Unlock luks by other device

Question

I know that by configuring crypttab I can automatically unlock LUKS drives by using keyfile stored on another drive in the machine which has been manually unlocked in advance. I have been wondering if a keyfile stored in a different machine/device can also be used, accessed e.g. over ssh.

Here is what I would like to achieve. A machine with an encrypted LUKS drive would at startup look at a particular IP address in the local network and if a device (android phone) is present, it would read a keyfile from the device and use it to unlock its drive, otherwise it would ask for password.

Are there any better approaches to this? I have found that there exists blueproximity which does something similar for lock-screen.

Answer 1

This is actually possible with LUKS 2 and cryptsetup-ssh. You can simply add the SSH token with

cryptsetup-ssh add --ssh-keypath=<path> --ssh-path=<path> --ssh-server=<ip/url> --ssh-user=<username> <device>

Where

• ssh-keypath is a path to SSH key to use to connect to the server,
• ssh-server is IP address or URL of the server,
• ssh-user is username to use when connecting to the server and
• ssh-path is path on the server where the key file can be found.

This will a so called token to the LUKS metadata (basically a small metadata blob containing above) and when you try to open the device with cryptsetup open it will try to use the data from the token to get the password.

Note that this is a relatively new feature (it was added in cryptsetup 2.4.0) and is still considered experimental and it is possible that your distribution doesn't ship cryptsetup-ssh. I am also not sure how well this works with systemd during boot.

An alternative is called Network Bound Disk Encryption (NBDE) which uses the Clevis-Tang client and server together with LUKS (both LUKS 1 and LUKS 2 are supported). You can read more about it in this RHEL documentation.