Magically unlocking your LUKS drive on boot

Prompt: I want a cool image for my blog about unlocking LUKS with Tang and Clevis. Make it awesome.

I encrypt all my Linux hard drives, and so should you. Unlocking them, especially on some far-away server that you don't have physical access to, however, is a bloody pain. Do I buy a KVM over IP? Is that even safe? It's a quandary.

Typically I've used Dropbear, a weird, magical SSH terminal that let me connect to my Linux machine over SSH even before boot, enter my decryption string, and we were off the the races. But then Ubuntu changed its LUKS unlocker from initramfs to something called "Dracut", and Dropbear just doesn't work.

At first I cursed Canonical, but it forced me to find something even better: Tang and Clevis.

Tang is a really cool server that sends out a key. You can drop it somewhere on your local network, and get your Ubuntu machine, using Clevis, to grab the key and unlock the drive.

If your machine (or drive) is stolen or removed from the network, you're back to entering your unlock string manually. Else your machine just sorts itself out and boots - no more SSH'ing in to weird ports!

Here's the full instructions. My first attempt didn't work, so I added the network drivers and the DHCP to Grub, and I'm not entirely sure which one of those fixed the problem, but I'm not re-running the experiment. I suspect you probably don't need to do the network driver step, but it probably doesn't hurt either.

Server Setup

sudo apt install tang
sudo mkdir -p /etc/systemd/system/tangd.socket.d/
sudo nano /etc/systemd/system/tangd.socket.d/override.conf

override.conf:

[Socket]
ListenStream=
ListenStream=7500

(No idea why we need two of those lines)

sudo systemctl daemon-reload
sudo systemctl enable --now tangd.socket
# Test
curl -s http://localhost:7500/adv
ip a # Get your local IP - assuming 192.168.1.100 for this example

Client

# Make sure we can see the server
curl -s http://192.168.1.100:7500/adv
sudo apt install clevis clevis-luks clevis-dracut
sudo dracut --force
# Test
sudo lsinitrd | grep clevis
# Make sure we have the right drive - get the UUID for the crypto_LUKS drive
lsblk -o NAME,TYPE,FSTYPE,MOUNTPOINTS,UUID
sudo clevis luks bind -d /dev/disk/by-uuid/<UUID> tang '{"url":"http://192.168.1.100:7500"}'
echo 'add_dracutmodules+=" network clevis "' | sudo tee /etc/dracut.conf.d/clevis.conf
sudo dracut --force --add-drivers "e1000e igc r8169" # (Include your ethernet driver if needed)
sudo pico /etc/default/grub

Add ip=dhcp to your grub cmdline defautl:

GRUB_CMDLINE_LINUX_DEFAULT="... ip=dhcp"

You should be good to go.

sudo reboot now

It might take a second to login. Hit esc to see the command line if you're stuck on the LUKS screen.