[babuskov]

I thought that everyone has switched to Clevis + Tang for that?

https://access.redhat.com/documentation/en-us/red_hat_enterp...

It's fully automated and supposed to be much more secure.

Has anyone got experience with it?

[traceroute66]

> I thought that everyone has switched to Clevis + Tang for that?

Clevis+Tang is good. There's also Keylime which takes a different approach to the same[1].

[1] https://keylime.dev/

[soraminazuki]

IIUC whether that is secure depends on your threat model. For example, how good is automated unlocking compared to unencrypted drives in a homelab setup?

[ahepp]

I've seen a bit about Clevis. Is there a major difference between using this, and systemd-cryptenroll?

[babuskov]

I guess it depends on your use case. If you rent a bunch of bare-metal servers at a remote location and you want restarts after updates to be fully automated, Clevis seems like a way to do. The whole idea is that once you cancel the server, you just remove it from Tang's list and the next customer who gets those hard drives cannot read them.

AFAICT, systemd-cryptenroll requires that you have a USB key plugged into the machine, so someone with physical access would have to insert them at the start and remove when you're done with the server. With Clevis+Tang everything is software.

Or am I missing something?

[ahepp]

That makes sense. I was thinking about the case of using a TPM to unlock full disk encryption as long as secure boot hashes checked out.