mirror of
https://git.sr.ht/~nabijaczleweli/tzpfms
synced 2025-06-18 23:23:53 +03:00
188 lines
9.6 KiB
HTML
188 lines
9.6 KiB
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<meta http-equiv='content-type' content='text/html;charset=utf8'>
|
|
<meta name='generator' content='Ronn-NG/v0.9.1 (http://github.com/apjanke/ronn-ng/tree/0.9.1)'>
|
|
<title>zfs-tpm1x-change-key(8) - change ZFS dataset key to one stored on the TPM</title>
|
|
<style type='text/css' media='all'>
|
|
/* style: man */
|
|
body#manpage {margin:0}
|
|
.mp {max-width:100ex;padding:0 9ex 1ex 4ex}
|
|
.mp p,.mp pre,.mp ul,.mp ol,.mp dl {margin:0 0 20px 0}
|
|
.mp h2 {margin:10px 0 0 0}
|
|
.mp > p,.mp > pre,.mp > ul,.mp > ol,.mp > dl {margin-left:8ex}
|
|
.mp h3 {margin:0 0 0 4ex}
|
|
.mp dt {margin:0;clear:left}
|
|
.mp dt.flush {float:left;width:8ex}
|
|
.mp dd {margin:0 0 0 9ex}
|
|
.mp h1,.mp h2,.mp h3,.mp h4 {clear:left}
|
|
.mp pre {margin-bottom:20px}
|
|
.mp pre+h2,.mp pre+h3 {margin-top:22px}
|
|
.mp h2+pre,.mp h3+pre {margin-top:5px}
|
|
.mp img {display:block;margin:auto}
|
|
.mp h1.man-title {display:none}
|
|
.mp,.mp code,.mp pre,.mp tt,.mp kbd,.mp samp,.mp h3,.mp h4 {font-family:monospace;font-size:14px;line-height:1.42857142857143}
|
|
.mp h2 {font-size:16px;line-height:1.25}
|
|
.mp h1 {font-size:20px;line-height:2}
|
|
.mp {text-align:justify;background:#fff}
|
|
.mp,.mp code,.mp pre,.mp pre code,.mp tt,.mp kbd,.mp samp {color:#131211}
|
|
.mp h1,.mp h2,.mp h3,.mp h4 {color:#030201}
|
|
.mp u {text-decoration:underline}
|
|
.mp code,.mp strong,.mp b {font-weight:bold;color:#131211}
|
|
.mp em,.mp var {font-style:italic;color:#232221;text-decoration:none}
|
|
.mp a,.mp a:link,.mp a:hover,.mp a code,.mp a pre,.mp a tt,.mp a kbd,.mp a samp {color:#0000ff}
|
|
.mp b.man-ref {font-weight:normal;color:#434241}
|
|
.mp pre {padding:0 4ex}
|
|
.mp pre code {font-weight:normal;color:#434241}
|
|
.mp h2+pre,h3+pre {padding-left:0}
|
|
ol.man-decor,ol.man-decor li {margin:3px 0 10px 0;padding:0;float:left;width:33%;list-style-type:none;text-transform:uppercase;color:#999;letter-spacing:1px}
|
|
ol.man-decor {width:100%}
|
|
ol.man-decor li.tl {text-align:left}
|
|
ol.man-decor li.tc {text-align:center;letter-spacing:4px}
|
|
ol.man-decor li.tr {text-align:right;float:right}
|
|
</style>
|
|
</head>
|
|
<!--
|
|
The following styles are deprecated and will be removed at some point:
|
|
div#man, div#man ol.man, div#man ol.head, div#man ol.man.
|
|
|
|
The .man-page, .man-decor, .man-head, .man-foot, .man-title, and
|
|
.man-navigation should be used instead.
|
|
-->
|
|
<body id='manpage'>
|
|
<div class='mp' id='man'>
|
|
|
|
<div class='man-navigation' style='display:none'>
|
|
<a href="#NAME">NAME</a>
|
|
<a href="#SYNOPSIS">SYNOPSIS</a>
|
|
<a href="#DESCRIPTION">DESCRIPTION</a>
|
|
<a href="#OPTIONS">OPTIONS</a>
|
|
<a href="#TPM1-X-BACK-END-CONFIGURATION">TPM1.X back-end configuration</a>
|
|
<a href="#AUTHOR">AUTHOR</a>
|
|
<a href="#SPECIAL-THANKS">SPECIAL THANKS</a>
|
|
<a href="#REPORTING-BUGS">REPORTING BUGS</a>
|
|
<a href="#SEE-ALSO">SEE ALSO</a>
|
|
</div>
|
|
|
|
<ol class='man-decor man-head man head'>
|
|
<li class='tl'>zfs-tpm1x-change-key(8)</li>
|
|
<li class='tc'></li>
|
|
<li class='tr'>zfs-tpm1x-change-key(8)</li>
|
|
</ol>
|
|
|
|
|
|
|
|
<h2 id="NAME">NAME</h2>
|
|
<p class="man-name">
|
|
<code>zfs-tpm1x-change-key</code> - <span class="man-whatis">change ZFS dataset key to one stored on the TPM</span>
|
|
</p>
|
|
<h2 id="SYNOPSIS">SYNOPSIS</h2>
|
|
|
|
<p><code>zfs-tpm1x-change-key</code> [-b file] <var>dataset</var></p>
|
|
|
|
<h2 id="DESCRIPTION">DESCRIPTION</h2>
|
|
|
|
<p>To normalise <code>dataset</code>, <span class="man-ref">zfs-tpm1x-change-key<span class="s">(8)</span></span> will open its encryption root in its stead.
|
|
<span class="man-ref">zfs-tpm1x-change-key<span class="s">(8)</span></span> will <em>never</em> create or destroy encryption roots; use <strong><a class="man-ref" href="https://manpages.debian.org/bullseye/zfsutils-linux/zfs.8.en.html">zfs<span class="s">(8)</span></a> change-key</strong> for that.</p>
|
|
|
|
<p>First, a connection is made to the TPM, which <em>must</em> be TPM-1.X-compatible.</p>
|
|
|
|
<p>If <code>dataset</code> was previously encrypted with tzpfms and the <em>TPM1.X</em> back-end was used, the metadata will be silently cleared.
|
|
Otherwise, or in case of an error, data required for manual intervention will be printed to the standard error stream.</p>
|
|
|
|
<p>Next, a new wrapping key is be generated on the TPM, optionally backed up (see <a href="#OPTIONS" title="OPTIONS" data-bare-link="true">OPTIONS</a>),
|
|
and sealed on the TPM;
|
|
if the SRK passphrase, set when taking ownership, is not "well-known" (all zeroes), the user is prompted for it;
|
|
the user is always prompted for an optional passphrase to protect the key with.</p>
|
|
|
|
<p>The following properties are set on <code>dataset</code>:</p>
|
|
|
|
<ul>
|
|
<li>
|
|
<code>xyz.nabijaczleweli:tzpfms.backend</code>=<code>TPM1.X</code>
|
|
</li>
|
|
<li>
|
|
<code>xyz.nabijaczleweli:tzpfms.key</code>=<em>(parent key blob)</em><code>:</code><em>(sealed object blob)</em>
|
|
</li>
|
|
</ul>
|
|
|
|
<p><code>tzpfms.backend</code> identifies this dataset for work with <em>TPM1.X</em>-back-ended tzpfms tools
|
|
(namely <span class="man-ref">zfs-tpm1x-change-key<span class="s">(8)</span></span>, <span class="man-ref">zfs-tpm1x-load-key<span class="s">(8)</span></span>, and <span class="man-ref">zfs-tpm1x-clear-key<span class="s">(8)</span></span>).</p>
|
|
|
|
<p><code>tzpfms.key</code> is a colon-separated pair of hexadecimal-string (i.e. "4F7730" for "Ow0") blobs;
|
|
the first one represents the RSA key protecting the blob,
|
|
and it is protected with either the password, if provided, or the SHA1 constant <em>CE4CF677875B5EB8993591D5A9AF1ED24A3A8736</em>;
|
|
the second represents the sealed object containing the wrapping key,
|
|
and is protected with the SHA1 constant <em>B9EE715DBE4B243FAA81EA04306E063710383E35</em>.
|
|
There exists no other user-land tool for decrypting this. (TODO: make an LD_PRELOADable for extracting the key maybe)</p>
|
|
|
|
<p>Finally, the equivalent of <strong><a class="man-ref" href="https://manpages.debian.org/bullseye/zfsutils-linux/zfs.8.en.html">zfs<span class="s">(8)</span></a> change-key -o keylocation=prompt -o keyformat=raw dataset</strong> is performed with the new key.
|
|
If an error occurred, best effort is made to clean up the properties,
|
|
or to issue a note for manual intervention into the standard error stream.</p>
|
|
|
|
<p>A final verification should be made by running <strong><span class="man-ref">zfs-tpm1x-load-key<span class="s">(8)</span></span> -n dataset</strong>.
|
|
If that command succeeds, all is well,
|
|
but otherwise the dataset can be manually rolled back to a password with <strong><span class="man-ref">zfs-tpm1x-clear-key<span class="s">(8)</span></span> dataset</strong> (or, if that fails to work, <strong><a class="man-ref" href="https://manpages.debian.org/bullseye/zfsutils-linux/zfs.8.en.html">zfs<span class="s">(8)</span></a> change-key -o keyformat=passphrase dataset</strong>), and you are hereby asked to report a bug, please.</p>
|
|
|
|
<p><strong><span class="man-ref">zfs-tpm1x-clear-key<span class="s">(8)</span></span> dataset</strong> can be used to clear the properties and go back to using a password.</p>
|
|
|
|
<h2 id="OPTIONS">OPTIONS</h2>
|
|
|
|
<dl>
|
|
<dt>
|
|
<code>-b</code> <em>file</em>
|
|
</dt>
|
|
<dd>Save a back-up of the key to <em>file</em>, which must not exist beforehand.
|
|
This back-up <strong>must</strong> be stored securely, off-site.
|
|
In case of a catastrophic event, the key can be loaded by running <strong><a class="man-ref" href="https://manpages.debian.org/bullseye/zfsutils-linux/zfs.8.en.html">zfs<span class="s">(8)</span></a> load-key dataset < backup-file</strong>.</dd>
|
|
</dl>
|
|
|
|
<h2 id="TPM1-X-back-end-configuration">TPM1.X back-end configuration</h2>
|
|
|
|
<h3 id="TPM-selection">TPM selection</h3>
|
|
|
|
<p>The tzpfms suite connects to a local <a class="man-ref" href="https://manpages.debian.org/bullseye/trousers/tcsd.8.en.html">tcsd<span class="s">(8)</span></a> process (at <code>localhost:30003</code>) by default.
|
|
Use the environment variable <code>TZPFMS_TPM1X</code> to specify a remote TCS hostname.</p>
|
|
|
|
<p>The TrouSerS <a class="man-ref" href="https://manpages.debian.org/bullseye/trousers/tcsd.8.en.html">tcsd<span class="s">(8)</span></a> daemon will try <code>/dev/tpm0</code>, then <code>/udev/tpm0</code>, then <code>/dev/tpm</code>;
|
|
by occupying one of the earlier ones with, for example, shell redirection, a later one can be selected.</p>
|
|
|
|
<h3 id="See-also">See also</h3>
|
|
|
|
<p>The TrouSerS project page at <a href="https://sourceforge.net/projects/trousers" data-bare-link="true">https://sourceforge.net/projects/trousers</a>.</p>
|
|
|
|
<p>The TPM 1.2 main specification index at <<a href="https://trustedcomputinggroup.org/resource/tpm-main-specification" data-bare-link="true">https://trustedcomputinggroup.org/resource/tpm-main-specification</a>>.</p>
|
|
|
|
<h2 id="AUTHOR">AUTHOR</h2>
|
|
|
|
<p>Written by наб <<a href="mailto:nabijaczleweli@nabijaczleweli.xyz" data-bare-link="true">nabijaczleweli@nabijaczleweli.xyz</a>></p>
|
|
|
|
<h2 id="SPECIAL-THANKS">SPECIAL THANKS</h2>
|
|
|
|
<p>To all who support further development, in particular:</p>
|
|
|
|
<ul>
|
|
<li>ThePhD</li>
|
|
<li>Embark Studios</li>
|
|
</ul>
|
|
|
|
<h2 id="REPORTING-BUGS">REPORTING BUGS</h2>
|
|
|
|
<p><<a href="https://todo.sr.ht/~nabijaczleweli/tzpfms" data-bare-link="true">https://todo.sr.ht/~nabijaczleweli/tzpfms</a>></p>
|
|
|
|
<p><<a href="mailto:~nabijaczleweli/tzpfms@lists.sr.ht" data-bare-link="true">~nabijaczleweli/tzpfms@lists.sr.ht</a>>, archived at <<a href="https://lists.sr.ht/~nabijaczleweli/tzpfms" data-bare-link="true">https://lists.sr.ht/~nabijaczleweli/tzpfms</a>></p>
|
|
|
|
<h2 id="SEE-ALSO">SEE ALSO</h2>
|
|
|
|
<p><<a href="https://git.sr.ht/~nabijaczleweli/tzpfms" data-bare-link="true">https://git.sr.ht/~nabijaczleweli/tzpfms</a>></p>
|
|
|
|
<ol class='man-decor man-foot man foot'>
|
|
<li class='tl'>tzpfms developers</li>
|
|
<li class='tc'>October 2020</li>
|
|
<li class='tr'>zfs-tpm1x-change-key(8)</li>
|
|
</ol>
|
|
|
|
</div>
|
|
</body>
|
|
</html>
|