Skip to content

clevis TPM2 prviatekey #33

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

clevis TPM2 prviatekey #33

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,27 @@ wireguard first. Then restrict to the wireguard network once it is working:
DROPBEAR_OPTIONS='... -p 172.31.255.10:22 ...'
```


## Clevis-TPM2

`wireguard-initramfs` can be combined with clevis-tpm2 to enable the protection
of the wireguard private key. This protection does only make sense, if the owner
is capable of using a TPM correctly.
This information needs to be undestood!
- https://uapi-group.org/specifications/specs/linux_tpm_pcr_registry/

You need to adapt for wg-quick usage:
`PostUp = wg set %i private-key <(sh -c "clevis decrypt tpm2 < /etc/wireguard/privatekey.jwe")`

The PreSharedKey is not secured in this way!
### Requirements

1. a working TPM2
2. [clevis-tpm2](https://github.com/latchset/clevis) installed and firm to use
2. [clevis-initramfs](https://github.com/latchset/clevis) installed and firm to use
3. a jwe encoded wireguard private key


## Legacy compatibility (Migration)

If you are a user using a previous release, such as the one dated
Expand Down
2 changes: 1 addition & 1 deletion configs/initramfs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,4 +57,4 @@ DATETIME_URL=google.com
PERSISTENT=

# Enable debug logging (will expose key material)? Any value enables.
DEBUG=
DEBUG=
23 changes: 19 additions & 4 deletions initramfs/hooks
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,10 @@ WG_INTERFACE_ADDRESSES=$(echo -n "$(echo "${WG_INTERFACE_SECTION}" | grep -i add
WG_INTERFACE_MTU=$(echo "${WG_INTERFACE_SECTION}" | grep -i mtu | sed 's/mtu[ ]*=[ ]*//I')
WG_INTERFACE_FW_MARK=$(echo "${WG_INTERFACE_SECTION}" | grep -i fwmark | sed 's/fwmark[ ]*=[ ]*//I')
WG_INTERFACE_LISTEN_PORT=$(echo "${WG_INTERFACE_SECTION}" | grep -i listenport | sed 's/listenport[ ]*=[ ]*//I')
WG_INTERFACE_KEY=$(echo "${WG_INTERFACE_SECTION}" | grep -i privatekey | sed 's/privatekey[ ]*=[ ]*//I')

if [ ! -s "/etc/wireguard/privatekey.jwe" ]; then
WG_INTERFACE_KEY=$(echo "${WG_INTERFACE_SECTION}" | grep -i privatekey | sed 's/privatekey[ ]*=[ ]*//I')
fi

INTERFACE_ADDR_IPV4=''
INTERFACE_ADDR_IPV6=''
Expand Down Expand Up @@ -100,8 +103,20 @@ if [ -n "${ENABLE_QUICK}" ]; then
copy_exec /usr/bin/bash
copy_exec /usr/bin/wg-quick /sbin
else
# wg base adapter config.
cat > "${DESTDIR}${ADAPTER}" <<EOL
if [ -s "/etc/wireguard/privatekey.jwe" ]; then
echo "copy jwe privatekey"
cp "/etc/wireguard/privatekey.jwe" "${DESTDIR}/etc/wireguard/privatekey.jwe"
# wg base adapter config.
cat > "${DESTDIR}${ADAPTER}" <<EOL
[Interface]
ListenPort = ${WG_INTERFACE_LISTEN_PORT:-0}
FwMark = ${WG_INTERFACE_FW_MARK:-0}

[Peer]
${WG_PEER_SECTIONS}
EOL
else
cat > "${DESTDIR}${ADAPTER}" <<EOL
[Interface]
PrivateKey = ${WG_INTERFACE_KEY}
ListenPort = ${WG_INTERFACE_LISTEN_PORT:-0}
Expand All @@ -110,8 +125,8 @@ FwMark = ${WG_INTERFACE_FW_MARK:-0}
[Peer]
${WG_PEER_SECTIONS}
EOL
fi
fi

# initramfs config with required primitives to turn-up interfaces.
cat > "${DESTDIR}/etc/wireguard/initramfs" <<EOL
ADAPTER="${ADAPTER}"
Expand Down
7 changes: 6 additions & 1 deletion initramfs/init-premount
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,7 +168,12 @@ if [ -n "${ENABLE_QUICK}" ]; then
wg-quick up "${ADAPTER}"
else
ip link add dev "${INTERFACE}" type wireguard
wg setconf "${INTERFACE}" "${ADAPTER}"
if [ -e "/etc/wireguard/privatekey.jwe" ]; then
log_success_msg "Found jwe keyfile"
clevis decrypt tpm2 < /etc/wireguard/privatekey.jwe > /etc/wireguard/privatekey
wg set "${INTERFACE}" private-key /etc/wireguard/privatekey
fi
wg addconf "${INTERFACE}" "${ADAPTER}"

# Interface must be up before adding routes.
if [ -n "${INTERFACE_MTU}" ]; then
Expand Down