Skip to content
Snippets Groups Projects
Verified Commit b42ebd59 authored by Robotka István Adrián's avatar Robotka István Adrián
Browse files

improved passphrase-from-tpm

parent c176c241
No related branches found
No related tags found
No related merge requests found
...@@ -12,6 +12,7 @@ sudo apt install tpm2-tools ...@@ -12,6 +12,7 @@ sudo apt install tpm2-tools
sudo cp passphrase-from-tpm /usr/local/bin/passphrase-from-tpm sudo cp passphrase-from-tpm /usr/local/bin/passphrase-from-tpm
sudo cp initramfs-hook /etc/initramfs-tools/hooks/tpm2 sudo cp initramfs-hook /etc/initramfs-tools/hooks/tpm2
# add to your crypttab: ",keyscript=/usr/local/bin/passphrase-from-tpm"
sudo nano /etc/crypttab sudo nano /etc/crypttab
sudo update-initramfs -u sudo update-initramfs -u
reboot reboot
......
#!/bin/sh #!/bin/sh
# halt on error
set -e set -e
echo "Unlocking via TPM" >&2
export TPM2TOOLS_TCTI="device:/dev/tpm0"
/usr/local/bin/tpm2_unseal --object-context 0x81000000 --auth pcr:sha256:0,5,7
[ $? -eq 0 ] && exit # successful TPM unseal LOCK="/tmp/tpm_unlock"
#export TPM2TOOLS_TCTI="device:/dev/tpm0"
user_pass() {
/lib/cryptsetup/askpass \
"Unlocking the disk fallback $CRYPTTAB_SOURCE ($CRYPTTAB_NAME)\nEnter passphrase: "
}
/lib/cryptsetup/askpass "Unlocking the disk fallback $CRYPTTAB_SOURCE ($CRYPTTAB_NAME)\nEnter passphrase: " tpm_pass() {
/usr/local/bin/tpm2_unseal \
--object-context 0x81000000 \
--auth pcr:sha256:0,5,7 \
| tr -d '\n'
}
if [ -e "$LOCK" ]; then
user_pass
else
echo 1 > $LOCK
echo "Unlocking via TPM" >&2
tpm_pass
[ $? -eq 0 ] && exit # successful TPM unseal
user+pass
fi
...@@ -108,4 +108,8 @@ fi ...@@ -108,4 +108,8 @@ fi
log "Profit" log "Profit"
echo "Generated LUKS key: $(cat $LUKS_PASS)" echo "Generated LUKS key: $(cat $LUKS_PASS)"
echo "Run: cryptsetup luksAddKey /dev/sda42" echo "Do NOT forget to delete folder: $BASE"
echo "!!!!!!!"
echo "! Run: cryptsetup luksAddKey /dev/sda42"
echo "!!!!!!!"
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment