Clevis autounlock with tpm1

[zayatz52]

Hi!
Thank you for your work, instruction was very helpful.
Recently needed to setup Proxmox on machine with TPM 1.2 module. Did most of steps but Clevis autounlock stage needed to be adjusted for TPM 1.2 devices.
Want to share my steps to make it done. Appreciate if you add it to instruction.

Bind the LUKS partition to TPM1 using Clevis

Install the necessary TPM1 tools to interact with the TPM module and Clevis with its related packages for LUKS and TPM1 integration at boot.

apt install -y clevis clevis-luks clevis-initramfs tpm-tools trousers

Install clevis-tpm1:

• https://github.com/oldium/clevis/releases
• https://repo.oldium.net/deb/debian/dists/trixie/

curl -fsSL https://repo.oldium.net/deb/archive-keyring.asc |
gpg --dearmor -o /etc/apt/trusted.gpg.d/repo.oldium.net.gpg

tee /etc/apt/sources.list.d/repo.oldium.net.sources >/dev/null <<'EOF'
Types: deb deb-src
URIs: https://repo.oldium.net/deb/debian
Suites: trixie
Components: main
Signed-By: /etc/apt/trusted.gpg.d/repo.oldium.net.gpg
EOF

apt update && install -y clevis-tpm1

Make sure tscd enabled and running:

systemctl enable tcsd
systemctl start tcsd

TPM1 PIN Limitations
To avoid prompting for a password during unlocking, the encryption and decryption processes require that the well-known Storage Root Key (SRK) be configured when taking ownership of the TPM 1.2 chip. This means you must have either run the tpm_takeownership command

tpm_takeownership --srk-well-known

during setup or executed tpm_changeownerauth command

tpm_changeownerauth --srk --set-well-known

to configure it. Note that a well-known key is not the same as an empty key.

Clear the TPM in case you made some tests before. Should the command fail, then you need to reset your TPM via the BIOS/UEFI.

tpm_clear

Execute this command for every LUKS partition:

-- SATA/SCSI/SAS drives

clevis luks bind -d /dev/sda3 tpm1 '{"pcr_bank":"sha256", "pcr_ids":"1,7"}'

clevis luks bind -d /dev/sdb3 tpm1 '{"pcr_bank":"sha256", "pcr_ids":"1,7"}'

# and other LUKS partitions if you have some

-- NVMe drives

clevis luks bind -d /dev/nvme0n1p3 tpm1 '{"pcr_bank":"sha256", "pcr_ids":"1,7"}'

clevis luks bind -d /dev/nvme1n1p3 tpm1 '{"pcr_bank":"sha256", "pcr_ids":"1,7"}'

# and other LUKS partitions if you have some