Disko + fido2 - skip presence touch

Help
1

Hello,

I am using disko to configure initial partitioning and luks encryption. The config file I use is taken from disko/example/luks-fido2.nix at ff8702b4de27f72b4c78573dfb89ec74e36abdf1 · nix-community/disko · GitHub with some minimal changes (device path). Is there a way to skip touching the presence button on Yubikey (or any other similar device) during install and boot? I am trying to do headless install/boot with minimal user interaction.

Thanks in advance.

2

I think you need to set extraFido2EnrollArgs = [ "--fido2-with-user-presence=false" ]

You may also need --fido2-with-client-pin=no unless you want to ssh in to provide the pin on boot

3

Oh, nice, thanks. Do you know if there is a way to use this on already installed system or it’s better to reinstall?

4

I’m fairly certain you can run systemd-cryptenroll manually and re-enroll your Fido key with the new settings.