Nicholas Santiago santiagon610

Decrypt LUKS volumes with a TPM on Fedora Linux

This guide allows you to use the TPM on your computer to decrypt your LUKS encrypted volumes. If you are worried about a cold boot attack on your hardware please DO NOT use this guide with your root volume!

Preflight Checks

Verify that you have a TPM in your computer:

# systemd-cryptenroll --tpm2-device=list
PATH DEVICE DRIVER

centos8 @ OVH/SoYouStart/Kimsufi

How to install CentOS 8 on OVH/SoYouStart/Kimsufi

connect to the OVH/SoYouStart/Kimsufi API and create a ipxe script under https://eu.api.kimsufi.com/console/#/me/ipxeScript#POST or equivalent, see centos8.ipxe below
boot your server from this netboot, and ping it to follow the process. If you can observe the webserver's logs you will se your server's IP pulling kernel and initrd with "iPXE" user agent, then it will start pinging, and retrieve the kickstart.cfg a bit later (with "curl" user agent). This is the moment when you could set your server back to "Boot from Hard Disk".
Also at this point you can connect to your server with SSH using the key/password set in the kickstart file. type tmux a to attach the install's tmux session and follow the progress. For debugging, check the logs in /tmp and those sent over syslog.

upstream documentation

[kernel/installer boot params in ipxe script](https://access.redhat.com/documentation/en-us/red_hat_enterprise_li

Python3 Virtualenv Setup

Requirements

Python 3
Pip 3

$ brew install python3

	#!/usr/bin/env bash

	echo "RENEWED_LINEAGE: ${RENEWED_LINEAGE}"

	# requires `yq` and `jq` cli tools
	OKTA_API_TOKEN=$(yq --raw-output .okta.client.token ~/.okta/okta.yaml)
	API_URL="${1}/api/internal/v1/custom-url-domain/certificate"
	CERT=$(cat "${RENEWED_LINEAGE}/cert.pem")
	KEY=$(cat "${RENEWED_LINEAGE}/privkey.pem")
	CHAIN=$(cat "${RENEWED_LINEAGE}/chain.pem")

	#!/bin/bash
	set -o errexit

	clear
	printf "\n* This script will download a cloud image and create a Proxmox VM template from it. *\n\n"

	### HOW TO USE
	### Pre-req:
	### - run on a Proxmox 6 server
	### - a dhcp server should be active on vmbr1