Full Disk Encryption - Revision history

Golbinex at 17:00, 23 July 2026

2026-07-23T17:00:26Z

← Older revision		Revision as of 17:00, 23 July 2026
Line 170:		Line 170:
	Because the TPM is attached to your computer, it provides no protection against a stolen computer when used on its own (it usually allows for setting a password, but that is it). It can only protect against a stolen drive.		Because the TPM is attached to your computer, it provides no protection against a stolen computer when used on its own (it usually allows for setting a password, but that is it). It can only protect against a stolen drive.

	== Encrypted /boot ==		= Encrypted /boot =
	[https://libreboot.org/ Libreboot] supports decrypting boot partition with built-in GRUB.		[https://libreboot.org/ Libreboot] supports decrypting boot partition with built-in GRUB.

Golbinex: Add Encrypted boot

2026-07-23T16:58:28Z

Add Encrypted boot

← Older revision		Revision as of 16:58, 23 July 2026
Line 169:		Line 169:

	Because the TPM is attached to your computer, it provides no protection against a stolen computer when used on its own (it usually allows for setting a password, but that is it). It can only protect against a stolen drive.		Because the TPM is attached to your computer, it provides no protection against a stolen computer when used on its own (it usually allows for setting a password, but that is it). It can only protect against a stolen drive.

			== Encrypted /boot ==
			[https://libreboot.org/ Libreboot] supports decrypting boot partition with built-in GRUB.

			Example layout of unified LUKS-encrypted btrfs partition:

			* boot subvolume mounted at /boot
			* home subvolume mounted at /home
			* nix subvolume mounted at /nix
			* swap subvolume mounted at /swap

			NixOS-generated grub.cfg may cause problems when loaded with Libreboot GRUB, so using extlinux configuration file is recommended instead.<syntaxhighlight lang="nix">
			boot.loader.grub.enable = false;
			boot.loader.generic-extlinux-compatible.enable = true;
			</syntaxhighlight>Partition can be decrypted and booted with following GRUB commands:<syntaxhighlight lang="console">
			# cryptomount -a
			# try_bootcfg crypto0 # assuming configuration file is located at /boot/extlinux/extlinux.conf
			</syntaxhighlight>

	= zimbatm's laptop recommendation =		= zimbatm's laptop recommendation =

DHCP: style fixes

2026-07-19T14:36:04Z

style fixes

Show changes

Voklen: Add additional info and remove unnecessary steps in TPM2 section

2026-06-25T11:59:37Z

Add additional info and remove unnecessary steps in TPM2 section

← Older revision		Revision as of 11:59, 25 June 2026
Line 147:		Line 147:
	=== TPM2 ===		=== TPM2 ===

	To store a key on the TPM2 module to unlock the device unattended, ~~check if your~~ <code>~~configuration.nix~~</code> ~~has a line~~ similar to ~~the one below (with~~ <~~code~~>~~YOUR-UUID</code> replaced with your device's actual UUID)~~:		To store a key on the TPM2 module to unlock the device unattended, first find the UUID values of the encrypted LUKS devices. One way to do this is by running the <code>lsblk</code> command and seeing an output similar to:
	~~{{file\|/etc/nixos/configuration~~.~~nix\|nix\|3=~~		<pre>
	boot.~~initrd.luks.devices."luks~~-~~YOUR~~-~~UUID"~~.~~device = "~~/~~dev~~/~~disk~~/~~by-uuid/YOUR-UUID";~~		NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
	}}		nvme0n1 259:0 0 1.8T 0 disk
	~~Then this is the device we want to add the crypttab option to. If your configuration does not contain this line, then you can find it through this command~~:		├─nvme0n1p1 259:1 0 1G 0 part /boot
	~~<syntaxhighlight lang="sh">~~		├─nvme0n1p2 259:2 0 1.8T 0 part
	~~nixos~~-~~option boot.initrd.luks~~.~~devices~~		│ └─luks-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 254:1 0 1.8T 0 crypt /nix/store
	</~~syntaxhighlight~~>		│ /
			└─nvme0n1p3 259:3 0 8G 0 part
	~~To unlock the device using TPM2, add the following to your configuration to enable systemd stage 1 and to add the tpm2 option to crypttab.~~		└─luks-yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy 254:0 0 7.9G 0 crypt [SWAP]
			</pre>
	~~{{file\|/etc/nixos/configuration.nix\|nix\|3=~~
	~~boot.initrd.systemd.enable = true;~~

	~~boot.initrd.luks.~~devices."luks-~~YOUR~~-~~UUID" = {~~		You are looking for devices in the format of <code>luks-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx</code> where <code>xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx</code> is replaced with an actual UUID. There may be multiple of these drives, in which case complete the following step on each device individually if unlocking via TPM2 is desired for all (in this example there are two devices due to the encrypted swap).
	~~device = "~~/~~dev/disk/by~~-~~uuid~~/~~YOUR-~~UUID";
	~~crypttabExtraOpts = [ "tpm2-~~device~~=auto" ];~~
	};
	}}

	~~Rebuild and reboot before running~~ the following command:		Run the following command but replace <code>YOUR-UUID</code> with the UUID you found in the previous step '''without the <code>luks-</code> at the start''':
	<syntaxhighlight lang="sh">		<syntaxhighlight lang="sh">
	sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto ~~--tpm2-pcrs=0~~ /dev/disk/by-uuid/YOUR-UUID		sudo systemd-cryptenroll --wipe-slot=tpm2 --tpm2-device=auto /dev/disk/by-uuid/YOUR-UUID
	</syntaxhighlight>		</syntaxhighlight>

	Now the device should unlock without prompting you for the password. After this is working, you can ~~run~~ the above command again ~~and add more PCRs such as~~ <code>--tpm2-pcrs=0+7</code> if your system uses [[~~Secure Boot~~]]~~. A good set of options is~~ <code>--tpm2-pcrs=0+2+7+12</code> ~~and you can find all of them documented at the [https://uapi-group.org/specifications/specs/linux_tpm_pcr_registry/ Linux TPM PCR Registry]~~.		Now the device should unlock without prompting you for the password. After this is working, you should add certain restrictions to your saved key using Platform Configuration Registers (PCR). All options for these can be found at the [https://uapi-group.org/specifications/specs/linux_tpm_pcr_registry/ Linux TPM PCR Registry]. If using the default <code>systemd-boot</code> without [[Secure Boot]], then a standard set of options to use is <code>4+9+12</code>. This can be applied by running the above command again with <code>--tpm2-pcrs=4+9+12</code>. If your system uses secure boot with [[Limine]] you may want to use <code>--tpm2-pcrs=4+7+8+9</code> instead.

	Because the TPM is attached to your computer, it provides no protection against a stolen computer when used on its own (it usually allows for setting a password, but that is it). It can only protect against a stolen drive.		Because the TPM is attached to your computer, it provides no protection against a stolen computer when used on its own (it usually allows for setting a password, but that is it). It can only protect against a stolen drive.

Voklen: Add section explaining how to store a key on TPM2

2026-06-03T13:46:21Z

Add section explaining how to store a key on TPM2

@@ Line 145: / Line 145: @@
 For FIDO2, directly read the [https://github.com/NixOS/nixpkgs/blob/7be68f763d94cdb4c809b7980647828e3274a511/nixos/doc/manual/configuration/luks-file-systems.section.md chapter in the official manual].
-For TPM, replace the crypttab and systemd-cryptsetup option <code>fido2-device=auto</code> with <code>tpm-device=auto</code> for systemd stage 1. See [https://github.com/NixOS/nixpkgs/blob/7be68f763d94cdb4c809b7980647828e3274a511/nixos/tests/systemd-initrd-luks-tpm2.nix this integration test] in the nixpkgs source code repository.
+=== TPM2 ===
 Because the TPM is attached to your computer, it provides no protection against a stolen computer when used on its own (it usually allows for setting a password, but that is it). It can only protect against a stolen drive.

Arch is the best: Move unlock KWallet with LUKS password section to KDE page

2026-04-21T01:04:26Z

Move unlock KWallet with LUKS password section to KDE page

← Older revision		Revision as of 01:04, 21 April 2026
Line 277:		Line 277:

	Again, the secondary drive will be unlocked and made available under <code>/dev/mapper/cryptstorage</code> for mounting.		Again, the secondary drive will be unlocked and made available under <code>/dev/mapper/cryptstorage</code> for mounting.

	~~= Autologin using LUKS password =~~

	One downside of full disk encryption is that you need to type in your password twice, once for unlocking the disk and once to log into your desktop. One approach is to skip the LUKS password, such as by using a TPM2, but is [https://oddlama.org/blog/bypassing-disk-encryption-with-tpm2-unlock/ difficult to properly secure]. The other approach is to enable autologin for your display manager:
	~~<syntaxhighlight lang="nix">~~
	{
	~~services.displayManager.autoLogin.user = "my username";~~
	}
	~~</syntaxhighlight>~~

	However, this breaks software such as KWallet which uses the login password to automatically unlock its keyring. The solution is to set the LUKS password, login password, and KWallet keyring password all to the same string, and then use the LUKS password to unlock KWallet. The LUKS password is first collected by a systemd initrd, saved to the kernel keyring, read out by SDDM via a PAM module, then finally passed off to KWallet.
	~~<syntaxhighlight lang="nix">~~
	{
	~~boot.initrd.systemd.enable = true;~~
	~~systemd.services.display-manager.serviceConfig.KeyringMode = "inherit";~~
	~~security.pam.services.sddm-autologin.text = pkgs.lib.mkBefore ''~~
	~~auth optional ${pkgs.systemd}/lib/security/pam_systemd_loadkey.so~~
	~~auth include sddm~~
	~~'';~~
	}
	~~</syntaxhighlight>~~

	= Further reading =		= Further reading =

Pigeon: fix consistency with wording "USB stick" and minor typos

2025-09-10T13:12:08Z

fix consistency with wording "USB stick" and minor typos

← Older revision		Revision as of 13:12, 10 September 2025
Line 46:		Line 46:
	== Unattended Boot via USB ==		== Unattended Boot via USB ==

	Sometimes it is necessary to boot a system without needing an keyboard and monitor. You will create a secret key, add it to a key slot and put it onto an USB stick.		Sometimes it is necessary to boot a system without needing a keyboard and monitor. You will create a secret key, add it to a key slot and put it onto a USB stick.

	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
Line 55:		Line 55:
	=== Option 1: Write key onto the start of the stick ===		=== Option 1: Write key onto the start of the stick ===

	This will make the ~~usb-~~stick unusable for any other operations than being used for decryption. Write the key onto the stick:		This will make the USB stick unusable for any other operations than being used for decryption. Write the key onto the stick:

	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
Line 82:		Line 82:
	}</syntaxhighlight>		}</syntaxhighlight>

	=== Option 2: Copy Key as file onto a vfat ~~usb~~ stick ===		=== Option 2: Copy Key as file onto a vfat USB stick ===

	If you want to use your stick for other stuff or it already has other keys on it you can use the following method by Tzanko Matev. Add this to your <code>configuration.nix</code>:		If you want to use your stick for other stuff or it already has other keys on it you can use the following method by Tzanko Matev. Add this to your <code>configuration.nix</code>:
Line 100:		Line 100:
	boot.initrd.postDeviceCommands = pkgs.lib.mkBefore ''		boot.initrd.postDeviceCommands = pkgs.lib.mkBefore ''
	mkdir -m 0755 -p /key		mkdir -m 0755 -p /key
	sleep 2 # To make sure the ~~usb~~ key has been loaded		sleep 2 # To make sure the USB key has been loaded
	mount -n -t vfat -o ro `findfs UUID=${PRIMARYUSBID}` /key \|\| mount -n -t vfat -o ro `findfs UUID=${BACKUPUSBID}` /key		mount -n -t vfat -o ro `findfs UUID=${PRIMARYUSBID}` /key \|\| mount -n -t vfat -o ro `findfs UUID=${BACKUPUSBID}` /key
	'';		'';

Arch is the best: Add section about SDDM autologin using LUKS password

2025-08-20T15:29:22Z

Add section about SDDM autologin using LUKS password

@@ Line 1: / Line 1: @@
-There are a few options for full disk encryption. The easiest way is to use the graphical installer and choose „encrypt“ while doing the installation.
+There are a few options for full disk encryption. The easiest way is to use the graphical installer and choose "encrypt" while doing the installation.
 = LVM on LUKS =
@@ Line 277: / Line 277: @@
 Again, the secondary drive will be unlocked and made available under <code>/dev/mapper/cryptstorage</code> for mounting.
 = Further reading =
@@ Line 287: / Line 308: @@
 * [[Remote disk unlocking|Using Tor and SSH to unlock your LUKS Disk over the internet]].
 * [[Bcachefs]], filesystem which supports native encryption
-* [https://discourse.nixos.org/t/full-disk-encryption-tpm2/29454/2 Automatically unlock encrypted disks using tpm2]
+* [https://discourse.nixos.org/t/full-disk-encryption-tpm2/29454/2 Automatically unlock encrypted disks using TPM2]
 [[Category:Desktop]]
 [[Category:Server]]

Artoria2e5: /* Store key on TPM2 or FIDO2 */ ~

2025-07-10T11:21:40Z

Store key on TPM2 or FIDO2: ~

← Older revision		Revision as of 11:21, 10 July 2025
Line 140:		Line 140:
	</syntaxhighlight>		</syntaxhighlight>

	== Store key on ~~TPM2~~ or ~~FIDO2~~ ==		== Store key on FIDO2 device or TPM ==
	Unattended boot can also happen with ~~TPM2~~ or ~~FIDO2~~. This cannot be performed in a fully declarative way because every such security device is unique; some manual running of <code>systemd-cryptenroll</code> is required.		Unattended boot can also happen with a FIDO2 device (e.g. Yubikey) or TPM. This cannot be performed in a fully declarative way because every such security device is unique; some manual running of <code>systemd-cryptenroll</code> is required.

	For FIDO2, directly read the [https://github.com/NixOS/nixpkgs/blob/7be68f763d94cdb4c809b7980647828e3274a511/nixos/doc/manual/configuration/luks-file-systems.section.md chapter in the official manual].		For FIDO2, directly read the [https://github.com/NixOS/nixpkgs/blob/7be68f763d94cdb4c809b7980647828e3274a511/nixos/doc/manual/configuration/luks-file-systems.section.md chapter in the official manual].

Artoria2e5: /* Store key on TPM2 or FIDO2 */ ~

2025-07-10T11:20:31Z

Store key on TPM2 or FIDO2: ~

← Older revision		Revision as of 11:20, 10 July 2025
Line 141:		Line 141:

	== Store key on TPM2 or FIDO2 ==		== Store key on TPM2 or FIDO2 ==
	Unattended boot can also happen with TPM2 or FIDO2. This cannot be performed in a fully declarative way because every such security device is unique; some manual running of {{code\|systemd-cryptenroll}} is required.		Unattended boot can also happen with TPM2 or FIDO2. This cannot be performed in a fully declarative way because every such security device is unique; some manual running of <code>systemd-cryptenroll</code> is required.

	For FIDO2, directly read the [https://github.com/NixOS/nixpkgs/blob/7be68f763d94cdb4c809b7980647828e3274a511/nixos/doc/manual/configuration/luks-file-systems.section.md chapter in the official manual].		For FIDO2, directly read the [https://github.com/NixOS/nixpkgs/blob/7be68f763d94cdb4c809b7980647828e3274a511/nixos/doc/manual/configuration/luks-file-systems.section.md chapter in the official manual].