You are not logged in.
Apologies in advance if this isn't the right subforum.
I recently installed with an encrypted root filesystem and it works great, but I would like to expedite the boot procedure.
I was able to enroll a yubikey with "systemd-cryptenroll /dev/nvme1n1p2 --fido2-device=auto" which now occupies keyslot 1. If I "cryptsetup open" the drive and the key is inserted it waits for the presence check to pass. If I cryptsetup open the drive and the key is not inserted it prompts for a password. That is the behavior I want.
However, on boot the behavior is different. To unlock the device in early boot it will only prompt for the passphrase, and the yubikey is ineffective. If I modify the /etc/crypttab entry to include "- fido2-device=auto" it will only unlock with the key inserted after the presence check passes, and never prompt for a passphrase.
Is there a way I can use _either_ the passphrase or the yubikey for the first unlock? crypttab(5) claims the default behavior is to try each keyslot in order, but I haven't observed this. Do I need to do something to "move on" to the next key?
Last edited by Brocellous (2022-06-03 02:55:59)
Offline
have you read this: https://wiki.archlinux.org/title/YubiKe … _with_LUKS
Offline
I hadn't seen that, thanks.
Since ykfde uses cryptsetup open I think it would work, but systemd-cryptenroll is convenient enough for me that I'll probably stick with it anyway. I'll consider opening a systemd issue to implement some kind of multiple-keyslot opening procedure in systemd-cryptsetup. I'll mark this issue as resolved.
EDIT:
In fact, this request already exists [1], and an alternative (token timeout) has already been implented [2]
[1] https://github.com/systemd/systemd/issues/19872
[2] https://github.com/systemd/systemd/pull/20970
Last edited by Brocellous (2022-06-03 03:00:57)
Offline