Hello everyone,
I recently bought a new laptop. While unboxing it, two things came to mind:
So, off to the races it was. I installed Void Linux with LUKS disk encryption. A few months later, I also bought a YubiKey. I now want to show you all the steps I took to set it up.
I first installed some packages that seemed to be related:
xbps-install u2f-hidraw-policy gnupg2-scdaemon ykpers yubikey-manager pcsc-ccid pcsclite
After that, I enabled the pcscd service:
ln -sv /etc/sv/pcscd /var/service
This is the easiest part. Configuring PAM allows you to use sudo, swaylock, (insert your favourite greeter here), and a lot of other programs that normally want your password.
I mostly followed the Gentoo Wiki here.
First, install pam_u2f:
xbps-install pam-u2f
Then, to use the pam_u2f module, enable it for system-auth by adding the following to the top of /etc/pam.d/system-auth:
auth sufficient pam_u2f.so cue
If you want to require a YubiKey, replace sufficient with required.
First create the directory and then generate the key file:
mkdir -p ~/.config/Yubico
pamu2fcfg > ~/.config/Yubico/u2f_keys
Note that you have to touch the key in the second step!
Most applications should already work by now, but for me, sudo didn’t.
For some reason, on Void Linux, sudo does not seem to use the global PAM configuration.
You can change that by replacing the contents of /etc/pam.d/sudo with the following:
#%PAM-1.0
auth substack system-auth
This is where I really struggled.
According to the Arch Wiki, I can just use the yubikey-full-disk-encryption package to enroll my key. But of course, that package did not exist in the Void repos.
So I looked at its source code, only to find out that it is pretty Arch-dependent.
Later, I stumbled upon Clevis Extra Pins, which provided a Clevis integration for YubiKeys.
First, I downloaded the two scripts from the repo to /usr/bin and made them executable:
wget -O /usr/bin/clevis-encrypt-yubikey https://github.com/anatol/clevis-extra-pins/raw/refs/heads/main/clevis-encrypt-yubikey
wget -O /usr/bin/clevis-decrypt-yubikey https://github.com/anatol/clevis-extra-pins/raw/refs/heads/main/clevis-decrypt-yubikey
chmod +x /usr/bin/clevis-encrypt-yubikey /usr/bin/clevis-decrypt-yubikey
I then tried to encrypt some data:
clevis encrypt yubikey '{"slot":"2"}' <<< 'hello, world'
But quickly noticed something: I forgot to configure the second slot:
ykpersonalize -2 -ochal-resp -ochal-hmac -ohmal-lt64
Then I ran into another problem:
The sha3-256sum command does not exist on Void Linux, so I replaced it with the normal sha256sum:
sed -i 's/sha3-256sum -x/sha256sum/g' /usr/bin/clevis-encrypt-yubikey
sed -i 's/sha3-256sum -x/sha256sum/g' /usr/bin/clevis-decrypt-yubikey
Now I was able to encrypt data using my YubiKey and Clevis. Yay! So I bound my YubiKey to my LUKS drive:
clevis luks bind -d /dev/sdX yubikey '{"slot":"2"}'
But there was just one problem: the initramfs.
Dracut is Void Linux’s default initramfs. It runs early userspace tasks like mounting the root filesystem. I wanted Dracut to decrypt my drive using Clevis.
Thankfully, there already was a Clevis hook for Dracut, so I just had to make one for the YubiKey pin.
I wrote the following to /usr/lib/dracut/modules.d/60clevis-pin-yubikey/module-setup.sh:
#!/bin/bash
depends() {
echo clevis
return 0
}
install() {
inst_multiple ykchalresp xxd sha256sum jose
inst_libdir_file libusb-1.0.so.0
inst clevis-decrypt-yubikey
}
After that, I reconfigured the initramfs and rebooted:
xbps-reconfigure -xf linux
Now it finally worked! I was able to decrypt my drive using my YubiKey.
]]>Hello everyone, I recently bought a new VPS. However the provider I bought it at (IONOS) does not provide NixOS images. At first I thought that Debian will be fine for me, but I quickly noticed, that NixOS is just way easier to maintain and reproduce. Especially on servers. So I quickly looked into ways of installing NixOS and I discovered two Methods:
NixOS Anywhere is a Nix module that can format the disk and install NixOS over SSH. It let’s you deploy your own flake and disko configuration onto your server. However at the time of installing, I never used Flakes and was somehow too afraid to try them out. Additionally the Machine I used for the installation didn’t have Nix installed which is required for NixOS Anywhere. So I looked into other Methods of installing NixOS.
NixOS-Infect is just a Shell script to install NixOS over another Distribution. This makes it possible to use basically any machine to install it from. You can even use the admin console of your VPS if you want. It doesn’t require any Interaction and creates it’s own NixOS configuration. However this also comes with some issues: The root password is unset and no additional user is created. So if you forget to set a SSH-key for the root user, you basically locked yourself out of your VPS. Not only that but the shell script isn’t coded very good and doesn’t have any error handling. I still decided to try this script out because it seemed very simple.
NixOS-Infect is pretty simple: First, add your public ssh key to the root user like this:
echo "<your ssh key>" >> /root/.ssh/authorized_keys
After that just run the shell script by running the following:
curl https://raw.githubusercontent.com/elitak/nixos-infect/master/nixos-infect | NIX_CHANNEL=nixos-<nixos version> bash -x
At the time of writing the latest NixOS version is 24.11, so I entered the following:
curl https://raw.githubusercontent.com/elitak/nixos-infect/master/nixos-infect | NIX_CHANNEL=nixos-24.11 bash -x
The script will automatically reboot your server and after it finished startup, You can login as the root user using the SSH-key you set up before.
After installation you can use the VPS like a normal NixOS machine and deploy a new configuration using flakes or the /etc/nixos/configuration.nix file. I would highly recommend creating a new user and removing the SSH-key from the root user. Additionally I also installed things like docker and tailscale to make maintaining easier.