3 ms·

> You can use "keyscript=" in "/etc/crypttab" to run any script you want. ...unless your distro uses systemd, which removes keyscript support [1] because the s

> You can use "keyscript=" in "/etc/crypttab" to run any script you want. ...unless your distro uses systemd, which removes keyscript support [1] because the systemd guy "really dislikes generic callouts" [1] https://github.com/systemd/systemd/pull/3007 https://github.com/systemd/systemd/pull/3007

sterlind 2y ago
you can apparently provide a Unix socket path in /etc/crypttab now, and it will connect and read the key from the socket. so you can have the same functionality, but you have to get at it a different way: https://github.com/systemd/systemd/pull/17524 https://github.com/systemd/systemd/pull/17524
adriancr 2y ago
It's 2024 and keyscript still works fine on ubuntu
- aflukasz 2y ago
  I don't use this param at the moment anywhere to confirm experimentally, but I'm pretty sure it's same on Debian: https://salsa.debian.org/cryptsetup-team/cryptsetup/-/blob/70ec02716f451a0272e7b1fa46c081cb94f1e910/debian/functions#L274 https://salsa.debian.org/cryptsetup-team/cryptsetup/-/blob/7....
pacificenigma 2y ago
For years I've used https://github.com/anatol/booster https://github.com/anatol/booster to unlock LUKS partitions using network bound disk encryption with https://github.com/latchset/clevis https://github.com/latchset/clevis and https://github.com/latchset/tang https://github.com/latchset/tang. Works well, especially as Tang is stateless (so deployment and high availability is easy) and Booster falls back to password entry if Tang is unavailable.
- aflukasz 2y ago
  Thumbs up for clevis/tang, happy user here, too! Did not hear about booster. Its README claims "Clevis style data binding. The encrypted filesystem can be bound to TPM2 chip or to a network service.". Does it mean that it tries to deliver various bindings independently from clevis pins, even when duplicating their functions?
adsf325q3 2y ago
[flagged]

sterlind 2y ago

you can apparently provide a Unix socket path in /etc/crypttab now, and it will connect and read the key from the socket. so you can have the same functionality, but you have to get at it a different way: https://github.com/systemd/systemd/pull/17524 https://github.com/systemd/systemd/pull/17524

adriancr 2y ago

It's 2024 and keyscript still works fine on ubuntu

aflukasz 2y ago
I don't use this param at the moment anywhere to confirm experimentally, but I'm pretty sure it's same on Debian: https://salsa.debian.org/cryptsetup-team/cryptsetup/-/blob/70ec02716f451a0272e7b1fa46c081cb94f1e910/debian/functions#L274 https://salsa.debian.org/cryptsetup-team/cryptsetup/-/blob/7....

pacificenigma 2y ago

For years I've used https://github.com/anatol/booster https://github.com/anatol/booster to unlock LUKS partitions using network bound disk encryption with https://github.com/latchset/clevis https://github.com/latchset/clevis and https://github.com/latchset/tang https://github.com/latchset/tang. Works well, especially as Tang is stateless (so deployment and high availability is easy) and Booster falls back to password entry if Tang is unavailable.

aflukasz 2y ago
Thumbs up for clevis/tang, happy user here, too! Did not hear about booster. Its README claims "Clevis style data binding. The encrypted filesystem can be bound to TPM2 chip or to a network service.". Does it mean that it tries to deliver various bindings independently from clevis pins, even when duplicating their functions?

adsf325q3 2y ago

[flagged]