Had to secure a mobile workstation against data theft in case I loose my device.

Fido2 Maintenance/Analysis Commands

• Test unlocking with enrolled key

  cryptsetup luksOpen --test-passphrase --token-only /dev/<device>

• Listing luks header (includes key&token entries)

  cryptsetup luksDump /dev/<device>

• Adding FIDO Key to existing luks device

  systemd-cryptenroll --fido2-with-client-pin=yes --fido2-device=auto /dev/<device>

sudo authentication with FIDO2 key

• Install u2f tools:
  sudo apt-get install libpam-u2f
• Create config folder:
  mkdir ~/.config/u2f
• Add FIDO2 key:
  pamu2fcfg >~/.config/u2f/u2f_keys
  • Note: Additional keys need to be added to the same line, e.g. user:keyhandle1:keyhandle2
• Enable pam_u2f: Edit /etc/pam.d/sudo and before the first auth (in my case before @include common-auth) add the line:

    auth sufficient pam_u2f.so cue prompt authfile=.config/u2f/u2f_keys

References:

• https://roman.gallauner.at/?p=1384 (Archive)
• https://www.token2.com/site/page/using-token2-fido2-security-keys-for-linux-local-authentication (Archive)

SSH (resident key on Solo2)

• Create resident key on stick:
  • sudo ssh-keygen -t ed25519-sk -O resident -O verify-required -C "Comment"
• Reinstall existing resident key from stick:
  • ssh-keygen -K

Resources

Debian Secure Boot

• https://wiki.debian.org/SecureBoot (Archive)

Debian Disk Encryption (LUKS)

• https://unix.stackexchange.com/questions/577379/how-can-i-install-debian-with-full-disk-encryption-and-a-custom-sized-swapfile (Archive)

• https://debianforum.de/forum/viewtopic.php?t=177435 (Archive)

• https://www.blakecarpenter.dev/installing-debian-on-existing-encrypted-lvm/ (Archive)

• https://www.reddit.com/r/debian/comments/hhvucx/comment/fwck8pq/ (Archive)

• https://www.reddit.com/r/debian/comments/10rh1on/do_i_have_to_put_bootefi_outside_the_encrypted_lvm/ (Archive)

• https://linuxwiki.de/cryptsetup (Archive)

• https://gist.github.com/luispabon/db2c9e5f6cc73bb37812a19a40e137bc ([Archive(https://web.archive.org/web/20240214143258/https://gist.github.com/luispabon/db2c9e5f6cc73bb37812a19a40e137bc))

• https://docs.fedoraproject.org/en-US/quick-docs/encrypting-drives-using-LUKS/ (Archive)

• https://cryptsetup-team.pages.debian.net/cryptsetup/encrypted-boot.html (Archive)

• https://wiki.archlinux.org/title/Resizing_LVM-on-LUKS (Archive)

Unlocking LUKS using FIDO2 key during boot

• https://www.privacy-handbuch.de/handbuch_37h1.htm (Archive)

• https://www.privacy-handbuch.de/handbuch_37h.htm (Archive)

• https://0pointer.net/blog/unlocking-luks2-volumes-with-tpm2-fido2-pkcs11-security-hardware-on-systemd-248.html (Archive)

• https://www.guyrutenberg.com/2022/02/17/unlock-luks-volume-with-a-yubikey/ (Archive)

• Debian fido2 with dracut boot (Archive)

• https://discussion.fedoraproject.org/t/unlock-luks-with-fido2-token/66323 (Archive)

• https://fedoramagazine.org/use-systemd-cryptenroll-with-fido-u2f-or-tpm2-to-decrypt-your-disk/ (Archive)

sudo authentication using FIDO2 key

• https://roman.gallauner.at/?p=1384 (Archive)
• https://www.token2.com/site/page/using-token2-fido2-security-keys-for-linux-local-authentication (Archive)

Fix: Restoring GRUB for encrypted LVM

• https://stephentanner.com/restoring-grub-for-an-encrypted-lvm.html (Archive)
• https://wiki.debian.org/GrubEFIReinstall (Archive)
• https://askubuntu.com/questions/719409/how-to-reinstall-grub-from-a-liveusb-if-the-partition-is-encrypted-and-there-i (Archive)
• https://gist.github.com/samuelcolvin/43c5ed2807e7db004b1058d0c9bfb068 (Archive)

Misc

• https://debianforum.de/forum/viewtopic.php?t=187139 (Archive)