![如何在 Fedora 中使用 PKCS#11 智能卡进行启动驱动器加密 (35)](https://linux22.com/image/204092/%E5%A6%82%E4%BD%95%E5%9C%A8%20Fedora%20%E4%B8%AD%E4%BD%BF%E7%94%A8%20PKCS%2311%20%E6%99%BA%E8%83%BD%E5%8D%A1%E8%BF%9B%E8%A1%8C%E5%90%AF%E5%8A%A8%E9%A9%B1%E5%8A%A8%E5%99%A8%E5%8A%A0%E5%AF%86%20(35).png)
在此处的 Fedora Workstation 35 上。系统 v249
我试图在启动时使用智能卡解锁根 LUKS 卷,但它不起作用。
我添加到 /etc/crypttab mydisk UUID=496e1cd5-712f-44ab-ad02-5fb6f7419af8 none pkcs11-token-uri=auto,luks,discard
我的磁盘已使用 sudo systemd-cryptenroll --pkcs11-token-uri=auto /dev/... 正确注册,我可以使用 luksDump 进行插槽我验证我可以使用 sudo /usr/lib/systemd/systemd-cryptsetup Attach 挂载MountName /dev/... 无 pkcs11-uri=auto
重新启动时会出现密码提示。控制台显示:
进入加密设置712f-44ab-ad02-5fb6f7419af8:请输入磁盘 WDS 的密码...[磁盘型号]:
此处只有恢复密码有效。无法使用智能卡并输入密码
我使用相同的 crypttab 方法和相同的智能卡来解锁其他驱动器(外部 HDD)并且它可以工作(虽然不在磁盘中,仅在启动时,磁盘应用程序在我尝试安装时总是要求输入密码,但这是另一个问题) 。该智能卡基于 Yubikey。
根据此处的公告:https://www.phoronix.com/scan.php?pa...lock-加密和这里的人:https://www.freedesktop.org/[电子邮件受保护] 这个功能应该可以工作。我引用文档中的内容:
In order to unlock a volume a password or binary key is required. [email protected] tries to acquire a suitable password or binary key via the following mechanisms, tried in order:
If a key file is explicitly configured (via the third column in /etc/crypttab), a key read from it is used. If a PKCS#11 token, FIDO2 token or TPM2 device is configured (using the pkcs11-uri=, fido2-device=, tpm2-device= options) the key is decrypted before use.
If no key file is configured explicitly this way, a key file is automatically loaded from /etc/cryptsetup-keys.d/volume.key and /run/cryptsetup-keys.d/volume.key, if present. Here too, if a PKCS#11/FIDO2/TPM2 token/device is configured, any key found this way is decrypted before use.
If the try-empty-password option is specified it is then attempted to unlock the volume with an empty password.
The kernel keyring is then checked for a suitable cached password from previous attempts.
Finally, the user is queried for a password, possibly multiple times, unless the headless option is set.