vtimofeenko / dracut-pcscd-cryptsetup

A dracut module that installs pcscd for systemd-cryptsetup to unlock a drive through pkcs#11

This dracut module installs the services that allow systemd-cryptsetup to unlock disks encrypted with PKCS11 token.

Installation

This module has been tested on Gentoo, but should in work on other Linux flavors.

Gentoo

Install from nitratesky overlay:

eselect repository enable nitratesky && emerge -a sys-kernel/dracut-pcscd-cryptsetup

Other

1. Install dependencies:

   • ccid
   • p11-kit
   • opensc
   • pcsc-lite

2. Create a dracut module directory (/usr/lib/dracut/modules.d/99pcscd-cryptsetup)

3. Place module-setup.sh file in that directory

Configuration

In order to use this module, add the following to your dracut configuration (located in /etc/dracut.conf or in /etc/dracut.conf.d/:

add_dracutmodules+=" pcscd-cryptsetup "

Make sure that the dracut configuration also contains

add_dracutmodules+=" crypt "

And /etc/crypttab is installed into initramfs:

install_items+=" /etc/crypttab "

Troubleshooting

This module contains _debug function that adds systemd-cryptenroll and opensc-tool to initramfs.

If [email protected] does not prompt for token password during boot, you can add call to _debug function into install function in module-setup.sh. On Gentoo, enable debug useflag and emerge --changed-use dracut-pcscd-module.

Then, once booted into dracut emergency shell, check if pcscd.service is running (run systemctl status).

Check if the reader is generally visible (run opensc-tool -l).

Check if systemd can see the token (run systemd-cryptenroll --pkcs11-token=list).

if no obvious error is returned – feel free to open an issue on Github.

dracut-pcscd-cryptsetup's Issues

Boot ignores PKCS11 enrolled root drive

Hey Vladimir!

My boot drive is enrolled with PKCS11 Yubiko card. You can check the details here, especially my last 2 comments: systemd/systemd#22866

My smart card is basically ignored and I use a backup password to decrypt.

I understand I need to include PCKS11 support to initramfs. But I am on Fedora 35 and your plugin is around an year old. Is your plugin still required and can it work on Dracut for Fedora?

Any help very much appreciated!