0

I'm trying to set up my LUKS encryption to use 2FA with a password and a FIDO2 key with the following command:

systemd-cryptenroll --fido2-device=auto --fido2-with-user-verification=true /dev/my_disk_device

But I get the error FIDO2 tokens not supported on this build.

systemd-cryptenroll --version shows the following output:

systemd 249 (249.7-1) +PAM +AUDIT +SELINUX +APPARMOR +IMA +SMACK +SECCOMP +GCRYPT +GNUTLS -OPENSSL +ACL +BLKID +CURL +ELFUTILS -FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP -LIBFDISK +PCRE2 -PWQUALITY -P11KIT -QRENCODE +BZIP2 +LZ4 +XZ +ZLIB +ZSTD -XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified

The system is the current Kali linux. Is there any possibility to get an official package from the repos with FIDO2 support? Or do I have to compile my own version?

If I have to compile my own version, is there a trick to automatically update the package in Kali or Debian?


Update:

Kali updated the version of systemd to 250.2-3, which has FIDO2 support activated. Now the enrollment of the FIDO2 devices works. But I can't decrypt the partitions at boot.

To enable decryption at boot time you should add fido2-device=auto to the list of options in /etc/crypttab and update the initramfs.

But update-initramfs -u doesn't know this option: cryptsetup: WARNING: nvme0n1p3_crypt: ignoring unknown option 'fido2-device'

So the current answer is: How can I activate decryption with FIDO2 during boot?


Update 2: In the next version 250.3-1 will be the needed support in cryptsetup: https://manpages.debian.org/unstable/systemd/systemd-cryptsetup@.service.8.en.html

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.