search

agherzan / yubikey-full-disk-encryption

Use YubiKey to unlock a LUKS partition
Apache License 2.0
795 stars 50 forks source link

Fails during boot. #50

Closed confuso closed 5 years ago

confuso commented 5 years ago

Hi, I wanted to use this package on my freshly installed full-disk encrypted arch installation. However, I cannot unlock my device during boot using Yubikey...

When I test the configuration: ykfde-open -d /dev/sda2 -s 2 -t I can successfully decrypt my device. During boot, I'm asked for the password, but not to push the button on my Yubikey like it is done during the test case. The unlock then fails.

My /etc/default/grub looks like: GRUB_CMDLINE_LINUX_DEFAULT="quiet cryptdevice=/dev/sda2:Archlinux root=/dev/mapper/Archlinux-root"

and my hooks in /etc/mkinitcpio.conf look like HOOKS=(base udev autodetect keyboard keymap modconf block ykfde encrypt lvm2 filesystems keyboard fsck)

My /etc/ykfde.conf is unchanged, everything is commented. I tried the procedure with DBG=1 to get further information, but I can just see that ykfde is trying my challenge to unlock my device without making any attempt to receive data from the yubikey.

Probably I'm still doing something wrong, but I can't see it. So I'm sorry if this is a stupid mistake.

Thank you

Vincent43 commented 5 years ago

My /etc/ykfde.conf is unchanged, everything is commented.

You have to choose which mode you want to use in /etc/ykfde.conf in order to use initramfs hook. ykfde-open script automatically falls back to Manual mode with secret challenge (2FA) if nothing was set in config but initramfs hook doesn't because we want to support case where user didn't setup any ykfde passphrase at all

confuso commented 5 years ago

I'm sorry, I missed that, now it's perfectly working. Thank you for the great tool.