documentation for full-disk-encryption with FIDO2 - #618
Conversation
…e requirements and fixed formatting issues.
|
|
||
| - libfido2 / fido2-tools | ||
|
|
||
| - initramfs-tools |
There was a problem hiding this comment.
I think these whitelines between each bullet point are not necessary.
| @@ -0,0 +1,158 @@ | |||
| Full-Disk Encryption with cryptsetup/LUKS | |||
There was a problem hiding this comment.
Set the scope to Linux at the beginning or better in the title e.g. call it "Linux Full-Disk Encryption". Also align the file name with the title better.
|
|
||
| - at least one LUKS-encrypted volume | ||
|
|
||
| - a FIDO2 capable Nitrokey with FIDO2 PIN |
There was a problem hiding this comment.
I understand you mean the FIDO2 PIN has to be set. This could be easily misunderstood. Maybe better to mention this explicitly and refer to appropriate instructions.
| FIDO2 security keys like the Nitrokey 3 and Nitrokey Passkey to unlock | ||
| LUKS-encrypted volumes. Once you finish the setup, you will just need to insert | ||
| your Nitrokey at boot and enter your User PIN, instead of typing in your | ||
| regular disk encryption passphrase. |
| Get the partition with the "dm_crypt-0" in it. For example "/dev/nvme0n1p3". | ||
|
|
||
|
|
||
| 2. Add a Nitrokey security token |
There was a problem hiding this comment.
I think it is mostly called "security key".
| .. code-block:: bash | ||
|
|
||
|
|
||
| $ sudo nano /etc/crypttab |
There was a problem hiding this comment.
Use "editor" instead of a certain editor.
| $ sudo cryptsetup luksChangeKey <disk-device-name> | ||
|
|
||
| Use Multiple Nitrokeys | ||
| ^^^^^^^^^^^^^^^^^ |
|
|
||
| .. code-block:: bash | ||
|
|
||
| $ sudo systemd-cryptenroll --fido2-device=auto <disk-device-name> |
There was a problem hiding this comment.
Editing crypttab again is not requrired?
| Delete Nitrokeys | ||
| ^^^^^^^^^^^^^^^^^^^ | ||
|
|
||
| If you want to remove a Nitrokey e.g. because it got lost you will need to delete all Nitrokeys and add them again. |
There was a problem hiding this comment.
be more precise what "them" means. Maybe "the Nitrokeys you want to keep using"
|
|
||
| If you want to remove a Nitrokey e.g. because it got lost you will need to delete all Nitrokeys and add them again. | ||
|
|
||
| 1. Delete the Nitrokeys |
2 participants
Added a documentation on how to use a Nitrokey for full-disk-encryption with FIDO2.