diff options
| author | Marek Mahut <marek.mahut@gmail.com> | 2020-01-27 08:27:30 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-01-27 08:27:30 +0100 |
| commit | 61dbbe4121b8a6d3058e38c2d948b2ff143f0e5b (patch) | |
| tree | e7c187efc37d8ef82e4c80d6e11f84f65bfffc87 /nixos/doc | |
| parent | 7b819104a216615c1aba6dbcb1cf2bb7ec788c27 (diff) | |
| parent | 860a3114f774b87d17295e2f2650b949bf44c8d1 (diff) | |
| download | nixlib-61dbbe4121b8a6d3058e38c2d948b2ff143f0e5b.tar nixlib-61dbbe4121b8a6d3058e38c2d948b2ff143f0e5b.tar.gz nixlib-61dbbe4121b8a6d3058e38c2d948b2ff143f0e5b.tar.bz2 nixlib-61dbbe4121b8a6d3058e38c2d948b2ff143f0e5b.tar.lz nixlib-61dbbe4121b8a6d3058e38c2d948b2ff143f0e5b.tar.xz nixlib-61dbbe4121b8a6d3058e38c2d948b2ff143f0e5b.tar.zst nixlib-61dbbe4121b8a6d3058e38c2d948b2ff143f0e5b.zip | |
Merge pull request #77826 from mmahut/fido2luks
FIDO2 luks support
Diffstat (limited to 'nixos/doc')
| -rw-r--r-- | nixos/doc/manual/configuration/luks-file-systems.xml | 34 | ||||
| -rw-r--r-- | nixos/doc/manual/release-notes/rl-2003.xml | 6 |
2 files changed, 40 insertions, 0 deletions
diff --git a/nixos/doc/manual/configuration/luks-file-systems.xml b/nixos/doc/manual/configuration/luks-file-systems.xml index 8a2b107e0ee8..d3007843d68b 100644 --- a/nixos/doc/manual/configuration/luks-file-systems.xml +++ b/nixos/doc/manual/configuration/luks-file-systems.xml @@ -37,4 +37,38 @@ Enter passphrase for /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d: *** on an encrypted partition, it is necessary to add the following grub option: <programlisting><xref linkend="opt-boot.loader.grub.enableCryptodisk"/> = true;</programlisting> </para> + <section xml:id="sec-luks-file-systems-fido2"> + <title>FIDO2</title> + + <para> + NixOS also supports unlocking your LUKS-Encrypted file system using a FIDO2 compatible token. In the following example, we will create a new FIDO2 credential + and add it as a new key to our existing device <filename>/dev/sda2</filename>: + + <screen> +# export FIDO2_LABEL="/dev/sda2 @ $HOSTNAME" +# fido2luks credential "$FIDO2_LABEL" +f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7 + +# fido2luks -i add-key /dev/sda2 f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7 +Password: +Password (again): +Old password: +Old password (again): +Added to key to device /dev/sda2, slot: 2 +</screen> + + To ensure that this file system is decrypted using the FIDO2 compatible key, add the following to <filename>configuration.nix</filename>: +<programlisting> +<link linkend="opt-boot.initrd.luks.fido2Support">boot.initrd.luks.fido2Support</link> = true; +<link linkend="opt-boot.initrd.luks.devices._name__.fido2.credential">boot.initrd.luks.devices."/dev/sda2".fido2.credential</link> = "f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7"; +</programlisting> + + You can also use the FIDO2 passwordless setup, but for security reasons, you might want to enable it only when your device is PIN protected, such as <link xlink:href="https://trezor.io/">Trezor</link>. + +<programlisting> +<link linkend="opt-boot.initrd.luks.devices._name__.fido2.passwordLess">boot.initrd.luks.devices."/dev/sda2".fido2.passwordLess</link> = true; +</programlisting> + </para> + </section> + </section> diff --git a/nixos/doc/manual/release-notes/rl-2003.xml b/nixos/doc/manual/release-notes/rl-2003.xml index 1eef4f08c4fd..af91d72fb8f2 100644 --- a/nixos/doc/manual/release-notes/rl-2003.xml +++ b/nixos/doc/manual/release-notes/rl-2003.xml @@ -485,6 +485,12 @@ users.users.me = now uses the short rather than full version string. </para> </listitem> + <listitem> + <para> + It is now possible to unlock LUKS-Encrypted file systems using a FIDO2 token + via <option>boot.initrd.luks.fido2Support</option>. + </para> + </listitem> </itemizedlist> </section> </section> |