search

latchset / clevis

Automated Encryption Framework
GNU General Public License v3.0
929 stars 104 forks source link

Clevis+Tang+v6-only network doesn't work #215

Open jpds opened 4 years ago

jpds commented 4 years ago

I have a network which only has IPv6 addressing, and I would like to port the servers on this network over to Clevis-based disk encryption.

On the servers themselves, this works fine:

$ echo hi | clevis encrypt tang '{"url": "http://tang.local"}' > hi.jwe

However, on either CentOS or Debian, I cannot seem to make dracut/initramfs work with just the IPv6 addresses as these tools seem to always expect a DHCP response (even though I'm fairly sure my NIC got an autoassigned IPv6 address).

natxo commented 4 years ago

I have implemented nbde with ipv6 exclusively but it was a bit trial and error. The main issue was getting dracut to work: link in centos 7, you need to configure dracut's kernel_cmdline and rebuilding the initrd

If you only have router advertisement for acquiring an ipv6 address, then you have no name servers and you need to tell dracut in centos what your nameserver is. If this network allows using external nameservers, you could try using google's nameservers (2001:4860:4860::8888 or 2001:4860:4860::8844). If you can, try using dhcpv6, the dnsmasq implementation is really trivial and provides the clients with nameservers.

sarroutbi commented 3 years ago

@jpds : did you try solution provided by @natxo? Can we close this issue?