luks bind -d /dev/nvme0n1p3 tpm2 '{"pcr_ids":"0,1,2,3,4,5,6,7"}'

If it's correct, it will ask for your LUKS encryption password and add the Clevis key to the LUKS header.

Key upgrade procedure

When we do a kernel upgrade, probably our saved key will be invalidated. At this point, we need first to locate the Clevis key slot in the LUKS header.

We can use the command cryptsetup luksDump like before to locate it.

[kowalski7cc@Kaos ~]$  sudo cryptsetup luksDump /dev/nvme0n1p3
[sudo] password di kowalski7cc:
LUKS header information
Version:        2
Epoch:          7
...
Tokens:
  0: clevis
  Keyslot:  1
...

We can see that clevis is using Keyslot 1, so we can proceed with

sudo clevis luks unbind -d /dev/nvme0n1p3 -s 1

Then we can use sudo clevis luks bind... again to set up the new key.

Some notes and small thoughts about security

At the moment I've tested successfully Clevis only with GRUB
GRUB doesn't support measured boot, so it could be possible to tamper
You need a full trusted chain of boot, e.g. using secureboot
- You need to allow only your keys
- Oops! Microsoft Accidentally Leaks Backdoor Keys to Bypass UEFI Secure Boot
- Exploiting signed bootloaders to circumvent UEFI Secure Boot
TPM 2 has been proved to be unsafe when used alone
More things about secureboot, trustedboot, measuredboot

Systemd-boot install on Fedora 32 (Updated for Fedora 40)

Wed, 03 Jan 2024 00:00:00 GMT

Systemd logo

Since many years, GRUB has been the default manager of every Linux distribution. This until systemd-boot has born, allowing easier configuration and promising enhanced security for our devices.

Let's see how to install it on Fedora 32 or Fedora 40

If you're planning to install Fedora 39 or more recent, you can directly configure anaconda to use systemd-boot as bootloader, adding the following argument in the boot command line:

inst.sdboot

you can check the details on the Fedora 39 documentation and the Change on the Fedora Wiki.

This still not covers booting with secure boot enabled, you will need to enroll your own keys. You can use a tool like sbctl to do that.

Take you responsabilities first

I am not responsible for bricked computers, system instabilities, dead cats, thermonuclear war or you getting fired because you lost important work.

Please make a backup of your device or of the data, and make a boot drive in case of necessity. Do some research if you have any concerns about steps documented in this guide.

YOU are choosing to make these modifications, and if you point the finger at me for messing up your device, I will laugh at you.

Check if you are running EFI

Before doing anything, you should check that you are running using EFI, and if you have Secure Boot enabled, you may want to turn it off now.

To do that, you can use the following one-liner:

test -d /sys/firmware/efi && echo EFI || echo Legacy

If the result of the command will be "EFI", you're good to go with this guide.

Move ESP mount to /efi

First of all, we need to move the ESP partition from /boot/efi to /efi

Let's start by creating the folder for EFI mount point

sudo mkdir /efi

You can use Vim (or any other text editor you like) to edit the fstab file using this command:

sudo cp /etc/fstab /etc/fstab.bak # (Make a backup first if you are unsure)
sudo vi /etc/fstab

Edit the line by entering in "insert mode" by pressing the "i" button

UUID=xxxx-xxxx    /boot/efi    vfat    umask=0077,shortname=winnt 0 2

to:

UUID=xxxx-xxxx    /efi    vfat    umask=0077,shortname=winnt 0 2

Press the esc button to return to normal mode, followed by ":wq" to save the modified file and quit.

If you edited correctly you should be able to run successfully the following commands to unmount the efi partition and mount it to the new path:

sudo systemctl daemon-reload
sudo umount /boot/efi
sudo umount /boot
sudo mount /efi

After this you will be able to cleanup the boot partition as well.

Install systemd-boot

The firts step is to create a folder in the ESP directory with the machine-id in the name

sudo mkdir /efi/$(cat /etc/machine-id)

If you have Fedora 34+, you need to remove GRUB from DNF's protected packages

sudo rm /etc/dnf/protected.d/{grub,shim}*

install systemd-boot and then uninstall GRUB related packages.

sudo dnf remove -y grubby grub2\* memtest86\* && sudo rm -rf /boot/*
sudo dnf install -y systemd-boot-unsigned sdubby

Do not reboot after this, or you will not be able to boot!

Edit the file /etc/kernel/install.conf to have tge following content:

BOOT_ROOT=/efi
layout=bls

We can delete the boot partition using parted and resize the esp partition. Pay attention to this step, as deleted partitions are (usually) unrecoverable. By default Fedora should create the first partition arount 500-600MB in VFAT for EFI/ESP and the second partition around 1-1.5GB for boot. With this layout you can safely delete the second one and grow the first. Your partition table may differ, you can check this with parted /dev/YOUR_DISK print.

In my case the system disk is /dev/vda:

sudo parted /dev/vda rm 2
sudo umount /dev/vda1
sudo growpart /dev/vda 1
sudo mount /efi

If you have used a custom partition layout, you will know how to proceed, good luck!

Now we can install the bootloader and the kernel entries:

cat /proc/cmdline | cut -d ' ' -f 2- | sudo tee /etc/kernel/cmdline
sudo bootctl install
sudo kernel-install add $(uname -r) /lib/modules/$(uname -r)/vmlinuz
sudo dnf reinstall kernel-core

If everyting installs correcry, now you can reboot, and you should boot normally using systemd-boot

You can verify everything working correctly with

sudo bootctl

You can use sbctl to setup Secure Boot signature with sistemd boot and enroll your keys.

Enjoy systemd-boot!

systemd-boot running inside GNOME Boxes

Sources

Thanks to all these people for their guides and tips:

Top userful JavaScript shorthands

Mon, 23 Aug 2021 00:00:00 GMT

The if-else shorthand

if (age < 18) {
  console.log("You cannot drive in some states");
} else {
  console.log("You can drive in some states");
}

shorthand:

console.log(
  age < 18
    ? "Non You cannot drive in some states"
    : "You can drive in some states"
);

react:

<div>
  {age < 18 ? (
    <Button disabled>You cannot drive</Button>
  ) : (
    <Button>Book your exam</Button>
  )}
</div>

Spread Operator Shorthand

let numbers = [2, 3];
let fullNumbers = [1, ...numbers, 4, 5];

react:

function GreetingFunction() {
  return <Greeting firstName='Kowalski' lastName='Dragon' />;
}

becomes

function GreetingFunction() {
  const props = { firstName: "Kowalski", lastName: "Dragon" };
  return <Greeting {...props} />;
}

Destructuring

let people = ["Max", "Anna", "Tom"];
let [firstBoy, , secondBoy] = people;
firstBoy; // Max
secondBoy; // Tom

Or Short-circuit Evaluation

if (variable1 !== null || variable1 !== undefined || variable1 !== "") {
  let variable2 = variable1;
} else {
  let variable2 = "new";
}

shorthand:

const variable2 = variable1 || "new";

Object Property Shorthand

const x = 1920,
  y = 1080;
const obj = { x: x, y: y };

shorthand:

const obj = { x, y };

Arrow Functions Shorthand

function sayHello(name) {
  console.log("Hello", name);
}

setTimeout(function () {
  console.log("Loaded");
}, 2000);

list.forEach(function (item) {
  console.log(item);
});

shorthand:

sayHello = (name) => console.log("Hello", name);

setTimeout(() => console.log("Loaded"), 2000);

list.forEach((item) => console.log(item));

Implicit Return Shorthand

function calcCircumference(diameter) {
  return Math.PI * diameter;
}

shorthand:

calcCircumference = diameter => (
  Math.PI * diameter;
)

Default Parameter Values

function volume(l, w, h) {
  if (w === undefined) w = 3;
  if (h === undefined) h = 4;
  return l * w * h;
}

shorthand:

volume = (l, w = 3, h = 4) => l * w * h;
volume(2); //output: 24

And shorthand with implicit return and arrow function

function isNotEmpty(arr) {
  if (Array.isArray(arr) && arr.length > 0) {
    return true;
  } else {
    return false;
  }
}

shorthand:

const isNotEmpty = (arr) => Array.isArray(arr) && arr.length > 0;

react:

<div>{articles > 0 && <ul>...</ul>}</div>

Template Literals

const welcome = "You have logged in as " + first + " " + last + ".";
const db = "http://" + host + ":" + port + "/" + database;

const welcome = `You have logged in as ${first} ${last}`;
const db = `http://${host}:${port}/${database}`;

Sources

Gain back the control of your browser

Thu, 17 Jun 2021 00:00:00 GMT

Image by 200 Degrees from Pixabay

Some sites decided that, for security or whatever any other reasons, you should not use certain browser functionalities. We can change that behaveaur using bookmarklets, bookmarks you can store in your web browser that contains some JavaScript that add new features to it.

Just add them to your favorites, and "press" on them when you need them!

Some userful bookmarklets

To add a bookmarklets to your browser, drag and drop the link in your favourites bar or add a new bookmark using the "minified bookmarklet version" as the url of the bookmark.

Allow Paste

Source:

var allowPaste = function (e) {
  e.stopImmediatePropagation();
  return true;
};
document.addEventListener("paste", allowPaste, true);

Minified bookmarklet version:

javascript: void document.addEventListener(
  "paste",
  function (t) {
    return t.stopImmediatePropagation(), !0;
  },
  !0
);

Right Click

Code:

javascript:void(document.oncontextmenu = null))

Text Selection

Source:

function R(a) {
  ona = "on" + a;
  if (window.addEventListener)
    window.addEventListener(
      a,
      function (e) {
        for (var n = e.originalTarget; n; n = n.parentNode) n[ona] = null;
      },
      true
    );
  window[ona] = null;
  document[ona] = null;
  if (document.body) document.body[ona] = null;
}
R("click");
R("mousedown");
R("mouseup");
R("selectstart");

Minified bookmarklet version:

javascript: (function () {
  function R(n) {
    (ona = "on" + n),
      window.addEventListener &&
        window.addEventListener(
          n,
          function (n) {
            for (var o = n.originalTarget; o; o = o.parentNode) o[ona] = null;
          },
          !0
        ),
      (window[ona] = null),
      (document[ona] = null),
      document.body && (document.body[ona] = null);
  }
  R("click"), R("mousedown"), R("mouseup"), R("selectstart");
})();

Sources:

My homelab

Thu, 19 Sep 2019 00:00:00 GMT

"The Rack"

What is packed inside my rack

Ubiquiti USG 4 Pro
Patch Panel
Cable organizer
Ubiquiti UniFi Switch 16 PoE
Tim Hub
Tado° Smart Thermostat
Dell R210 II
- Intel Xeon E3 1265l V2
- 16GB ECC Buffered
- 2x 3TB WD Red
- Samsung 860 Evo 250GB SSD
UPS CyberPower 900VA

Total power usage: Less than 120 Watts!

Server Dell R210 II

Happy homelabbing everyone!

My battlestation

Tue, 17 Sep 2019 00:00:00 GMT

My battlestation

What is on my desk

Dell XPS 13 9350
- Intel Core i7 6560U
- Samsung 500GB SSD NVMe
- 16GB DDR3l
- 4K touch display
Edifier Luna Eclipse
Dell WD15 Dock
AOC 23" FHD 3D monitor
~~Google~~ Nest Home Mini
Logitech Keyboard K810
Logitech MX Master mouse
Kysoh TuxDroid

My penguin robot, TuxDroid

That's it :)