Ubuntu Tpm2 Luks

Verifying the Functionality of TPM2 and LUKs Disk Encryption in Ubuntu

Introduction

This article will guide you through the process of configuring TPM2 with LUKs in Ubuntu to verify its functionality and utilize disk encryption. We will cover enrolling the TPM2, setting up LUKs encryption, and auto-unlocking the encrypted system partition.

Prerequisites

• Ubuntu Server 2004 LTS or later with full disk LUKS encryption enabled during installation
• TPM2 chip installed and enabled in the BIOS
• Basic understanding of Linux command line and systemd

Configuring TPM2 with LUKs

1. Enroll the TPM2 using systemd-cryptenroll:
   

   sudo systemd-cryptenroll --tpm2

2. Create a LUKS encrypted partition:
   

   sudo cryptsetup luksFormat /dev/sdX

   Replace /dev/sdX with the appropriate disk partition.
3. Open the LUKS partition:
   

   sudo cryptsetup luksOpen /dev/sdX my_luks_volume

   Choose a memorable passphrase for 'my_luks_volume'.
4. Bind the LUKS partition to the TPM2 using clevis:
   

   sudo clevis luks bind --tpm2 --volume my_luks_volume

5. Configure automatic unlocking:
   

   sudo systemctl enable --now systemd-cryptsetup@my_luks_volume

   Replace 'my_luks_volume' with the name of your LUKS partition.

Verification

Restart your system to verify that the LUKS partition is automatically unlocked using the TPM2. You should be able to boot into your system without entering the LUKS passphrase.

Conclusion

By following the steps outlined in this article, you have successfully configured and verified the functionality of TPM2 with LUKs disk encryption in Ubuntu. This setup provides enhanced security for your system by protecting your data at rest with strong encryption and leveraging the hardware-based security of the TPM2 chip.