News for hackers. Stuff that matters.

A comment on I picked up a shitty NUC from ewaste and it had a label on it for an AI company. Parent comment

Re:I picked up a shitty NUC from ewaste and it had a label o... by michaelt on Tuesday August 20, 2024 @08:28AM (#41299439)
> You can use "keyscript=" in "/etc/crypttab" to run any script you want.

...unless your distro uses systemd, which removes keyscript support [1] because the systemd guy "really dislikes generic callouts"

[1] https://github.com/systemd/systemd/pull/3007

[ Parent | on HN ]
Re:I picked up a shitty NUC from ewaste and it had a label o... by pacificenigma on Tuesday August 20, 2024 @10:01AM (#41300162)
For years I've used https://github.com/anatol/booster to unlock LUKS partitions using network bound disk encryption with https://github.com/latchset/clevis and https://github.com/latchset/tang. Works well, especially as Tang is stateless (so deployment and high availability is easy) and Booster falls back to password entry if Tang is unavailable.
[ Parent | on HN ]
Re:I picked up a shitty NUC from ewaste and it had a label o... by aflukasz on Wednesday August 21, 2024 @09:16AM (#41309984)
Thumbs up for clevis/tang, happy user here, too!

Did not hear about booster. Its README claims "Clevis style data binding. The encrypted filesystem can be bound to TPM2 chip or to a network service.". Does it mean that it tries to deliver various bindings independently from clevis pins, even when duplicating their functions?

[ Parent | on HN ]
Re:I picked up a shitty NUC from ewaste and it had a label o... by sterlind on Tuesday August 20, 2024 @08:43AM (#41299545)
you can apparently provide a Unix socket path in /etc/crypttab now, and it will connect and read the key from the socket. so you can have the same functionality, but you have to get at it a different way:

https://github.com/systemd/systemd/pull/17524

[ Parent | on HN ]
Re:I picked up a shitty NUC from ewaste and it had a label o... by adriancr on Tuesday August 20, 2024 @08:43AM (#41299550)
It's 2024 and keyscript still works fine on ubuntu
[ Parent | on HN ]
Re:I picked up a shitty NUC from ewaste and it had a label o... by aflukasz on Wednesday August 21, 2024 @09:32AM (#41310121)
I don't use this param at the moment anywhere to confirm experimentally, but I'm pretty sure it's same on Debian: https://salsa.debian.org/cryptsetup-team/cryptsetup/-/blob/7....
[ Parent | on HN ]