I'm surprised that this question is not asked more frequently, but (in RHEL) does LUKS support TPM's the way that Windows BitLocker does? If so, how is this feature implemented, and does it provide the same type of protections that BitLocker for Windows provides?

BitLocker is very popular among businesses, and now that RHEL6 is getting FIPS certification for the disk encryption modules, it would be great if it also supported the same feature set.

However, I do understand that with the way LUKS works, not every volume can be encrypted, since the system would need to read the /etc/fstab and the /etc/crypttab files in order to mount the volumes. I believe this is OK as long as /home, /var, and other directories chosen by the administrator are encrypted.

I find it odd that "TPM" is not a tag on serverfault.

  • 3
    The only partition that needs to be unencypted s /boot. – Zoredache Dec 13 '11 at 16:11
  • I have never attempted this before (I'll need to experiment with it), but does the GRUB in RHEL6 support this out of the box? – Phanto Dec 13 '11 at 18:45
  • 1
    Grub shouldn't have to know anything. Grub would be on the un-ecrypted /boot volume along with the kernel and initrd. The real question is, can you easily get the RHEL to generate an initrd that includes everything you need to mount your root filesystem. – Zoredache Dec 13 '11 at 18:48

I've implemented support for storing your LUKS key in TPM NVRAM, and RHEL6 happens to be the one platform where all features are fully tested, see this post:

[1] https://security.stackexchange.com/a/24660/16522

  • I will definitely need to investigate this. I am going to mark this as the answer. – Phanto Nov 29 '12 at 18:40

This isn't supported out the box, but you probably can hack something together. The idea is to seal the LUKS key in the TPM, and then set up a trusted boot path which unlocks the sealed key. You'll need to install TrustedGRUB, and write a keyscript for /etc/crypttab which retrieves the key from the TPM. This will all happen in the initrd, so that will probably need to include the TPM tools. This post has a good description of the basic TPM installation.

  • Ouch, that is a lot of work. Unfortunately, that really does seem like the only way it will work. It's too bad the Linux developers haven't implemented this feature in a more simple way. I will mark this as the answer, since there hasn't been any other answer. – Phanto Jun 7 '12 at 2:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.