5

I just finished setting up a LUKS encrypted system that is unlocked using a FIDO2 hardware token following this blog post. However, at home I usually leave the hardware token plugged in and I only remove it when traveling. So if someone were to steal the laptop together with the plugged-in hardware token they could easily boot the laptop and decrypt the disk.

To remedy this I'd like to use 2FA with both a password and the hardware token, but so far I only found solutions using a password + HMAC-SHA1 by using the password as the challenge and storing the generated hash as the actual password in LUKS, so this does not generalize to FIDO2. Is there a way to get 2FA working with FIDO2, too?

Improve this question
0

1 Answer 1

Reset to default
5

Systemd has a module for that since version 248. It's called systemd-cryptenroll. Depending on the capabilities of your FIDO2 stick multiple options are available for 2FA:

  • --fido2-with-user-presence=true configures the system so that you need to touch the FIDO2 stick.
  • --fido2-with-client-pin=true configures the system so that you need the FIDO2 stick and enter the PIN.
  • --fido2-with-user-verification=true configures the system so that you need the FIDO2 stick and authenticate to the system.

An example call would be systemd-cryptenroll --fido2-device=auto --fido2-with-user-verification=true /dev/sda3

But you should experiment with a spare USB drive or an image. Make sure everything works as expected before you enroll the FIDO2 key to your real devices.

After you enrolled your key to your device, at the fido2-device=auto option to the device in /etc/crypttab.

Multiple examples can be seen here.

Improve this answer
4
  • 1
    I was hoping to find an answer that combines plain user input together with the token input as source/secrets to unlock the key slot. Currently the PIN entry is quite limited and not supported on all tokens. Moreover, it's silently ignored by systemd-cryptenroll if it's not supported.
    – gertvdijk
    Jul 17, 2022 at 13:28
  • Can you share your crypttab file to demonstrate how password and FiDO2 token can work together ?
    – NoobTom
    Dec 13, 2022 at 9:24
  • This all makes sense and the documentation is easy to follow, but all attempts at this result in the same "please unlock disk <name>" at boot and only the passphrase works to unlock the disk. I've never been able to get any of my YubiKey 5s with FIDO2 support to work.
    – user24601
    Nov 24 at 15:28
  • @user24601 I am in the same boat. Have you found anything promising? Our issue is slightly different to the original question, and it may be Ubuntu specific (I was preparing myself to post that in askubuntu, as I don't know the specifics about the "boot unlocker")
    – MariusSiuram
    Nov 29 at 11:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .