Hey there, how are you?
I was inspired by recently installing Ubuntu after quite a while and remembering how it
can decrypt Lux encrypted partition automatically with the help of trusted platform module.
This is really cool.
You get the ability to have your data partition, your home partition encrypted
and you don't have to type the decryption password, so it's good.
However, I am now using Fedora Silver Blue because I want to check it out, I want to use it,
I want to get some experience with that one and I used this inspiration to do the same on Fedora
Silver Blue, so it's not repaired out of the box, but it's not that difficult to set up.
However, I am going to need a little bit of your help with finishing this into a really clean
way. So you'll see where I got stuck, help me out if you can and for everyone else,
if anyone smart enough solves my last issue that I have with this, mind you I did get it working,
but I'm not completely pleased. So if anyone smart enough ends up solving my issue in the
comments down below, I'm going to pin their answer. Let's get started.
First of all, enter your BIOS, go to security settings, go to secure boot, clear everything,
clear it, clear it, clear it and well return it to the user mode, standard mode after clearing
everything, go to security chip, clear that one as well, so everything is like super clear,
go to exit saving changes, yes, it may take a little bit longer to boot for the first time to
to show up your manufacturer logo, insert your fedora silver blue installation stick,
press the button to select your boot device so that you can boot the installer. Here we go,
entering boot menu, USB disk, okay, let's start this installation. So I'm not going to show you
the installation, that's not the point of this video, just go through the installation on your own
and make sure to encrypt your installation with lux and of course remember which password you
encrypted your partition with and I'm going to see you after the installation is finished.
Here we go, our first boot after installation, it will ask us for a
decryption password for sure, so that's how it works. There we go.
I have entered my decryption password so we can continue with the, well, the end of the setup, right?
Okay, English keyboard, no need for Wi-Fi, no need for location services,
time zone, we can do that, third-party repository, no need for that, my name,
okay, next my password,
it's not the best one, but it's mine, start using Fedora. So the first thing you definitely want to
do, please update your system.
Do wish to enable third-party software repositories, I have already said that I don't want those,
so ignore it, let's go to updates, secure boot dbx configuration update, let's get this,
let's update, let's restart to get the first update first, etc.
Okay, we are back at the decryption screen for locks, right? So at this point, what happens
if you just press enter, you press enter and it is going to attempt to boot, but
can't boot because it's encrypted. Okay, so let's type the correct decryption password,
so that we can continue booting, there is a valid reason why I did that with just pressing enter
and you're going to find it out pretty soon. Here we are with the boot login screen on my end here,
on my screen, I have typed my password and now I'm going to switch the screen
to the one that I'm recording for you. Let's go ahead and update the rest of the system now.
Apparently, we are already up to date. I kind of figured that if I just press the download
button on ufe dbx update that it will only download that part and then that we are
going to download the rest of it, but apparently we are done and we can go ahead
and start doing what we came here to do. So first of all, let's pin this to dash,
because I am going to use it a bit on the frequent side.
The first thing we need to do is install a couple of packages, including
Clevis. Clevis is a tool which will help you to automatically decrypt
your Lux encrypted partition. You can use it in combination with a TPM trusted platform module,
you can use it in combination with Fido, keys with smart cards, whatever it is that you have
used to encrypt your partition.
RPM oyster to install a couple of packages. Right, so Clevis, Clevis dash
Lux, Clevis dash U, Disk U, Clevis dash System D, EPM 2 dash tools, and we might as well add
Htop, Emacs, NeoVim and whatever else tools you may require.
Also, we don't need this one. Okay, then just wipe that one, because apparently we don't need it.
There is an error here, package not found, Clevis dash U, Disk 2,
because the S is missing. Okay, so we have to type U, Disk 2. Good, the changes are now queued
for next boot. So let's do that reboot. And now we need to enter the new environment
which holds all of our new packages.
You will need your decryption password here.
Type it in, continue booting. When you get to your login screen off, of course, log back in.
Back to the terminal. So at this stage, you need to bind your well,
blocks device with the trusted platform module, which is being done with sudo
Clevis locks bind dash D slash dev NVMe 0 and 1 partition 3, and then TPM 2 as a module,
and under quotes just put not these guys, but these guys. So the early braces, I think they are called.
Maybe I can increase the font size so that you can see better what I did here.
My password here.
Now it is asking you for your decryption password. You're handing it over to
Clevis.
Okay, if you are unsure about which partition is it that is encrypted and needs to be highlighted
after the dash D, you can do the LS BLK dash F decrease the font size a little bit.
See now you have NVMe 0 and 1 partition 1 partition 2 partition 3 and
under partition 3 you have your locks encryption. This is your device, right? So the one that
you're going to hand over to the bind command, it is going to be the one that contains the locks
user, not user ID, you, you ID. Okay, so that's partition 3 on my NVMe. There is one more thing
that needs to be done because Fedora silver blue is going to drop a new image instead of your
current one when the update happens. You have to ask your Fedora nicely to regenerate
init ram fs on every image deployment. Okay, so you can do that with sudo rpm os3 init ram ram fs dash
enable wait it out a little bit.
Here we go, init ram fs regeneration is now enabled. Let's reboot into our new environment now.
And we are pretty much done with this exercise, but not really.
Okay, so as you're going to see, we are now going to get halted with the decryption password
romped. There we go. So what can we do now? Did we not do everything that was required? I think
we did. I actually believe that at this stage, our data partition, our home partition is actually
already decrypted. So let's go ahead and try it out just by pressing enter here.
No, it's not. Let's type the password.
Let's see where did I make a mistake?
Okay, rpm os3 init ram fs enable. That's a correct command.
I'm just looking at my notes.
So the only thing that may be missing here
pvc dash drakut. I think I thought that this wasn't necessary, but let's give it a chance and see if
this helps. Okay, clivis drakut added. Let's check if this solved our issue. Okay, we are once again
stopped with this prompt to decrypt our partition. Let's press enter.
Yeah, clivis drakut was missing.
So there you have it. In the description of this video, there will be a correct command
listed or maybe it will be a link to my web page where the correct command will be listed,
but nevertheless, a correct command will be listed. If you are happy with what we got so far, then
you can stop watching this video, but there is something more that has been troubling me
with this setup because I didn't really want to press enter to skip the password prompt.
Okay, so let's do the sudo rpm os3 kernel arguments dash dash append if missing
rd locks options equals locks oma discard okay append if missing rd locks skip
password append if missing okay now enter a new terminal do the lsblk dash f command once again
copy the id of your encrypted partition go back to previous tab and type rd.locks.name equals
paste equals locks and two votes and press enter here type your password to authorize this change.
So the first two appends are going to be just about enough to skip the password prompt
but what is troubling me is that I want to make the password prompt not actually appear at all.
The third append is supposed to help with this but in my case it just didn't and once the generation
of initrumpfs finishes I'm going to show you how this works for me now and then I'm going to ask
for some of your smart brains help.
We're done let's see what we did rpm os3k args
okay so you can already see that where is it after the vconsole and root flags okay we have rd
locks options equals locks comma discard this is fine then we have rd locks skip password this is
fine and then we have rd locks name equals our id and equals locks so if you made a mistake here
and you can clearly see it you can use the command dash dash delete if present okay so you just roll
back the same command that you used but instead of using dash dash append if missing you can use
dash dash delete if present and just copy paste the incorrect part and once it gets deleted
then re-edit again and verify with rpm os3k args that you have done it correctly
we can now reboot so I can show you finally how it works and what still troubles me and there you
have it hands off experience fedora is now going to display a locks decryption password prompt
right I'm not going to press enter this time I'm not going to press anything actually
I'm just gonna hold my hands up high so that you can see what's going on here
and voila we have booted in we are now typing in the gdm password on my screen not on yours
voila so basically this is a hands off experience it will boot completely
it's just tiny bit annoying that it still shows up the password prompt like a phantom
password prompt because the partition is actually unlocked at the moment of this password prompt
appearing or somewhere around that moment if you manage to find a solution to this phantom
password prompt problem please type it in the comment below I'm going to check it on my system
if it works I'm going to pin your comment and I'm going to update the instructions on my webpage
which is probably already linked down below and I'm going to put your name on my webpage as a little
thank you for solving this issue but even without solving this last issue I think this whole thing is
pretty well done at this stage well and thank you for watching the video and I'm going to see you in
the next one hold on hold on I figured it out go ahead and sudo to root okay copy this file here
from user lib system d system system d ask password plywood dot service to
edit system d system okay copy that one there and then edit this file edit this file let's edit it
you will find every one of these rows already in there except the last one just add exec
start pre equals slash bin slash sleep 10 this is going to wait a little bit until all of the modules
are loaded and well it's not going to show you the password prompt just save this one
you can do the system control demon reexit demon reload maybe that's not necessary just
reboot your computer after this and we should be good at this point we should be good let's
check it out once more no password prompt if you still think that you can do a better job
I do challenge you to well reply in the comments and make it work better for all of us
see you in the next video