Hello,
I am using disko to configure initial partitioning and luks encryption. The config file I use is taken from disko/example/luks-fido2.nix at ff8702b4de27f72b4c78573dfb89ec74e36abdf1 · nix-community/disko · GitHub with some minimal changes (device path). Is there a way to skip touching the presence button on Yubikey (or any other similar device) during install and boot? I am trying to do headless install/boot with minimal user interaction.
Thanks in advance.
I think you need to set extraFido2EnrollArgs = [ "--fido2-with-user-presence=false" ]
You may also need --fido2-with-client-pin=no unless you want to ssh in to provide the pin on boot
Oh, nice, thanks. Do you know if there is a way to use this on already installed system or it’s better to reinstall?
I’m fairly certain you can run systemd-cryptenroll manually and re-enroll your Fido key with the new settings.
Does this work for you when you open the LUKS volume as well? I came across this Reddit post and this GitHub issue that mention an error(?) in the spec that forces user presence when unlocking the volume.
Do you mean to unlock it separately or the unlock that happens during boot? If the latter, it still requires user presence even though I passed -fido2-with-user-presence=false as option.
Also when it’s mounted by disko, but yes, the latter. Hmm… That’s a shame. I’ll have to try it my other ideas, then…