How to add LUKS Passphrase as backup to clevis/tang

[DSDV]

Hi all,
sorry if this is the wrong place. i sadly could not find a better one to ask.

I found a description how to add clevis/tang here: https://coreos.github.io/butane/examples/#luks-encrypted-storage
but on debian systems the clevis setup comes usually after the initial install.
and i case the server looses network access an admin can locally still enter the passphrase.
How can this be done with coreos/butane ?

tl;dr:
Can someone please tell me how to add a passphrase for LUKS in addition to the clevis/tang to butane / coreos?

with kind regards

[travier]

I don't think we have sugar in Butane or specific support for doing that in Ignition right now. You would have to write a custom systemd service unit to set it up or do it manually.

[travier]

To do it manually you can use cryptsetup luksAddKey /dev/<your-device> and type your passphrase.

To do it automatically via Butane/Ignition, you have to consider that the key you are adding will be part of the Ignition config and anyone with access to it will get it. Thus you need to remove the Ignition config after the first boot or ensure that no-one as access to it anymore (i.e. it's not in the metadata service of a cloud provided without firewalling).

Then you can use Starting a script on first boot via a systemd service as an example to write a systemd service unit and use the same command above in the unit, passing it a file with your key for example (you can add this file with Ignition itself as that service unit will run in the final root, not in the initrd).

[DSDV]

thank you very much for your help (:

i tried cryptsetup luksAddKey but that needs an existing passphrase for validation. since there is none yet that method did not work.

but in the fedora chat (not sure if i am allowed to name the kind user here)
an example butane config was provided with an inline option to add a plain text passphrase:

luks:
    - name: root
      device: /dev/disk/by-partlabel/root
      wipe_volume: true
      key_file:
        inline: [...]
      clevis:
        tang:
          - url: '[...]' 
          thumbprint: [...]

that worked (:

but i agree that the warning must be acknowledged that a plain text passphrase in a config is pretty dangerous!
so changing the passphrase after install would be my recommendation.

[DSDV]

also for someone reading this in the future and getting stuck at broken installs after trying to add luks to the butane config:

as for now as soon as you add luks you have to also add manual file system and partitioning stuff.
also the kind person also provided a full example of the storage part that would be needed:

storage:
  disks:
    - device: /dev/disk/by-id/coreos-boot-disk
      partitions:
        - label: root
          wipe_partition_entry: true
          number: 4
  luks:
    - name: root
      device: /dev/disk/by-partlabel/root
      wipe_volume: true
      key_file:
        inline: [...]
      clevis:
        tang:
          - url: '[...]'
            thumbprint: [...]
  filesystems:
    - device: /dev/mapper/root
      format: xfs
      label: root
      with_mount_unit: false
      wipe_filesystem: true

replace the blanks ([...]) with your own passphrase tang server and tang thumbprint
(which can be found on the server running tang for example via tang-show-keys)

also i changed the file system format to btrfs on my VM (or ext4 if you dont need cow in your VMs)