diff --git a/README.md b/README.md index bcacee4..2691701 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # fido2luks [![Crates.io Version](https://img.shields.io/crates/v/fido2luks.svg)](https://crates.io/crates/fido2luks) -This will allow you to unlock your luks encrypted disk with an fido2 compatible key +This will allow you to unlock your LUKS encrypted disk with an FIDO2 compatible key. Note: This has only been tested under Fedora 31, [Ubuntu 20.04](initramfs-tools/), [NixOS](https://nixos.org/nixos/manual/#sec-luks-file-systems-fido2) using a Solo Key, Trezor Model T @@ -65,7 +65,7 @@ cp /usr/bin/fido2luks /boot/fido2luks/ cp /etc/fido2luks.conf /boot/fido2luks/ ``` -## Test +## Testing Just reboot and see if it works, if that's the case you should remove your old less secure password from your LUKS header: @@ -96,6 +96,13 @@ set -a Then add the new secret to each device and update dracut afterwards `dracut -f` +### Multiple keys + +Additional/backup keys are supported, Multiple fido2luks credentials can be added to your /etc/fido2luks.conf file. Credential tokens are comma separated. +``` +FIDO2LUKS_CREDENTIAL_ID=,, +``` + ## Removal Remove `rd.luks.2fa` from `GRUB_CMDLINE_LINUX` in /etc/default/grub diff --git a/initramfs-tools/README.md b/initramfs-tools/README.md index 63f11a2..925eea7 100644 --- a/initramfs-tools/README.md +++ b/initramfs-tools/README.md @@ -1,13 +1,34 @@ ## Initramfs-tools based systems(Ubuntu and derivatives) -After installation generate your credentials and add keys to your disk as described in the top-level README -then add `initramfs,keyscript=fido2luks` to your `/etc/crypttab` +For easiest installation [download and install the precompiled deb from releases.](https://github.com/shimunn/fido2luks/releases). However it is possible to build from source via the instructions on the main readme. -Example: ``` -sda6_crypt UUID=9793d81a-4cfb-4712-85f3-c7a8d715112c none luks,discard,initramfs,keyscript=fido2luks +sudo -s + +# Insert FIDO key. +fido2luks credential +# Tap FIDO key +# Copy returned string + +nano /etc/fido2luks.conf +# Insert +# FIDO2LUKS_CREDENTIAL_ID= + +set -a +. /etc/fido2luks.conf +fido2luks -i add-key /dev/ +# Current password: +# Password: +# Tap FIDO key + +nano /etc/crypttab +# Append to end ",discard,initramfs,keyscript=fido2luks" +# E.g. sda6_crypt UUID=XXXXXXXXXX none luks,discard,initramfs,keyscript=fido2luks + +update-initramfs -u + + ``` -But don't forget to run `make install` which will install all necessary scripts and regenerate your intrid. +[Recording showing part of the setup](https://shimun.net/fido2luks/setup.svg) -[Recording showing part of the setup](https://shimun.net/fido2luks/setup.svg) \ No newline at end of file