ITPreview
Open in TheBrain

Clevis - crypt key LUKS Error

Running the start.sh script again would sometimes cause the crpt LUKS key to error out and the admin would have to sign in. Using cleavis that would fix the issue and bind the keys that are present with clevis and auto log in

sudo apt update
sudo apt install clevis clevis-luks clevis-tpm2 clevis-initramfs tpm2-tools

sudo clevis luks bind -d /dev/nvme0n1p3 tpm2 '{}'

If no TPM is found

  1. lsblk -o NAME,FSTYPE,SIZE,MOUNTPOINT - locate where crypto_LUKS sits for example the NAME might be sda3
  2. sudo dd if=/dev/urandom of=/root/luks-keyfile bs4096 count=1 - this creates the keyfile
    1. sudo chmod 0400 /root/luks-keyfile
    2. sudo chown root:root /root/luks-keyfile
  3. sudo cryptsetup luksAddKey /dev/sda3 /root/luks-keyfile

If busybox opens with initramfs:

First, try to manually unlock the disk

cryptsetup luksOpen /dev/sda3 dm_crypt-0

exit

check crypttab - sudo nano /etc/crypttab

update initramfs - sudo update-initramfs -u -k all