Comments

• 

  over 2 years ago by oertel | Reply

  worked on the luks2.sh script from https://en.opensuse.org/SDB:LUKS2,TPM2and_FIDO2 to support the setup of just /boot/efi separate and / including /boot on lvm inside the crypted disk

  ```

  !/bin/bash

  LVM="" GRUBMOUNT=$(df /boot/grub2 | tail -n1) GRUBMOUNT=${GRUBMOUNT%% *} set -- $(lsblk -p -r | grep "^$GRUBMOUNT") DEV=$1 TYP=$6 MP=$7 case $TYP in lvm) LVM="lvm" LVMGRUB=${GRUBMOUNT#/dev/mapper/} GRUBROOT="($LVM/$LVMGRUB)" case $MP in /) GRUBPREFIX=($LVM/$LVMGRUB)/boot/grub2 ;; /boot) GRUBPREFIX=($LVM/$LVMGRUB)/grub2 ;; /boot/grub2) GRUBPREFIX=($LVM/$LVMGRUB) ;; esac ;; part) LVM="" case $DEV in /dev/sda) DISK=hd0 ;; /dev/sdb) DISK=hd1 ;; /dev/sdc*) DISK=hd2 ;; esac PART=${DEV: -1} GRUBPREFIX="($DISK.gpt$PART)" case $MP in /) echo "/ not encrypted, not needed here" ; exit 1 ;; /boot) GRUBPREFIX="$GRUB_PREFIX/grub2" ;; esac ;; esac

  set -- $(lsblk -p -r | grep " /$") ROOTDEV=$1 ROOTTYP=$6 case $ROOTTYP in crypt) GRUBROOT=crypto0 ;; esac set -- $(blkid | grep crypto_LUKS)

  second param is UUID=

  eval $2

  drop the - dashes

  TARGET=${UUID//-/}

  GRUBMODULES="luks2 partgpt cryptodisk gcryrijndael pbkdf2 gcrysha512 btrfs gcrysha256 gcrysha1 ext2 luks $LVM"

  grub2-install --target=x8664-efi --modules="$GRUBMODULES"

  CONFIG=$(mktemp /tmp/grub-config.XXXXX) cat >"$CONFIG" <<EOF cryptomount -u "$TARGET" set root=$GRUBROOT set prefix=$GRUBPREFIX insmod normal normal EOF

  cat $CONFIG

  grub2-mkimage \ -p "$GRUBPREFIX" \ -O x8664-efi \ -c "$CONFIG" \ -o /tmp/image \ $GRUB_MODULES rm "$CONFIG"

  cp -v /tmp/image /boot/efi/EFI/opensuse/grubx64.efi

  ```

×
Edit Comment 6389
# A First Level Header
## A Second Level Header

Use one asterisk to *emphasize*

Use two asterisks for **strong emphasis**

- Use hyphens
- for unordereed
- lists

This is an [link to example.com](http://example.com/)

This is an image ![an openSUSE geeko icon](https://en.opensuse.org/images/d/d0/Icon-distribution.png)

This is a user link @hans

This is a project link hw#some-cool-title
More Complex Markdown Help
Formatting Help
• Edit
• Preview
worked on the luks2.sh script from https://en.opensuse.org/SDB:LUKS2,_TPM2_and_FIDO2 to support the setup of just /boot/efi separate and / including /boot on lvm inside the crypted disk ``` #!/bin/bash LVM="" GRUB_MOUNT=$(df /boot/grub2 | tail -n1) GRUB_MOUNT=${GRUB_MOUNT%% *} set -- $(lsblk -p -r | grep "^$GRUB_MOUNT") DEV=$1 TYP=$6 MP=$7 case $TYP in lvm) LVM="lvm" LVM_GRUB=${GRUB_MOUNT#/dev/mapper/} GRUB_ROOT="($LVM/$LVM_GRUB)" case $MP in /) GRUB_PREFIX=($LVM/$LVM_GRUB)/boot/grub2 ;; /boot) GRUB_PREFIX=($LVM/$LVM_GRUB)/grub2 ;; /boot/grub2) GRUB_PREFIX=($LVM/$LVM_GRUB) ;; esac ;; part) LVM="" case $DEV in /dev/sda*) DISK=hd0 ;; /dev/sdb*) DISK=hd1 ;; /dev/sdc*) DISK=hd2 ;; esac PART=${DEV: -1} GRUB_PREFIX="($DISK.gpt$PART)" case $MP in /) echo "/ not encrypted, not needed here" ; exit 1 ;; /boot) GRUB_PREFIX="$GRUB_PREFIX/grub2" ;; esac ;; esac set -- $(lsblk -p -r | grep " /$") ROOT_DEV=$1 ROOT_TYP=$6 case $ROOT_TYP in crypt) GRUB_ROOT=crypto0 ;; esac set -- $(blkid | grep crypto_LUKS) #second param is UUID= eval $2 #drop the - dashes TARGET=${UUID//-/} GRUB_MODULES="luks2 part_gpt cryptodisk gcry_rijndael pbkdf2 gcry_sha512 btrfs gcry_sha256 gcry_sha1 ext2 luks $LVM" grub2-install --target=x86_64-efi --modules="$GRUB_MODULES" CONFIG=$(mktemp /tmp/grub-config.XXXXX) cat >"$CONFIG" <<EOF cryptomount -u "$TARGET" set root=$GRUB_ROOT set prefix=$GRUB_PREFIX insmod normal normal EOF cat $CONFIG grub2-mkimage \ -p "$GRUB_PREFIX" \ -O x86_64-efi \ -c "$CONFIG" \ -o /tmp/image \ $GRUB_MODULES rm "$CONFIG" cp -v /tmp/image /boot/efi/EFI/opensuse/grubx64.efi ```
 
×
Reply to oertel
worked on the luks2.sh script from https://en.opensuse.org/SDB:LUKS2,TPM2and_FIDO2 to support the setup of just /boot/efi separate and / including /boot on lvm inside the crypted disk
```
!/bin/bash
LVM="" GRUBMOUNT=$(df /boot/grub2 | tail -n1) GRUBMOUNT=${GRUBMOUNT%% *} set -- $(lsblk -p -r | grep "^$GRUBMOUNT") DEV=$1 TYP=$6 MP=$7 case $TYP in lvm) LVM="lvm" LVMGRUB=${GRUBMOUNT#/dev/mapper/} GRUBROOT="($LVM/$LVMGRUB)" case $MP in /) GRUBPREFIX=($LVM/$LVMGRUB)/boot/grub2 ;; /boot) GRUBPREFIX=($LVM/$LVMGRUB)/grub2 ;; /boot/grub2) GRUBPREFIX=($LVM/$LVMGRUB) ;; esac ;; part) LVM="" case $DEV in /dev/sda) DISK=hd0 ;; /dev/sdb) DISK=hd1 ;; /dev/sdc*) DISK=hd2 ;; esac PART=${DEV: -1} GRUBPREFIX="($DISK.gpt$PART)" case $MP in /) echo "/ not encrypted, not needed here" ; exit 1 ;; /boot) GRUBPREFIX="$GRUB_PREFIX/grub2" ;; esac ;; esac
set -- $(lsblk -p -r | grep " /$") ROOTDEV=$1 ROOTTYP=$6 case $ROOTTYP in crypt) GRUBROOT=crypto0 ;; esac set -- $(blkid | grep crypto_LUKS)
second param is UUID=
eval $2
drop the - dashes
TARGET=${UUID//-/}
GRUBMODULES="luks2 partgpt cryptodisk gcryrijndael pbkdf2 gcrysha512 btrfs gcrysha256 gcrysha1 ext2 luks $LVM"
grub2-install --target=x8664-efi --modules="$GRUBMODULES"
CONFIG=$(mktemp /tmp/grub-config.XXXXX) cat >"$CONFIG" <<EOF cryptomount -u "$TARGET" set root=$GRUBROOT set prefix=$GRUBPREFIX insmod normal normal EOF
cat $CONFIG
grub2-mkimage \ -p "$GRUBPREFIX" \ -O x8664-efi \ -c "$CONFIG" \ -o /tmp/image \ $GRUB_MODULES rm "$CONFIG"
cp -v /tmp/image /boot/efi/EFI/opensuse/grubx64.efi
```
---
# A First Level Header
## A Second Level Header

Use one asterisk to *emphasize*

Use two asterisks for **strong emphasis**

- Use hyphens
- for unordereed
- lists

This is an [link to example.com](http://example.com/)

This is an image ![an openSUSE geeko icon](https://en.opensuse.org/images/d/d0/Icon-distribution.png)

This is a user link @hans

This is a project link hw#some-cool-title
More Complex Markdown Help
Formatting Help
• Edit
• Preview
 
• 

  over 2 years ago by oertel | Reply

  hacked up a patch for systemd to have a chance to notice the user should touch the token on bootup

  ``` --- a/src/shared/libfido2-util.c +++ b/src/shared/libfido2-util.c @@ -345,6 +345,13 @@ static int fido2usehmachashspecifictoken( lognotice("%s%sPlease confirm presence on security to unlock.", emojienabled() ? specialglyph(SPECIALGLYPHTOUCH) : "", emojienabled() ? " " : ""); + + if (!retrywithup) { + /* notify user for a few secs on first try */ + _cleanup(strvfreeerasep) char **pin = NULL; + askpasswordauto("Please confirm presence on security token to unlock.", "drive-harddisk", NULL, "fido2-up", "fido2-up", usecadd(now(CLOCKMONOTONIC), 5 * USECPERSEC), 0, &pin); + } + retrywithup = true; }

  ```

×
Edit Comment 6392
# A First Level Header
## A Second Level Header

Use one asterisk to *emphasize*

Use two asterisks for **strong emphasis**

- Use hyphens
- for unordereed
- lists

This is an [link to example.com](http://example.com/)

This is an image ![an openSUSE geeko icon](https://en.opensuse.org/images/d/d0/Icon-distribution.png)

This is a user link @hans

This is a project link hw#some-cool-title
More Complex Markdown Help
Formatting Help
• Edit
• Preview
hacked up a patch for systemd to have a chance to notice the user should touch the token on bootup ``` --- a/src/shared/libfido2-util.c +++ b/src/shared/libfido2-util.c @@ -345,6 +345,13 @@ static int fido2_use_hmac_hash_specific_token( log_notice("%s%sPlease confirm presence on security to unlock.", emoji_enabled() ? special_glyph(SPECIAL_GLYPH_TOUCH) : "", emoji_enabled() ? " " : ""); + + if (!retry_with_up) { + /* notify user for a few secs on first try */ + _cleanup_(strv_free_erasep) char **pin = NULL; + ask_password_auto("Please confirm presence on security token to unlock.", "drive-harddisk", NULL, "fido2-up", "fido2-up", usec_add(now(CLOCK_MONOTONIC), 5 * USEC_PER_SEC), 0, &pin); + } + retry_with_up = true; } ```
 
×
Reply to oertel
hacked up a patch for systemd to have a chance to notice the user should touch the token on bootup
``` --- a/src/shared/libfido2-util.c +++ b/src/shared/libfido2-util.c @@ -345,6 +345,13 @@ static int fido2usehmachashspecifictoken( lognotice("%s%sPlease confirm presence on security to unlock.", emojienabled() ? specialglyph(SPECIALGLYPHTOUCH) : "", emojienabled() ? " " : ""); + + if (!retrywithup) { + /* notify user for a few secs on first try */ + _cleanup(strvfreeerasep) char **pin = NULL; + askpasswordauto("Please confirm presence on security token to unlock.", "drive-harddisk", NULL, "fido2-up", "fido2-up", usecadd(now(CLOCKMONOTONIC), 5 * USECPERSEC), 0, &pin); + } + retrywithup = true; }
```
---
# A First Level Header
## A Second Level Header

Use one asterisk to *emphasize*

Use two asterisks for **strong emphasis**

- Use hyphens
- for unordereed
- lists

This is an [link to example.com](http://example.com/)

This is an image ![an openSUSE geeko icon](https://en.opensuse.org/images/d/d0/Icon-distribution.png)

This is a user link @hans

This is a project link hw#some-cool-title
More Complex Markdown Help
Formatting Help
• Edit
• Preview
 
• 

  over 2 years ago by oertel | Reply

  for systemd on 15.4 this is:

  ``` --- systemd-v249.11+suse.129.g17d488c53a/src/shared/libfido2-util.c 2022/07/01 09:41:51 1.1 +++ systemd-v249.11+suse.129.g17d488c53a/src/shared/libfido2-util.c 2022/07/01 09:42:43 @@ -292,6 +292,11 @@ lognotice("%s%sPlease confirm presence on security token to unlock.", emojienabled() ? specialglyph(SPECIALGLYPHTOUCH) : "", emojienabled() ? " " : ""); + + /* notify user for a few secs on first try / + cleanup(strvfreeerasep) char *pin = NULL; + askpasswordauto("Please confirm presence on security token to unlock.", "drive-harddisk", NULL, "fido2-up", "fido2-up", usecadd(now(CLOCKMONOTONIC), 5 * USECPERSEC), 0, &pin); + }

       if (has_uv && !FLAGS_SET(required, FIDO2ENROLL_UV_OMIT)) {
  

  ```

×
Edit Comment 6407
# A First Level Header
## A Second Level Header

Use one asterisk to *emphasize*

Use two asterisks for **strong emphasis**

- Use hyphens
- for unordereed
- lists

This is an [link to example.com](http://example.com/)

This is an image ![an openSUSE geeko icon](https://en.opensuse.org/images/d/d0/Icon-distribution.png)

This is a user link @hans

This is a project link hw#some-cool-title
More Complex Markdown Help
Formatting Help
• Edit
• Preview
for systemd on 15.4 this is: ``` --- systemd-v249.11+suse.129.g17d488c53a/src/shared/libfido2-util.c 2022/07/01 09:41:51 1.1 +++ systemd-v249.11+suse.129.g17d488c53a/src/shared/libfido2-util.c 2022/07/01 09:42:43 @@ -292,6 +292,11 @@ log_notice("%s%sPlease confirm presence on security token to unlock.", emoji_enabled() ? special_glyph(SPECIAL_GLYPH_TOUCH) : "", emoji_enabled() ? " " : ""); + + /* notify user for a few secs on first try */ + _cleanup_(strv_free_erasep) char **pin = NULL; + ask_password_auto("Please confirm presence on security token to unlock.", "drive-harddisk", NULL, "fido2-up", "fido2-up", usec_add(now(CLOCK_MONOTONIC), 5 * USEC_PER_SEC), 0, &pin); + } if (has_uv && !FLAGS_SET(required, FIDO2ENROLL_UV_OMIT)) { ```
 
×
Reply to oertel
for systemd on 15.4 this is:
``` --- systemd-v249.11+suse.129.g17d488c53a/src/shared/libfido2-util.c 2022/07/01 09:41:51 1.1 +++ systemd-v249.11+suse.129.g17d488c53a/src/shared/libfido2-util.c 2022/07/01 09:42:43 @@ -292,6 +292,11 @@ lognotice("%s%sPlease confirm presence on security token to unlock.", emojienabled() ? specialglyph(SPECIALGLYPHTOUCH) : "", emojienabled() ? " " : ""); + + /* notify user for a few secs on first try / + cleanup(strvfreeerasep) char *pin = NULL; + askpasswordauto("Please confirm presence on security token to unlock.", "drive-harddisk", NULL, "fido2-up", "fido2-up", usecadd(now(CLOCKMONOTONIC), 5 * USECPERSEC), 0, &pin); + }
     if (has_uv && !FLAGS_SET(required, FIDO2ENROLL_UV_OMIT)) {
```
---
# A First Level Header
## A Second Level Header

Use one asterisk to *emphasize*

Use two asterisks for **strong emphasis**

- Use hyphens
- for unordereed
- lists

This is an [link to example.com](http://example.com/)

This is an image ![an openSUSE geeko icon](https://en.opensuse.org/images/d/d0/Icon-distribution.png)

This is a user link @hans

This is a project link hw#some-cool-title
More Complex Markdown Help
Formatting Help
• Edit
• Preview