4 ms·
What was the gist of it? I use LUKS with a pretty strong password on Fedora 25 and have a few Yubikeys I need to put to good use.
by SEJeff 10y ago
What was the gist of it? I use LUKS with a pretty strong password on Fedora 25 and have a few Yubikeys I need to put to good use.
- jlgaddis 10y agognome-keyring replaces gpg-agent and ssh-agent (on the system) but doesn't actually include all the functionality... basically, disable GPG/SSH agent support in gnome-keyring (if it's running -- and it's quite often automatically launched, even if you aren't aware of/expecting it), and explicitly use the real agent instead. You can find the details on Google, but it's one of things that you wouldn't even know was a problem to be aware of. Edit: Sorry... for LUKS, write a custom initramfs hook (shell script, in my case) to prompt the user for a "passphrase", use that as the challenge sent to the Yubikey, read the response from the Yubikey, write that to /crypto_keyfile.bin (in the initramfs, so not on disk), and the "encrypt" hook should use that file as the key to unlock the disk. You'll have to do it by hand once so that you can add the key (response) to a slot in LUKS. There's examples on Github of this but of course I didn't find them until I had already figured it out myself.
- jeffmcjunkin 10y agoAmusingly I just ran across this[0] link an hour or so before this HN post went live. I haven't done it yet, but it looks pretty reasonable. I prefer not to mix LUKS with random many-year-old GitHub repos. [0] http://askubuntu.com/a/599826 http://askubuntu.com/a/599826
- mmozeiko 10y agoTake a look at this: https://github.com/agherzan/yubikey-full-disk-encryption https://github.com/agherzan/yubikey-full-disk-encryption