Tang in early boot

[nemihome]

Hello,

Maybe I'm missunderstanding the documentation:
https://access.redhat.com/documentation/de-de/red_hat_enterprise_linux/8/html/security_hardening/configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption_security-hardening

In the description the luks key is bound to localhost in the documentation.

I have installed clevis-initramfs and getting the message that clevis has found network interface at early boot. But seems to be tang is not running at that time in early boot.

I do understood that the basic idea is that tang is running on another server and not the same where clevis is running but in my case the idea is just that the drives can not be read by anyone if stolen. That's still the case if tang and clevis coming up byself.

If that is not possible the documentation is missguiding because this localhost bindings do make no sense. In this case this should not be localhost but remotehost for the lunks binding.

[fatihsennik]

I think that you misunderstood the doc. When do you use Tang? The real LUKS keys are never transmitted, and the Tang key server always needs to be located in a different location, never in the same location as Clevis. So Tang just allows unlocking a remote server's LUKS volumes by using a network server. Within the server itself it is called localhost; on the remote server it is referred to by the Tang server's remote IP. What's more, the main motivation of LUKS is to protect your important information from theft. If they steal your device, they cannot read your data, and you can revoke the access on the Tang server. Also, do not trust the Tang server blindly. Always add a backup key slot to your LUKS and keep it somewhere safe.

Clevis needs to reach Tang before the root filesystem mounts, but if your network interface isn't up yet, the whole thing silently fails and drops you to a passphrase prompt. So before embedding Clevis into your boot process, you need to make sure that your server is getting an IP via static or DHCP, and accordingly you need to update your /etc/initramfs-tools/initramfs.conf file.
So do not treat Tang as TPM, because for best practice it should not be on the same device.

You can read my blog.