Ubuntu 20.04 clevis-luks setup auto unlocking not working
5
votes
1
answer
5212
views
I have an Ubuntu 20.04 machine setup that I am trying to configure for disk encryption. I am trying to setup auto unlock, but my configuration has not worked so far, and I am always prompted for a password.
To do this I followed the following steps:
1.
sudo apt-get update
and sudo apt-get install cryptsetup
2. Check /dev/nvme0n1p3 -> sudo cryptsetup luksDump /dev/nvme0n1p3
-> No Tokens or Keyslots
3. Install clevis
, clevis-luks
, clevis-dracut
, clevis-udisks2
, clevis-systemd
, clevis-tpm2
4. sudo clevis luks list -d /dev/nvme0n1p3
-> Empty
5. echo | sudo clevis luks bind -d /dev/nvme0n1p3 tpm2 '{ "pcr_bank":"sha256", "pcr_ids": "7,11" }'
6. sudo dracut -fv --regenerate-all
7. Check sudo clevis luks list -d /dev/nvme0n1p3
-> 1: tpm2 '{"hash":"sha256","key":"ecc","pcr_bank":"sha256","pcr_ids":"7,11"}'
8. lsblk -o NAME,UUID,MOUNTPOINT
->
├─nvme0n1p1 /boot/efi
├─nvme0n1p2 /boot
└─nvme0n1p3
└─dm_crypt-0
└─ubuntu--vg-ubuntu--lv /
9. cat /etc/crypttab
-> dm_crypt-0 UUID= none luks
When booting I do not notice any errors for cryptsetup, luks, tpm2. Googling around and checking others questions, I have also verified tried:
1. sudo systemctl enable clevis-luks-askpass.path
2. update-initramfs -c -k all
-> Runs successfully
My fstab file doesn't actually list the encrypted partition:
cat /etc/fstab
->
# /etc/fstab: static file system information.
#
# Use 'blkid' to print the universally unique identifier for a
# device; this may be used with UUID= as a more robust way to name devices
# that works even if disks are added and removed. See fstab(5).
#
#
# / was on /dev/ubuntu-vg/ubuntu-lv during curtin installation
/dev/disk/by-id/ / ext4 defaults 0 1
# /boot was on /dev/nvme0n1p2 during curtin installation
/dev/disk/by-uuid/ /boot ext4 defaults 0 1
# /boot/efi was on /dev/nvme0n1p1 during curtin installation
/dev/disk/by-uuid/ /boot/efi vfat defaults 0 1
/swap.img none swap sw 0 0
I've also tried manually adding in the partition to fstab but did not work.
No matter what I try, it always asks for password on boot.
What could I do to fix this?
Asked by Niru
(161 rep)
Jun 3, 2022, 12:10 AM
Last activity: Jun 6, 2022, 11:10 PM
Last activity: Jun 6, 2022, 11:10 PM