diff --git a/nixos/doc/manual/configuration/file-systems.xml b/nixos/doc/manual/configuration/file-systems.xml index 42c59844ff4a..908b5d6c4681 100644 --- a/nixos/doc/manual/configuration/file-systems.xml +++ b/nixos/doc/manual/configuration/file-systems.xml @@ -53,6 +53,6 @@ "nofail" ];. - + diff --git a/nixos/doc/manual/configuration/luks-file-systems.section.md b/nixos/doc/manual/configuration/luks-file-systems.section.md new file mode 100644 index 000000000000..b5d0407d1659 --- /dev/null +++ b/nixos/doc/manual/configuration/luks-file-systems.section.md @@ -0,0 +1,77 @@ +# LUKS-Encrypted File Systems {#sec-luks-file-systems} + +NixOS supports file systems that are encrypted using *LUKS* (Linux +Unified Key Setup). For example, here is how you create an encrypted +Ext4 file system on the device +`/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d`: + +```ShellSession +# cryptsetup luksFormat /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d + +WARNING! +======== +This will overwrite data on /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d irrevocably. + +Are you sure? (Type uppercase yes): YES +Enter LUKS passphrase: *** +Verify passphrase: *** + +# cryptsetup luksOpen /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d crypted +Enter passphrase for /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d: *** + +# mkfs.ext4 /dev/mapper/crypted +``` + +The LUKS volume should be automatically picked up by +`nixos-generate-config`, but you might want to verify that your +`hardware-configuration.nix` looks correct. To manually ensure that the +system is automatically mounted at boot time as `/`, add the following +to `configuration.nix`: + +```nix +boot.initrd.luks.devices.crypted.device = "/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d"; +fileSystems."/".device = "/dev/mapper/crypted"; +``` + +Should grub be used as bootloader, and `/boot` is located on an +encrypted partition, it is necessary to add the following grub option: + +```nix +boot.loader.grub.enableCryptodisk = true; +``` + +## FIDO2 {#sec-luks-file-systems-fido2} + +NixOS also supports unlocking your LUKS-Encrypted file system using a +FIDO2 compatible token. In the following example, we will create a new +FIDO2 credential and add it as a new key to our existing device +`/dev/sda2`: + +```ShellSession +# export FIDO2_LABEL="/dev/sda2 @ $HOSTNAME" +# fido2luks credential "$FIDO2_LABEL" +f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7 + +# fido2luks -i add-key /dev/sda2 f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7 +Password: +Password (again): +Old password: +Old password (again): +Added to key to device /dev/sda2, slot: 2 +``` + +To ensure that this file system is decrypted using the FIDO2 compatible +key, add the following to `configuration.nix`: + +```nix +boot.initrd.luks.fido2Support = true; +boot.initrd.luks.devices."/dev/sda2".fido2.credential = "f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7"; +``` + +You can also use the FIDO2 passwordless setup, but for security reasons, +you might want to enable it only when your device is PIN protected, such +as [Trezor](https://trezor.io/). + +```nix +boot.initrd.luks.devices."/dev/sda2".fido2.passwordLess = true; +``` diff --git a/nixos/doc/manual/configuration/luks-file-systems.xml b/nixos/doc/manual/configuration/luks-file-systems.xml deleted file mode 100644 index d8654d71ac00..000000000000 --- a/nixos/doc/manual/configuration/luks-file-systems.xml +++ /dev/null @@ -1,78 +0,0 @@ -
- LUKS-Encrypted File Systems - - - NixOS supports file systems that are encrypted using - LUKS (Linux Unified Key Setup). For example, here is how - you create an encrypted Ext4 file system on the device - /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d: - -# cryptsetup luksFormat /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d - -WARNING! -======== -This will overwrite data on /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d irrevocably. - -Are you sure? (Type uppercase yes): YES -Enter LUKS passphrase: *** -Verify passphrase: *** - -# cryptsetup luksOpen /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d crypted -Enter passphrase for /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d: *** - -# mkfs.ext4 /dev/mapper/crypted - - The LUKS volume should be automatically picked up by - nixos-generate-config, but you might want to verify that your - hardware-configuration.nix looks correct. - - To manually ensure that the system is automatically mounted at boot time as - /, add the following to - configuration.nix: - -boot.initrd.luks.devices.crypted.device = "/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d"; -."/".device = "/dev/mapper/crypted"; - - Should grub be used as bootloader, and /boot is located - on an encrypted partition, it is necessary to add the following grub option: - = true; - -
- FIDO2 - - - NixOS also supports unlocking your LUKS-Encrypted file system using a FIDO2 compatible token. In the following example, we will create a new FIDO2 credential - and add it as a new key to our existing device /dev/sda2: - - -# export FIDO2_LABEL="/dev/sda2 @ $HOSTNAME" -# fido2luks credential "$FIDO2_LABEL" -f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7 - -# fido2luks -i add-key /dev/sda2 f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7 -Password: -Password (again): -Old password: -Old password (again): -Added to key to device /dev/sda2, slot: 2 - - - To ensure that this file system is decrypted using the FIDO2 compatible key, add the following to configuration.nix: - -boot.initrd.luks.fido2Support = true; -boot.initrd.luks.devices."/dev/sda2".fido2.credential = "f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7"; - - - You can also use the FIDO2 passwordless setup, but for security reasons, you might want to enable it only when your device is PIN protected, such as Trezor. - - -boot.initrd.luks.devices."/dev/sda2".fido2.passwordLess = true; - - -
- -
diff --git a/nixos/doc/manual/from_md/configuration/luks-file-systems.section.xml b/nixos/doc/manual/from_md/configuration/luks-file-systems.section.xml new file mode 100644 index 000000000000..42b766eba98b --- /dev/null +++ b/nixos/doc/manual/from_md/configuration/luks-file-systems.section.xml @@ -0,0 +1,84 @@ +
+ LUKS-Encrypted File Systems + + NixOS supports file systems that are encrypted using + LUKS (Linux Unified Key Setup). For example, + here is how you create an encrypted Ext4 file system on the device + /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d: + + +# cryptsetup luksFormat /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d + +WARNING! +======== +This will overwrite data on /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d irrevocably. + +Are you sure? (Type uppercase yes): YES +Enter LUKS passphrase: *** +Verify passphrase: *** + +# cryptsetup luksOpen /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d crypted +Enter passphrase for /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d: *** + +# mkfs.ext4 /dev/mapper/crypted + + + The LUKS volume should be automatically picked up by + nixos-generate-config, but you might want to + verify that your hardware-configuration.nix looks + correct. To manually ensure that the system is automatically mounted + at boot time as /, add the following to + configuration.nix: + + +boot.initrd.luks.devices.crypted.device = "/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d"; +fileSystems."/".device = "/dev/mapper/crypted"; + + + Should grub be used as bootloader, and /boot is + located on an encrypted partition, it is necessary to add the + following grub option: + + +boot.loader.grub.enableCryptodisk = true; + +
+ FIDO2 + + NixOS also supports unlocking your LUKS-Encrypted file system + using a FIDO2 compatible token. In the following example, we will + create a new FIDO2 credential and add it as a new key to our + existing device /dev/sda2: + + +# export FIDO2_LABEL="/dev/sda2 @ $HOSTNAME" +# fido2luks credential "$FIDO2_LABEL" +f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7 + +# fido2luks -i add-key /dev/sda2 f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7 +Password: +Password (again): +Old password: +Old password (again): +Added to key to device /dev/sda2, slot: 2 + + + To ensure that this file system is decrypted using the FIDO2 + compatible key, add the following to + configuration.nix: + + +boot.initrd.luks.fido2Support = true; +boot.initrd.luks.devices."/dev/sda2".fido2.credential = "f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7"; + + + You can also use the FIDO2 passwordless setup, but for security + reasons, you might want to enable it only when your device is PIN + protected, such as + Trezor. + + +boot.initrd.luks.devices."/dev/sda2".fido2.passwordLess = true; + +
+