colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/doc: add documentation on using FIDO2 tokens in systemd stage1

Browse Source
This commit is contained in:
dadada 2023-10-08 16:08:19 +02:00
parent 4a7dad37d5
commit 0f8084ba6b
No known key found for this signature in database
GPG Key ID: EEB8D1CE62C4DFEA
1 changed files with 40 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
nixos/doc/manual/configuration/luks-file-systems.section.md
View File

@ -42,8 +42,12 @@ boot.loader.grub.enableCryptodisk = true;
## FIDO2 {#sec-luks-file-systems-fido2}
NixOS also supports unlocking your LUKS-Encrypted file system using a
FIDO2 compatible token. In the following example, we will create a new
NixOS also supports unlocking your LUKS-Encrypted file system using a FIDO2
compatible token.
### Without systemd in initrd {#sec-luks-file-systems-fido2-legacy}
In the following example, we will create a new
FIDO2 credential and add it as a new key to our existing device
`/dev/sda2`:
@ -75,3 +79,37 @@ as [Trezor](https://trezor.io/).
```nix
boot.initrd.luks.devices."/dev/sda2".fido2.passwordLess = true;
```
### systemd Stage 1 {#sec-luks-file-systems-fido2-systemd}
If systemd stage 1 is enabled, it handles unlocking of LUKS-enrypted volumes
during boot. The following example enables systemd stage1 and adds support for
unlocking the existing LUKS2 volume `root` using any enrolled FIDO2 compatible
tokens.
```nix
boot.initrd = {
luks.devices.root = {
crypttabExtraOpts = [ "fido2-device=auto" ];
device = "/dev/sda2";
};
systemd.enable = true;
};
```
All tokens that should be used for unlocking the LUKS2-encrypted volume must
first be enrolled using [systemd-cryptenroll](https://www.freedesktop.org/software/systemd/man/systemd-cryptenroll.html).
In the following example, a new key slot for the first discovered token is
added to the LUKS volume.
```ShellSession
# systemd-cryptenroll --fido2-device=auto /dev/sda2
```
Existing key slots are left intact, unless `--wipe-slot=` is specified. It is
recommened to add a recovery key that should be stored in a secure physical
location and can be entered wherever a password would be entered.
```ShellSession
# systemd-cryptenroll --recovery-key /dev/sda2
```