Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm surprised that this question is not asked more frequently, but (in RHEL) does LUKS support TPM's the way that Windows BitLocker does? If so, how is this feature implemented, and does it provide the same type of protections that BitLocker for Windows provides?

BitLocker is very popular among businesses, and now that RHEL6 is getting FIPS certification for the disk encryption modules, it would be great if it also supported the same feature set.

However, I do understand that with the way LUKS works, not every volume can be encrypted, since the system would need to read the /etc/fstab and the /etc/crypttab files in order to mount the volumes. I believe this is OK as long as /home, /var, and other directories chosen by the administrator are encrypted.

I find it odd that "TPM" is not a tag on serverfault.

share|improve this question

migrated from serverfault.com Dec 13 '11 at 16:56

This question came from our site for system and network administrators.

The only partition that needs to be unencypted s /boot. – Zoredache Dec 13 '11 at 16:11
I have never attempted this before (I'll need to experiment with it), but does the GRUB in RHEL6 support this out of the box? – Phanto Dec 13 '11 at 18:45
Grub shouldn't have to know anything. Grub would be on the un-ecrypted /boot volume along with the kernel and initrd. The real question is, can you easily get the RHEL to generate an initrd that includes everything you need to mount your root filesystem. – Zoredache Dec 13 '11 at 18:48
up vote 7 down vote accepted

I've implemented support for storing your LUKS key in TPM NVRAM, and RHEL6 happens to be the one platform where all features are fully tested, see this post:

[1] http://security.stackexchange.com/a/24660/16522

share|improve this answer
I will definitely need to investigate this. I am going to mark this as the answer. – Phanto Nov 29 '12 at 18:40

This isn't supported out the box, but you probably can hack something together. The idea is to seal the LUKS key in the TPM, and then set up a trusted boot path which unlocks the sealed key. You'll need to install TrustedGRUB, and write a keyscript for /etc/crypttab which retrieves the key from the TPM. This will all happen in the initrd, so that will probably need to include the TPM tools. This post has a good description of the basic TPM installation.

share|improve this answer
Ouch, that is a lot of work. Unfortunately, that really does seem like the only way it will work. It's too bad the Linux developers haven't implemented this feature in a more simple way. I will mark this as the answer, since there hasn't been any other answer. – Phanto Jun 7 '12 at 2:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.