# Unlocking LUKS volume with Nitrokey 3 on Debian 12.2 **URL:** https://support.nitrokey.com/t/unlocking-luks-volume-with-nitrokey-3-on-debian-12-2/5553 **Category:** FIDO2 / Nitrokey 3 **Created:** [October 29, 2023, 7:50pm UTC](https://support.nitrokey.com/t/unlocking-luks-volume-with-nitrokey-3-on-debian-12-2/5553 "2023-10-29T19:50:32Z") **Posts on this page:** 15 **Page:** 1
### Author: ![FredL](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/f/3d9bf3/32.png) [@FredL](https://support.nitrokey.com/u/FredL) #### Post date: [October 29, 2023, 7:50pm UTC](https://support.nitrokey.com/t/unlocking-luks-volume-with-nitrokey-3-on-debian-12-2/5553/1 "2023-10-29T19:50:32Z")
I successfully setup a Debian 12.2 fresh install with a LUKS volume that is unlocked by a NitroKey 3. I use this great howto (and the comments): [Unlock LUKS volume with a YubiKey – Guy Rutenberg](https://www.guyrutenberg.com/2022/02/17/unlock-luks-volume-with-a-yubikey) And this Debian bug report: [https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1029324](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1029324) This one is also a great read: [Unlocking LUKS2 volumes with TPM2, FIDO2, PKCS#11 Security Hardware on systemd 248](https://0pointer.net/blog/unlocking-luks2-volumes-with-tpm2-fido2-pkcs11-security-hardware-on-systemd-248.html) Summary - You need to use `dracut` instead of `initramfs-tools` to manage initrd (since the latter cannot use `systemd-cryptsetup` to unlock LUKS volumes with FIDO2 devices) - Then you just enroll your FIDO2 device - (Optional) Generate recovery keys (see 2nd howto) Here a summary of all commands (as root) needed to set this up on a fresh install of Debian 12.2: ```auto # # Switch from initramfs-tools to Dracut to manage initrd # nano /etc/default/grub # Change the line with GRUB_CMDLINE_LINUX_DEFAULT like this: # GRUB_CMDLINE_LINUX_DEFAULT="quiet rd.auto=1" update-grub nano /etc/crypttab # Change the line: # vda5_crypt UUID=165e9c6c-6277-49b1-ac51-94158b504964 none luks,discard # to: # luks-165e9c6c-6277-49b1-ac51-94158b504964 UUID=165e9c6c-6277-49b1-ac51-94158b504964 none luks,discard apt install dracut apt purge cryptsetup-initramfs && apt autoremove -purge dracut -f # Test that the switch to dracut is working by rebooting 😀 reboot # # Enroll your FIDO2 device to unlock Luks volume # apt install fido2-tools # Plug your FIDO2 device systemd-cryptenroll -fido2-device=list # Check your FIDO2 device is listed systemd-cryptenroll -fido2-device=auto /dev/vda5 nano /etc/crypttab # Change the line: # luks-165e9c6c-6277-49b1-ac51-94158b504964 UUID=165e9c6c-6277-49b1-ac51-94158b504964 none luks,discard # to: # luks-165e9c6c-6277-49b1-ac51-94158b504964 UUID=165e9c6c-6277-49b1-ac51-94158b504964 none luks,discard,fido2-device=auto echo “hostonly=yes” > /etc/dracut.conf.d/10-hostonly.conf dracut -f # Test if everything works as expected ! 😀 reboot ``` ---
### Author: ![SecureBoot](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/s/cc9497/32.png) [@SecureBoot](https://support.nitrokey.com/u/SecureBoot) #### Post date: [October 30, 2023, 3:36am UTC](https://support.nitrokey.com/t/unlocking-luks-volume-with-nitrokey-3-on-debian-12-2/5553/2 "2023-10-30T03:36:15Z")
> [@FredL](#): > > ```auto > to: > # luks-165e9c6c-6277-49b1-ac51-94158b504964 UUID=165e9c6 > > ``` Doing this with dracut on Fedora 37 should be no different, correct? I am trying to do what you are doing with Debian on Qubes OS. Here is a link fyi. I will try what you did out. Debian must have crypttab nomenclature that is different from Fedora. You made it look too easy. `luks-machineID UUID=` is the key? Or` rd.luks` > **[FIDO and Fedora - Yubikey C Bio](https://discussion.fedoraproject.org/t/fido-and-fedora-yubikey-c-bio/82462/68)** > > Boot parameters and UUID for systemd-crypt ††\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* The missing piece might be in systemd-cryptsetup-\[generator\](https://man.archlinux.org/man/systemd-cryptsetup-generator.8.en). “If /etc/crypttab exists, only those UUIDs... ---
### Author: ![nku](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/n/2bfe46/32.png) [@nku](https://support.nitrokey.com/u/nku) #### Post date: [October 30, 2023, 6:03am UTC](https://support.nitrokey.com/t/unlocking-luks-volume-with-nitrokey-3-on-debian-12-2/5553/3 "2023-10-30T06:03:56Z")
Thanks for the nice tutorial. As tutorials are meant to be replicated, I just wanted to mention that [TRIM setting is a controversial topic](https://asalor.blogspot.com/2011/08/trim-dm-crypt-problems.html) and has security implications to consider. ---
### Author: ![FredL](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/f/3d9bf3/32.png) [@FredL](https://support.nitrokey.com/u/FredL) #### Post date: [October 30, 2023, 7:00pm UTC](https://support.nitrokey.com/t/unlocking-luks-volume-with-nitrokey-3-on-debian-12-2/5553/4 "2023-10-30T19:00:13Z")
From what I know, you need a distribution using systemd (at least version 248) and using systemd-cryptsetup in the initrd to unlock the LUKS volume. Fedora seems to have these prerequisites. In crypttab, after you must change the line : `vda5_crypt UUID=XXX none luks,discard` to `luks-XXX UUID=XXX none luks,discard` Where XXX is the UUID of the partition. You can check the UUID of a partition with the `blkid` command. From what I see, the crypttab file have the same nomenclature on Debian and Fedora. You can compare the Fedora manpage for crypttab with the Debian one: [https://manpages.debian.org/bookworm/cryptsetup/crypttab.5.en.html](https://manpages.debian.org/bookworm/cryptsetup/crypttab.5.en.html) ---
### Author: ![FredL](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/f/3d9bf3/32.png) [@FredL](https://support.nitrokey.com/u/FredL) #### Post date: [October 30, 2023, 7:13pm UTC](https://support.nitrokey.com/t/unlocking-luks-volume-with-nitrokey-3-on-debian-12-2/5553/5 "2023-10-30T19:13:08Z")
Thanks for the link, I didn’t know it was a controversial topic. I didn’t touch the default Debian configuration that why discard is present. But obviously you should consider using it or not, knowing the security implications. ---
### Author: ![FredL](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/f/3d9bf3/32.png) [@FredL](https://support.nitrokey.com/u/FredL) #### Post date: [October 30, 2023, 7:27pm UTC](https://support.nitrokey.com/t/unlocking-luks-volume-with-nitrokey-3-on-debian-12-2/5553/6 "2023-10-30T19:27:20Z")
> [@SecureBoot](#): > > I am trying to do what you are doing with Debian on Qubes OS. > > Here is a link fyi. I don’t use `rd.luks`. Just `rd.auto` to tell dracut to handle LUKS volumes. But if you do just that, dracut will only try to unlock the LUKS volume by asking a password. You need to add the `hostonly=yes` in your dracut configuration so that `dracut -f` includes your `/etc/crypttab` file into the initrd. This way during the boot, dracut will know that it can unlock the LUKS volume with a fido2 device. ---
### Author: ![FredL](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/f/3d9bf3/32.png) [@FredL](https://support.nitrokey.com/u/FredL) #### Post date: [November 1, 2023, 3:47pm UTC](https://support.nitrokey.com/t/unlocking-luks-volume-with-nitrokey-3-on-debian-12-2/5553/7 "2023-11-01T15:47:42Z")
I have done more tests and things can be simplified a bit more! When you set `hostonly=yes` in dracut configuration, the file `/etc/crypttab` is included into the initrd. Since dracut will have this file during boot, you don’t need to: - add `rd.auto=1` in `/etc/default/grub` - rename the target in `/etc/crypttab` So it boils down to: ```auto # # Switch from initramfs-tools to Dracut to manage initrd # apt install dracut apt purge cryptsetup-initramfs && apt autoremove -purge echo "hostonly=yes" > /etc/dracut.conf.d/10-hostonly.conf dracut -f # Test that the switch to dracut is working by rebooting 😀 reboot # # Enroll your FIDO2 device to unlock Luks volume # apt install fido2-tools nano /etc/crypttab # Change the line: # vda5_crypt UUID=165e9c6c-6277-49b1-ac51-94158b504964 none luks,discard # to: # vda5_crypt UUID=165e9c6c-6277-49b1-ac51-94158b504964 none luks,discard,fido2-device=auto # Update initrd to include FIDO2 tools and updated /etc/crypttab dracut -f # Plug your FIDO2 device systemd-cryptenroll -fido2-device=list # Check your FIDO2 device is listed systemd-cryptenroll -fido2-device=auto /dev/vda5 # Test if everything works as expected ! 😀 reboot ``` ---
### Author: ![kaugummi](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/k/bbe5ce/32.png) [@kaugummi](https://support.nitrokey.com/u/kaugummi) #### Post date: [April 3, 2024, 8:16pm UTC](https://support.nitrokey.com/t/unlocking-luks-volume-with-nitrokey-3-on-debian-12-2/5553/8 "2024-04-03T20:16:17Z")
I had some trouble with your code. ```auto # # Switch from initramfs-tools to Dracut to manage initrd # sudo -i nano /etc/default/grub # Change the line with GRUB_CMDLINE_LINUX_DEFAULT like this: # GRUB_CMDLINE_LINUX_DEFAULT="quiet rd.auto=1" update-grub nano /etc/crypttab # Change the line: # sda3_crypt UUID=165e9c6c-6277-49b1-ac51-94158b504964 none luks,discard # to: # luks-165e9c6c-6277-49b1-ac51-94158b504964 UUID=165e9c6c-6277-49b1-ac51-94158b504964 none luks,discard apt install dracut apt purge cryptsetup-initramfs && apt autoremove --purge dracut -f # Test that the switch to dracut is working by rebooting 😀 reboot # Enroll your FIDO2 device to unlock Luks volume sudo -i apt install fido2-tools # Plug your FIDO2 device systemd-cryptenroll --fido2-device=list systemd-cryptenroll --fido2-device=list # Check your FIDO2 device is listed systemd-cryptenroll --fido2-device=/dev/hidraw0 /dev/sda3 nano /etc/crypttab # Change the line: # luks-165e9c6c-6277-49b1-ac51-94158b504964 UUID=165e9c6c-6277-49b1-ac51-94158b504964 none luks,discard # to: # luks-165e9c6c-6277-49b1-ac51-94158b504964 UUID=165e9c6c-6277-49b1-ac51-94158b504964 none luks,discard,fido2-device=/dev/hidraw0 echo 'hostonly=yes' > /etc/dracut.conf.d/10-hostonly.conf dracut -f # Test if everything works as expected ! 😀 reboot # Mit folgendem Befehl kann man fehlerhafte Slots wieder löschen: systemd-cryptenroll --wipe-slot=1 /dev/sda3 ``` ---
### Author: ![FredL](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/f/3d9bf3/32.png) [@FredL](https://support.nitrokey.com/u/FredL) #### Post date: [April 4, 2024, 3:02pm UTC](https://support.nitrokey.com/t/unlocking-luks-volume-with-nitrokey-3-on-debian-12-2/5553/9 "2024-04-04T15:02:50Z")
@kaugummi What problem ? ---
### Author: ![kaugummi](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/k/bbe5ce/32.png) [@kaugummi](https://support.nitrokey.com/u/kaugummi) #### Post date: [April 4, 2024, 4:32pm UTC](https://support.nitrokey.com/t/unlocking-luks-volume-with-nitrokey-3-on-debian-12-2/5553/10 "2024-04-04T16:32:44Z")
``` apt purge cryptsetup-initramfs && apt autoremove --purge # here you only have a hyphen before purge (-purge) # Plug your FIDO2 device systemd-cryptenroll --fido2-device=list # here you only have a hyphen before fido2-device (-fido2-device) systemd-cryptenroll --fido2-device=list # here too (-fido2-device) # Check your FIDO2 device is listed systemd-cryptenroll --fido2-device=/dev/hidraw0 /dev/sda3 # here too (-fido2-device) echo 'hostonly=yes' > /etc/dracut.conf.d/10-hostonly.conf # here I had "hostonly=yes" in 10-hostonly.conf. So with quotation marks. ``` ---
### Author: ![kaugummi](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/k/bbe5ce/32.png) [@kaugummi](https://support.nitrokey.com/u/kaugummi) #### Post date: [April 4, 2024, 4:49pm UTC](https://support.nitrokey.com/t/unlocking-luks-volume-with-nitrokey-3-on-debian-12-2/5553/11 "2024-04-04T16:49:20Z")
Many thanks for the instructions. Everything worked after the improvements. ---
### Author: ![FredL](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/f/3d9bf3/32.png) [@FredL](https://support.nitrokey.com/u/FredL) #### Post date: [April 4, 2024, 6:35pm UTC](https://support.nitrokey.com/t/unlocking-luks-volume-with-nitrokey-3-on-debian-12-2/5553/12 "2024-04-04T18:35:34Z")
@kaugummi You’re welcome Yes, some characters have been changed by the forum text editor : double hyphen into single hyphen, double quote into strange double quote… ---
### Author: ![berto](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/b/51bf81/32.png) [@berto](https://support.nitrokey.com/u/berto) #### Post date: [May 13, 2024, 12:05pm UTC](https://support.nitrokey.com/t/unlocking-luks-volume-with-nitrokey-3-on-debian-12-2/5553/13 "2024-05-13T12:05:53Z")
Hi, for those using Debian and initramfs-tools I wrote a small tool to unlock a LUKS volume using a FIDO2 key: [GitHub - bertogg/fido2luks: Unlock LUKS volumes at boot time using a FIDO2 token and initramfs-tools](https://github.com/bertogg/fido2luks) ---
### Author: ![obey](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/o/e47c2d/32.png) [@obey](https://support.nitrokey.com/u/obey) #### Post date: [May 24, 2024, 7:19pm UTC](https://support.nitrokey.com/t/unlocking-luks-volume-with-nitrokey-3-on-debian-12-2/5553/14 "2024-05-24T19:19:49Z")
How do you select the unlock option once the fido key is enrolled and `fido2-device=auto` is part of the cryottab? Is unlocking with a password still possible? ---
### Author: ![FredL](https://support.nitrokey.com/letter_avatar_proxy/v4/letter/f/3d9bf3/32.png) [@FredL](https://support.nitrokey.com/u/FredL) #### Post date: [May 24, 2024, 7:43pm UTC](https://support.nitrokey.com/t/unlocking-luks-volume-with-nitrokey-3-on-debian-12-2/5553/15 "2024-05-24T19:43:12Z")
Hi @obey Yes, you can still unlock the partition with a password (if you have setup one). There is 2 possibilities: 1/ If the FIDO2 device PIN is not necessary to unlock the partition Boot with no FIDO2 device plugged and after 30s seconds the system will try to ask a password 2/ If the FIDO2 device PIN is necessary to unlock the partition Boot with no FIDO2 device plugged, type a PIN (any PIN but not an empty one) and after 30s seconds the system will try to ask a password See [FIDO2 fallback to password · Issue #19872 · systemd/systemd · GitHub](https://github.com/systemd/systemd/issues/19872)