Breadcrumbs

Configuring LUKS partition to use encryption key on Utimaco HSM

  1. List all the slots using the command below.

›_ Console 

# p11tool --provider /opt/utimaco/lib/libcs_pkcs11_R3.so --list-all
image-3285221661-1.jpg

Slot information

  1. List the objects on the slot and note down the URL of the certificate and private key.

›_ Console 

# p11tool --provider /opt/utimaco/lib/libcs_pkcs11_R3.so --login --listall pkcs11:token=UTILUKS
image-3285221661-2.jpg

Slot objects list

  1. Add pkcs11 module in /etc/pkcs11/modules/utpkcs11.module file.

›_ utpkcs11.module File 

module: /opt/utimaco/lib/libcs_pkcs11_R3.so
image-3285221661-3.jpg

Content of utpkcs11.module

  1. Enroll the certificate on LUKS drive using systemd-cryptenroll command.

›_ Console 

# systemd-cryptenroll --pkcs11-token-

uri="pkcs11:model=CryptoServer;manufacturer=Utimaco%20IS%20GmbH; serial=SI003001_0000;token=UTILUKS;id=%45;object=LUKSCERT;type=cert" /dev/sdc1
image-3285221661-4.jpg

systemd-cryptenroll command output

Provide slot PIN when prompted.

  1. Verify that the pkcs11 url is added to the luks partition in the tokens section.

›_ Console 

# cryptsetup luksDump /dev/sdc1
image-3285221661-5.jpg

Encrypted volume information

image-3285221661-6.jpg

Encrypted volume information

  1. Open the luks volume as mybackup disk.

›_ Console 

# cryptsetup luksOpen /dev/sdc1 mybackup
image-3285221661-7.jpg

luksopen command output

  1. Export token using the command below to header.json file.

›_ Console 

# cryptsetup token export –-token-id 0 /dev/sdc1 > header.json
image-3285221661-8.jpg

Exporting token id information

  1. Open header.json file and replace the pkcs-uri with type=private url.

Example

›_ header.json file 

pkcs11:model=CryptoServer;manufacturer=Utimaco%20IS%20GmbH;serial=CS7108 43_0014;token=UTILUKS;id=%45;object=LUKSPrivateKey;type=private

  1. Import the header.json file.

›_ Console 

# cryptsetup token import –-json-file header.json –-token-id 1 /dev/sdc1
image-3285221661-9.jpg

Importing token id information

  1. Verify token id 1 using below command.

›_ Console 

# cryptsetup luksDump /dev/sdc1
image-3285221661-10.jpg

LuksDump output

image-3285221661-11.jpg

LuksDump output

  1. Remove token id 0 and verify with below command.

›_ Console 

# cryptsetup token remove –-token-id 0 /dev/sdc1 

# cryptsetup luksDump /dev/sdc1
image-3285221661-12.jpg

Removing old token id

image-3285221661-13.jpg

Removing old token id

  1. Close the LUKS volume.

›_ Console 

# cryptsetup luksClose mybackup

  1. Attach the LUKS volume with systemd-cryptsetup.

›_ Console 

# /usr/lib/systemd/systemd-cryptsetup attach luks /dev/sdc1 - pkcs11uri="auto"
image-3285221661-14.jpg

Attaching LUKS volume

Provide slot PIN when prompted.